Last October, we shot out a heads-up regarding an out-of-band update from Microsoft. An out-of-band update is one that is released outside of the patch Tuesday update schedule, the well-known pattern Microsoft has established for releasing updates to its products on the second Tuesday of each month.

Today, Microsoft has released another out-of-band update. This update fixes a critical security hole in Internet Explorer that could allow an attacker to compromise a system and gain control over it. Microsoft doesn’t release out-of-band updates often, so when they do you can know that they’re fairly critical.

Read more about today’s critical update from Microsoft’s website.

Just because you’ve switched to Opera or Safari or Chrome or Firefox and don’t use Internet Explorer regularly doesn’t mean you should ignore this update. It’s our belief that IE is so integrated into so many parts of Windows that it’s much better to be safe than sorry. Updates are easy and you should check for them frequently and install them immediately. Here are a few tips.

• If you’re still using XP, go to update.microsoft.com and install all available updates.
• If you’re running Vista, congratulations. Windows Update is a start menu item and can be accessed from there.
• If you’re running IE7, upgrade to IE8 even if you don’t regularly use Internet Explorer.

Microsoft isn’t the only company that releases updates. Last September, we wrote about a great service called Secunia that you can run to tell you what other programs on your computer have updates that are available. It would probably be a good idea to run their free web scan to check if you’re using an outdated version of Flash, Java, iTunes or any other program that has recently patched security holes.

I’ve spoken with many auctioneers recently who are at the beginning stages of a new technology project, usually a website redesign or new build of some kind. The questions everyone asks mostly revolve around the expectations they should have of the person or company being hired to build the website.

A mockup is essential to give to your provider - don't let the provider design the site

I’ve put together some content that I consider important to include in an RFP – request for proposal. It’s by no means exhaustive, and at least some parts of it will have to be changed for every application, but it’s a start to a baseline set of what I believe to be good standard practices when entering into a relationship with a service provider.

For the purposes of this post, buyer is auctioneer, seller is service provider, employee is a backend user and user is frontend user. We’re going to assume that the buyer will provide a mock-up created by a designer. This mock-up would show exactly the layout and presentation requested by the buyer so that all the seller has to do is build the site using web standards. This draft assumes that your provider will install the website on a purchased or rented server controlled by the buyer. It assumes that the buyer has an email list system – I recommend phpList – and wants ownership of the auction calendar as opposed to using a third party’s auction calendar like that from Auction Services or AuctionZIP. I’m neither endorsing nor recommending against either of those popular auction website providers, I’m merely giving an example of a possible permutation. Perhaps a third party calendar is desired, as well as housing the site on the seller’s servers. Each auctioneer’s needs and desires are different.

I’ve intentionally tried to stay away from most functional pieces of a good website and focus instead on the deliverables and legal requirements that should set the ground rules of a work for hire.

Website must include a calendar system that will facilitate easy creation and display of auction title, date, time, location and thumbnail images. Frontend layout is provided by attached mock-up. Backend must allow upload of images, auction event creation and modification and be available only over secure connection. Seller must install security certificate on buyer’s environment if it doesn’t already exist. Backend login must be employee-specific with ability to grant access to various resources to various employees.

Email subscription form must allow direct subscription ability and integration with a bulk email list management system such as phpList or Intersend.

Sales lead generation form must email leads to email address or addresses as specified by buyer or employees in the backend.

In order to anticipate future browser compatibility we require conformance to the following W3C standards.

1. Markup must validate to the W3C’s XHTML 1.1 doctype at http://www.w3.org/TR/xhtml11/
2. Style sheets must validate to the W3C’s CSS 2.1 format at http://www.w3.org/TR/CSS21/
3. Javascript will never use browser detection but instead object detection to test for browser support of properties, arrays and methods.
4. Site must not use tables for layout purposes. Tables will only be used for tabular data.
5. Website must be tested to display similarly in current and the last major release of Internet Explorer, Mozilla Firefox, Apple Safari, Opera, Konqurer, and Google Chrome on stock installations of Microsoft Windows XP and Vista, Apple OS X and Ubuntu Linux where each browser is available on each operating system, as well as Internet Explorer 5 and 6.

Deliverables:

1. All deliverables must be installed by seller on buyer’s environment.
2. All deliverables will be considered “work made for hire” under U.S. Copyright law. Buyer will receive exclusive and complete copyrights to all work purchased. Any use of open-source content must be expressly defined and agreed to by buyer before implementation.
3. No dependence on outside services is allowed. The website must function completely and independently of any third party site, service or server, unless expressly permitted by buyer.
4. Seller will have no rights to use, reproduce or access any content, materials or other information stored on the website, including but not limited to form submission, customer information, email addresses, sales data and account records.
5. Work must be original and not based on existing templates or previously-constructed components used by other customers of the seller.

Successful proposal will include the following components.

1. Bid for construction of website using web standards with layout defined by provided mock-up and functionality defined above. This construction must include documentation and training sufficient for buyer to understand and operate site completely and effectively.
2. Estimate of time to completion as well as financial implications of delays should they occur due to additional requests made by buyer or developmental hardships experienced by seller.
3. Bid for continued ad-hoc support and maintenance on an hourly basis. Support must be provided by website creator if that person is different from seller.
4. List of hours with guaranteed availability for support.
5. List of five websites created by seller and contact information of website owners to serve as list of references.

Now, I realize that this draft is very strict. Some providers may balk completely, and some that don’t balk may intentionally price themselves out of the competition because, like using perfect English, using web standards is hard for some. Hopefully, however, this example may serve as a valuable starting point for someone looking to start from scratch. Compromises may be desired on certain parts, like XHTML validation, but an auctioneer should always retain the rights to your data (deliverable 4) and be sure that the provider will support the product after it’s built. Above all, be sure to have a very clearly-defined, counsel-approved contract that you can use to hold the service provider accountable should you believe that the work is incomplete or incorrect.

Writing an example RFP was requested by many. These are some of my ideas. Do you have a must-have condition for the work that you hire done? Leave a comment so we can build on this document and add it to the resources page.

You’re listening to the AuctioneerTech Auction Podcast for the week of 15 September 2008.

AuctioneerTech – Technology, auctions and auctioneers – auction tech for the auction industry

Hello and welcome to the third episode of the AuctioneerTech Auction Podcast, tech roundup one. We’re going to cover some of the previous two weeks’ stories from auctioneertech.com. We’ll talk about Google Chrome, OpenOffice 3, Secunia, new products from Apple and finish by trying to explain what Twitter is and how to use it.

There’s been a lot of activity over the last two weeks in the industry regarding Google’s release of it’s entry into the new browser wars, Google Chrome. You may remember the last browser wars of the late 1990s with websites claiming to be best viewed in one web browser or another. A browser is simply a program that you use to browse web pages. Perhaps you remember the annoying Netscape Now! Buttons. Microsoft won the browser war, pushing the now defunct Netscape Navigator out of the way with its Internet Explorer product. With Netscape out of the way, Microsoft has ruled the web for many years. There are many other browsers like Epiphany, Opera, Galleon and Konquerer, but recently Mozilla’s Firefox browser has been taking market share away from Microsoft, and Apple released its Safari browser on Windows in 2007 and captured some of its fans who had been relegated to the Windows platform for one reason or another. Google’s entry into the new war was unexpected, but in retrospect not very surprising.

Chrome has a new Javascript engine called V8 so it’s fast, and it’s running on Webkit so it’s pretty. I’ve been playing with it for the last two weeks,and I like how it puts the tabs in line with the minimize / maximize / close buttons at the very top – I’ve wanted this in a browser for years. They have a long way to go to enable other features, but it’s blazing fast and minimalistic, which are two big pluses in my book.  It puts Firefox to shame in the coolness category, and while it has a ways to catch up when it comes to community and available plugins, it’s still faster and sexier and what I’ll be using until Microsoft puts Internet Explorer 8 on the ground.

My recent experiences with Chrome are common, but there are auctioneers and other users who claim that Chrome is slow. While I haven’t noticed this with a new instance of Chrome, when I load several tabs I have noticed that it seems to use a fair amount of memory. Some users have noted that Chrome is slow rendering PDFs and running Java.

Speaking of Java, my friend and fellow auctioneer Don Hamit pointed out to me at the KAA auctioneer contest on Wednesday that Chrome doesn’t work with the recently-funded real-time Internet bidding platform Proxibid. I was able to get the Proxibid Bidder App to run in Chrome on XP and Vista. Here’s how to get it, and other Java applications, to run on Chrome.

First of all, Java is a browser add-on that functions as a virtual machine. It’s a way for programmers to write code for an interpreted environment which in turn can be installed on multiple devices, operating systems and browsers. Rather than writing specific code for IE on Windows and then starting from scratch to write code on Safari on Mac, a programmer can choose to write an application in Java and have it run in the Java environment on both platforms.

As of the recording of this podcast, Chrome doesn’t work yet with any current version of Java. In order to get Java applications to run on Chrome, you have to download a pre-release, or beta, version of Java called Java SE 6 update 10 release candidate. There’s a link to this update on auctioneertech.com.

Once you’ve downloaded and installed it, the only other difference between Chrome and other browsers I’ve used is that Chrome treats the Java .jnlp file as a download rather than something that can be automatically executed. That only means that you have to open the file once it’s downloaded. I was able to simply click on the file at the bottom of the screen in Chrome to get it to run in XP. In Vista I had to click the arrow to bring up the menu and then select ‘run’.

September 5 saw the release of the first release candidate of OpenOffice version 3, the free and open source alternative to Microsoft Office.

The last thing an auctioneer needs when starting out or outfitting employees or workstations with new computers is to have to pay upwards of $200 for a copy of a piece of software when a clearly sufficient and arguably superior alternative is available.

OpenOffice includes Writer and Calc, alternatives to Word and Excel, respectively. Their functionality is above the basic needs of word processing and number crunching. We’ve been using Calc for inventory uploads for quite some time. The only piece of Writer that we’ve had trouble with is the mail-merge. For that process, we still have to dust off a copy of Microsoft Word.

Version 3 of OpenOffice brings a visual refresh, not to mention full-on support of Microsoft Office 2007 OOXML file formats – you know, those annoying .docx and .xlsx formats that everyone complains about when you MS Office 2007 users forget to use save-as before you email.

OpenOffice.org is a great alternative to Microsoft Office. It’s like different brands of cars. The gear-shift may be in a different place, but a Ford and a Chevrolet both go forwards and backwards at about the same speed. If you’ve driven a Ford all your life, you may feel a little different for the first hundred miles in your Chevrolet, but it’ll take you where you want to go. OpenOffice.org is open source and runs on Windows, Mac and Linux.

Let’s turn now to security. The tubes are full of baddies. It’s not enough anymore to simply install an antivirus package and pay your yearly virus tax. Antivirus is becoming outdated. Granted, it’s still a requirement for all but the most elite computer users, but in the time of the always-on Internet connection we need to protect ourselves against all kinds of attack vectors. An attack vector is merely a means by which someone or some automated program can compromise and, in the worst cases, gain access to an innocent user’s computer or network.

As today’s software becomes larger and as release cycles become shorter, there are security holes in everyday packages like browsers such as IE, Firefox, Safari, Opera and Chrome; add-ons like Flash, PDF readers, Java machines; applications like OpenOffice, Microsoft Office, Picasa and even the operating system itself like Linux, OSX or Windows.

Maintaining a constant watch over all of the programs that you may or may not even know you have installed can be a daunting task. Luckily, for the majority of you who are Windows users, a product called Secunia can help put your mind to rest.

Secunia offers three levels of protection. The first level, which is a no-brainer for everyone, is a free web scan. Simply launch your Java-enabled browser and it will scan 70 common programs to be sure they’re all up to date. If it finds a program that’s not the most current version, it lists it and provides links to explanations of the vulnerabilities in that older version. I was not able to get the program to run under Chrome. Since Chrome requires the latest Java 6 update 10 release candidate, it’s not all that surprising that it doesn’t support everything we throw at it. Just run Secunia’s online scan in IE for now to check your system.

The second level of protection is their PSI – Personal Software Inspector. The PSI is a free-for-personal-use application you download and install. It scans for over 6,900 possible programs to be sure all the software on your computer is up-to-date.

The third level of protection is for business and is called the NSI – Network Software Inspector. It makes it easy to maintain the same level of updates as the PSI but on multiple-system scale. It costs $30 per system per year.

Now I pride myself on keeping my software, nearly all of which is open-source, up to date. I have yet to run a scan on a machine where Secunia didn’t tell me at least one package was vulnerable. I’ll admit the business solution is a little steep for the average business, but the web scan is something that you should do right now and once every month. It’s free and crazy-easy and is one more asset in the responsible-computing tool belt.

Apple on Tuesday released new versions of their iTunes software as well as updated versions of iPods. This release was hardly surprising and, as predicted, there wasn’t anything unexpected or widely diverging from the rumors that had been floating around the Internet.

The take-aways are really fewer than I had expected. iTunes 8 is out and it’s cool. It seems to combine features found in web radio stations like Pandora and Last.fm where it will predict what you would like and automatically associates similar styles of music into playlists. They call this feature the ‘genius’ feature.

The Nano and Touch have both received a redesign, both in shape and price. The iPod Touch and iPhone have a software update that will be made available on Friday. That software update is free for users of the 2.0 software.

The Nano now has an accelerometer, like the iPhone and iPod touch. That’s the part that can tell which way is up so it can adjust the screen orientation based on the way you hold it. The Nano also has a microphone on the back. I don’t know if there is a time or size limit on the recordings, but at $199 for 16GB version, it would make a high quality voice recorder for auctioneers to use to catalog merchandise or to record auctions.

Apple also announced a new version of their iPod Touch. The Touch is essentially an iPhone without the phone, camera and GPS. The iPod Touch now has a speaker. That’s probably the biggest feature that was lacking from it. We’ve been using my girlfriend’s Touch as a timer when cooking, and it doesn’t work very well when you can’t hear it ding.

I ordered a Touch on Thursday, paying the extra $16 for next-day shipping. They didn’t say anywhere that it was going to originate in China. I received my Touch this morning, and I’ll have to say that going from Kunshan, China, to Shanghai to Anchorage to Indianapolis to Kansas City to Manhattan over the weekend isn’t bad for FedEx. I’m really happy with my Touch so far. I’ll probably continue to use my Microsoft Zune for my music and podcasts, but the Touch is really more of a small computer than it is a music device.

The one feature for which I was hoping in the Touch that didn’t apparently seem to be added is GPS. I had hoped that they would find a way to push this feature into the new models. Even without GPS, though, I’m really enjoying the iPod apps such as AirSharing, Evernote, SplashKey, WordPress and Twitterific.

Twitter is a popular social network that can be called ‘micro-blogging’. Think of it as a way to post updates about what you’re doing. These updates can be sent by text message to update your status on twitter.com. Through the use of various plugins, you can incorporate these status updates into Facebook, MySpace, WordPress, Friendfeed and many other websites and website-management systems. I have Twitter integrated into my Facebook and my website so that every time I tweet it updates my Facebook status and my website. You can also use Twitter as a messenger service of sorts, using its ability to send direct messages to others.

Twitter is simple to use. Simply create an account, enter your mobile number, and Twitter will send a text message to you. When you reply, you’ve authorized your phone so that every time you send a message to that number it will update your Twitter page – this process is called “tweeting” or posting a “tweet”.

You can use Twitter effectively without the text messaging part, but it’s not nearly as fun. They do have applications for all operating systems, including the iPod and iPhone, as well as a Firefox plugin, but nothing seems to be as cool as the phone integration.

As a Twitter user, the two numbers that you grow are “followers” and “following”. “Following” describes those other users to whose updates you subscribe and “followers” describes those users who subscribe to your updates. As of today, the leader on Twitter is Barack Obama who has 76,691 people following him, followed by Digg founder Kevin Rose who has 62,679 followers. I think I have 25. :-[

The take away is that Twitter can be used as a bulk text messaging service. If your followers have device-updates enabled, each time you tweet they will get a text message with the contents of that tweet. Since they can follow you without turning on the phone updates, you don’t really know how many people actually get a text message, but if your followers go to twitter.com they can see your status.

It took me a while to find the value in Twitter. Since the people I initially followed didn’t know me, it kind of felt like I wasn’t involved with the community. Over the last six months that I’ve been using it, I’ve convinced some of my friends to join and so now the updates I receive and send become much more relevant. It’s quite fun and makes quick updates to websites very easy.

That’s it for episode three. I’m excited that as I was writing this episode, I received an email from Apple notifying me that the Auction Podcast will be made available in the podcast section of iTunes. My next task will be getting listed in Zune and other podcasting indices.

You’ve been listening to the Auction Podcast from AuctioneerTech. If you have suggestions, questions or comments, or are interested in being a guest, please let me know by going to http://www.auctioneertech.com/feedback and leaving a message. You can also post public comments about this or any other episode, as well as find show transcrip s, on the auction podcast page of auctioneertech.com.

Thank you for listening. Now go sell something.

My friend and fellow auctioneer Don Hamit pointed out to me at the KAA auctioneer contest yesterday that the recently-released Chrome doesn’t work with the recently-funded real-time Internet bidding platform Proxibid. I was able to get the Proxibid Bidder App to run in Chrome on XP and Vista. Here’s how to get it, and other Java applications, to run on Chrome.

Java is a browser add-on that functions as a virtual machine. It’s a way for programmers to write code for an interpreted environment which in tern can be installed on multiple devices, operating systems and browsers. Rather than writing specific code for IE on Windows and then starting from scratch to write code on Safari on Mac, a programmer can choose to write an application in Java and have it run in the Java environment on multiple platforms.

Chrome doesn’t work with any current version of Java. In order to get Java applications to run on Chrome, you have to download a pre-release, or beta, version of Java called Java SE 6 update 10 RC.

Once you’ve downloaded and installed it, the only other difference between Chrome and other browsers I’ve used is that Chrome treats the Java .jnlp file as a download rather than something that can be automatically executed. That only means that you have to open the file once it’s downloaded. I was able to simply click on the file at the bottom of the screen to get it to run in XP. In Vista I had to click the arrow to bring up the menu and then select ‘run’.

If you have other difficulties with Proxibid or find other applications that don’t work in Chrome other than the previously-mentioned Secunia web scan, let me know in the comments.

The tubes are full of baddies. It’s not enough anyomore to simply install an antivirus package and pay your yearly virus tax. Antivirus is becoming outdated. Granted, it’s still a requirement for all but the most elite computer users, but in the time of the always-on Internet connection we need to protect ourselves against all kinds of attack vectors. An attack vector is a means by which someone or some automated program can compromise and, in the worst cases, gain access to an innocent user’s computer or network.

As today’s software becomes larger and as release cycles become shorter, there are security holes in everyday packages like browsers (IE, Firefox, Safari, Opera and Chrome), add-ons (Flash, PDF readers, Java machines), utilities (OpenOffice, Microsoft Office, Picasa) and even the operating system itself (Linux, OSX, Windows).

Maintaining a constant watch over all of the programs that you may or may not even know you have installed can be a daunting task. Luckily, for the majority of you who are Windows users, a product called Secunia can help put your mind to rest.

Secunia offers three levels of protection. The first level, which is a no-brainer for everone, is a free web scan. Simply launch your Java-enabled browser and it will scan 70 common programs to be sure they’re up to date. If it finds a program that’s not the most current version, it lists it and provides links to explanations of the vulnerabilities in that older version. I wasn’t able to get the program to run under Chrome. Since Chrome requires the lastest Java 6 update 10 release candidate, it’s not all that surprising that it doesn’t support everything we throw at it. Just run Secunia’s online scan in IE for now to check your system.

The second level of protection is their PSI – Personal Software Inspector. The PSI is a free-for-personal-use application you download and install. It scans for over 6,900 possible programs to be sure all the software on your computer is up-to-date.

The third level of protection is for business and is called the NSI – Network Software Inspector. It makes it easy to maintain the same level of updates as the PSI but on a multiple-system scale. It costs $30 per system per year.

I pride myself on keeping my software, nearly all of which is open-source, up to date. I have yet to run a scan on a machine where Secunia didn’t tell me at least one package was vulnerable. I’ll admit the business solution is a little steep for the average business, but the web scan is something that you should do right now and once every month. It’s free and crazy-easy and is one more asset in the reponsible-computing tool belt.

Google screenshot showing Chrome download link position

Google today, seemingly confident enough about their new browser, posted a link on their homepage for the download.

While a significant percentage of the news I read over the course of the last week involved Chrome and the browser wars, I’m guessing that the news escaped the average Fox News viewer. 

Now everyone knows. Everyone who uses Windows, that is. The link doesn’t appear on Linux. I’m curious why they’re displaying the link on users who are actually using Chrome, as the screenshot to the right was taken inside the Chrome browser. If they’re so worried about their homepage as to sniff for user agent to see that the user isn’t running Linux (and I presume OSX) before displaying the link, you’d think they’d go the extra line of code to only display the link to users running browsers other than Chrome. I’ve already looked at the browser’s agent string – the header line that identifies the browser to the server – and it does list itself as Chrome. 

I digress. The beauty of the sparsity of the Google homepage is that the nine words that make up the additional Chrome link represent such a significant percentage of the words on the page that it has the same effect of a big, flashing, yellow banner on any other site.

Google’s page teaches us an important concept. If you want to make a bigger impact on your users, reduce page weight. It’s tough, but we can all agree how effective it can be. Users want content. We should give it to them.

Google Chrome logo

Google released its entry into the browser wars Today. I’ve been playing with it all day. I like how it puts the tabs in line with the minimize / maximize / close buttons. I’ve wanted this in a browser for years. They have a long way to go to enable other features, but it’s blazing fast and minimalist, which are two big pluses in my book.

Chrome has a new Javascript engine so it’s fast. Goofy fast. Melt your face fast. It’s running on Webkit so it’s pretty. Kate Bosworth pretty. Kate Bosworth in 21 pretty. I tried to get it to run on Linux using WINE and, while I got it to load, it didn’t work well enough to render any pages without crashing. It puts Firefox to shame in the coolness category, and while it has a ways to catch up when it comes to community and available plugins, it’s still faster and sexier and what I’ll be using until Microsoft puts IE8 on the ground.

Some auctioneers, as well as my sister, have claimed that Chrome runs slower than Firefox and IE. Some speed tests have claimed that Firefox may be just as fast, though I haven’t see this behavior. If you’ve seen Chrome running slowly, let us know in the comments.