Tales from the Crypto : Miscellany - not security

Why .NET apps keep crashing on your Tablet PC

Alun Jones — Sat, 07 Nov 2009 23:24:29 GMT

I’ve been struggling with this issue for some time.

I have a small, simple .NET application I wrote in Visual C# a few months ago – I’ve tentatively titled it “iFetch”, because it fetches radio shows from the BBC iPlayer.

It really is very little more than a simple data grid view that displays the details of the shows and allows users to select them for downloading and later listening.

Despite that, I’ve had some terrible trouble with it. Sometimes it’ll work perfectly, other times it’ll just suddenly crash, and apparently without warning and for different reasons – sometimes when I click on a row, other times when I select to sort on a column heading.

The crash seems to be intermittent, but doesn’t reproduce on other computers; even computers of the same configuration.

For those who want technical details, here we go – the crash is a System.StackOverflowException error, and appears to be due to an unchecked infinite recursion in System.Windows.Forms.dll!System.Windows.Forms.DataGridViewRow.DataGridViewRowAccessibleObject.Bounds.get().

The clue here is that this is a “DataGridViewRowAccessibleObject” – not a mere DataGridViewRow. These “AccessibleObject” versions of common .NET components only come into existence and spread their effect when an “accessibility application” is active on the system. Apparently, in addition to text-to-speech readers, braille devices, etc, a Tablet – whether external like mine, or internal like those in a Tablet PC – classifies as an accessibility application.

That’s why this bug was intermittent for me – sometimes I had my external graphics tablet plugged in, other times I didn’t. To make matters worse, it seems to only trigger when one or more rows in the DataGrid are hidden.

If you get this error, first try checking to see if Microsoft have fixed the flaw – check for .NET service packs – and then, if there is no direct fix for the flaw, try either unplugging your tablet, if you can, or temporarily stop the Tablet PC Input Service, while running the program.

So far, I have received no feedback from Microsoft about when this will be fixed.

Windows 7 – what it’s missing

Alun Jones — Fri, 23 Oct 2009 04:16:26 GMT

Unless you’ve been living under a rock, you’ll be aware that today was the release of Microsoft’s latest operating system version, Windows 7.

So, everyone else has their own ideas of what’s missing in Windows 7, here’s my list, and it’s not the same petty focus that everyone else seems to have. Mine is based on what I want, rather than what’s remotely close to being reasonably achievable.

Media Center devices to provide support for DirecTV.
Trimmable transparent screen overlays supporting multi-touch input.
IPv6 support from my home ISP.
A web browser that opens quickly enough that I don’t forget what I was about to browse to.
A tool to answer “why is the system so slow right now?” – especially on those occasions when the CPU is not being over-taxed.
A free Zune HD. (Why not, since I’m dreaming here.)
Simple facilities to allow electronic commerce to operate on ‘zero knowledge’ principles, so that I would share my credit card account number only with my credit card provider, rather than with every merchant I might do business with. (Maybe Infocard or something like it could come close to fulfilling this wish)
An “Expert” mode, where menus are visible, files and file extensions are not hidden in Explorer. (For that matter, file extensions should not be hidden in Explorer. Ever.)
MSN – excuse me – Windows Live Messenger that works in a somewhat rational way, back in the system tray, rather than as a minimised icon.

So, what are the things in your twisted imaginings that would turn Windows 7 from this kind of Seven:

into this kind?

[Note: Having said all of this, it should be clear by now that I think Windows Seven is well worth having. But I still want more!]

Google bans MVP

Alun Jones — Fri, 02 Oct 2009 15:36:16 GMT

Google certainly sounds like it’s a nice place to work. Table football, free lunches, that whole “don’t be evil” mantra, and the requirement to spend 20% of your time on projects that aren’t specifically to do with any particular company goal (with the obvious intent that some of those projects will result in interesting discoveries and/or personal development that the company can use).

But I can’t say that I’ll be applying there, at least until they publicly state that they are permanently reversing a decision they made in the last few weeks.

What did Google do that was, to my mind, so very close to evil?

Google told Jon Skeet that he shouldn’t accept the Microsoft MVP Award that was offered to him, despite the fact that he’s been awarded for the sixth year in a row.

Remember, this is a retrospective award – it is a recognition of what you have done for the community of Microsoft’s users, not a request or obligation to do anything in the future or act in a particular way.

Jon’s award stems from his frequent, continued and voluntary assistance to other C# developers.

As far as I can tell, Google has not told Jon to stop helping C# developers, and certainly his blog is still up, his support pages and FAQs are still up, and he’s still posting helpful advice on C#.

I could even understand if they said “don’t go to the annual MVP Summit”, or “don’t advocate Microsoft products” (although that’s not expected of MVPs, who bristle at the slightest suggestion of being ‘evangelists’).

So, Google’s not angry with his behaviour – they are angry with his being recognised and rewarded, by Microsoft, for that helpful volunteer behaviour.

My own C# projects have benefitted on numerous occasions from finding an article Jon has posted on the Internet. I’d like to thank him for that, and I hope he isn’t required by Google to reject my gratitude as well.

Thanks, Jon Skeet, for all you do for the C# developer community.

Thanks, Google, for reminding us that there’s a line that divides “evil” from simply “really, really bad”.

[Note: Please feel free to pass this posting on. I’d like to see Google feel very very ashamed for this, and to recant. If only because Jon will be eligible every quarter for the MVP award, and he’s going to get awfully tired of refusing it over and over. News coverage would be great, but I don’t see any at the time of writing on Bing’s News search.]

Zune HD – but not mine

Alun Jones — Wed, 16 Sep 2009 04:36:00 GMT

A friend of mine ordered a Platinum Zune HD recently (that’s the 32GB model), and because he was unable to receive the shipment, asked for me to open it for him and check on its functionality to make sure he hadn’t been shipped a lemon.

Since I’ve previously commented on the Zune 30 that my wife bought for my birthday, I thought I’d have a quick look and see what I like about it.

The demonstration video is stunning, and shows off the display impressively. The display is wonderfully bright, and fulfils every bit of the promise of OLED technology. Light-weight, thin, amazingly bright and detailed.

Installing the new Zune software from http://www.zune.net/setup went smoothly, although when the player was plugged in, the Zune software immediately insisted on a Player update. The Zune needs to be updated from 4.0 to 4.1 already.

This may come as a surprise, but really it’s not too shocking. There’s a considerable gap between preparing a bunch of hardware for simultaneous shipping and the actual delivery, during which time there may be some interesting bugs discovered. Possibly this time, the bug is that the charge indicator doesn’t light in version 4.0, but does light up in version 4.1. At least, that’s a change I noticed.

So, have any of my previous complaints been addressed? Given the timing of my last post, close to the end of the Zune HD’s development, I doubt that Microsoft had a chance to fix the problems I noted, and I seem to be correct about that.

You can still put MP3 files into your Podcast folder and give them a genre of “Podcast” in order to make them work like Podcasts (i.e. remembering their position while you go do other things), but the images tied into the MP3 files are still not displayed along with those podcasted MP3s. And they still don't play ordered by track number, preferring instead to use some bizarre combination of date and textual sort, with some apparent randomness thrown in.

It appears so far that all of the other issues I’ve encountered are still there, so I’m still waiting for someone at Microsoft to address those and deliver a Zune (updated firmware, software, or hardware) that is absolutely perfect. If they could make it cheaper, too, it would be easier to justify a purchase.

But man, I love that bright display on the new Zune HD. I just wish I didn’t have to part with this one so soon. I guess I’d better save my Amazon gift cards…

Dreaming of the future...

Alun Jones — Sun, 12 Jul 2009 23:41:39 GMT

Here are some technologies I just can't wait for:

OLEDs:
- for room lighting - ambient light from ceiling-tile sized light panels [those of us that suffer migraines want an alternative to fluorescent lights, compact or otherwise]
- for either back-lighting of LCD screens, or for the screen itself - I didn't know until after I bought it that my laptop uses a fluorescent bulb for the backlight. When the battery gets low, I can see it flicker, and I have to turn it off or risk another migraine.
- Are they green? They're any colour you want, baby!
- Oh, you mean are they ecologically sound? Far more so than incandescent, fluorescent, effervescent, evanescent or putrescent. Incandescent bulbs burn way more power; fluorescent bulbs have mercury - and, surprisingly, burn way more power for the amount of light they put out than equivalent LEDs or OLEDs.
- OLEDs are cool to the touch - perhaps in some climates this means you'll have to run your heater more, but really, you don't think a light-bulb is an efficient heat generator, do you?
Multi-touch support, including fingertip and stylus support.
- Windows 7 (which I thought would be called "Viista") will feature multi-touch support, where users will grab objects with a couple of fingers, to more naturally twist and scale them.
- Stylus support would allow drawing and writing - I wish I had an excuse to get a Tablet PC, but I just can't afford to sacrifice power in order to get that capability. Maybe I'll buy a cheap USB tablet to plug in at the side.
Single sign-on through the use of federated identity.
- Okay, that one probably needs some explanation.
- I'm tired - so tired - of one password here, a different password there, here I'm "alunj", there I'm "aljones", another place I'm ma7amj, yet another place AMJ10.
- I want to enter one user name, one password, and be able to authenticate to everywhere.
- Of course, that would mean everywhere would have to trust the one user name and one password - and if that isn't carefully monitored, you'll see people tying their bank accounts and nuclear secrets to a one character password. This requires some thought.
Transflective displays.
- Tra-wha?
- Put simply, if it's light enough to read a piece of paper, I want to be able to use my laptop. And if it's really, really bright, I want to be able to use my laptop.
- No backlights - I want the screen to be like coloured paper, reflecting ambient light.
- That'll cut down on weight, battery consumption, and probably also frame rate in games. Can't have everything :)
Wi-tricity
- Wireless electricity.
- Sure, it's going to bombard me with electrons, but only if I'm resonant. Otherwise, it'll power my technology without requiring that it all be tethered to the wall.
Wide-spread adoption of IPv6
- Heck, even though Microsoft installs IPv6 by default in Vista and Server 2008, there still isn't an IPv6-based Microsoft "front page".
- www.ipv6.microsoft.com has been dead for months.
- Akamai, which hosts www.microsoft.com, doesn't appear to know about IPv6.
- IPv6 brings us back to the way that nature intended the Internet to be - everyone's a peer node; everyone can be a server. Firewalls are firewalls, and NATs are non-existent.

Nice support from Lenovo

Alun Jones — Sun, 12 Jul 2009 19:11:01 GMT

I’ve been wanting to post this comment for some time, but never seemed to get around to it.

I’ve been through a number of different laptops over the last decade or so – Compaq, Dell, Gateway, and Toshiba – and each time, I’ve found that they just don’t seem to last. I can’t point to anything in particular – it’s never the same thing twice, but for one reason or another, I don’t get more than a couple of years’ life out of a laptop. Sometimes it’s physical failure – the screen breaks, the drive fails, the battery stops holding a charge – and sometimes it’s simply that the machine is too slow and impossible to upgrade to support me as new software is needed.

Unless I buy a ThinkPad.

It’s not that the ThinkPad doesn’t have its problems – it’s more that IBM support always made things right. When the CD-R drive on my first ThinkPad started failing, I called them up, and they quickly sent me a replacement (taking, as usual, my credit card number as guarantee in case I didn’t send them the drive back). The replacement turned out to be a DVD-R drive, so I was ahead on that deal – particularly since the failure happened right at the end of the warranty period.

So my more recent ThinkPad concerned me, coming as it did with a Lenovo sticker instead of IBM.

As usual, problems with the laptop happened once in a while. About six months in, the laptop battery stopped retaining its charge. I’m used to companies telling me that the battery is only warranted for 90 days, and that when batteries stop holding their charge, it’s because of my usage patterns (whatever that means – isn’t a battery supposed to be used when you’re on the bus or train, or in a meeting?)

Not these guys, no, they sent me a replacement battery (after the ritual exchange of credit card numbers).

One persistent problem stayed with me from the first few months of the purchase of the laptop – the sound stuttered. Now, I should note here what I mean by “stuttered”, because I gather others have sound stuttering that isn’t the same problem as mine.

Imagine, if you will, that the speakers can handle sounds only “so” loud. Pass any sounds louder than that to them, and the sound ceases until the sound is back to a good volume. So, the timing of the sound is unaffected, it’s just as if someone’s repeatedly hammering the ‘mute’ button. Not a problem if everything’s normalised to below 70%, say, but then that’s difficult to listen to because it’s so quiet.

That’s the problem I had – the other sort of problem appears to be where the processing of the sound signal is held up, so the timing of the sound is affected, as if someone is hammering a ‘pause’ button repeatedly on and off.

I called Lenovo a couple of times about this, and assumed it was simply not going to be fixed, as they kept suggesting new drivers, or that I take it to a service centre where they would decide if it could be fixed there or had to be sent away. I wasn’t keen on the service centres they were suggesting.

Finally I reached the end of my warranty, and also the end of my patience with the problem – I was playing more and more stuff from BBC Radio (see a theme here?), and they were coming through normalised properly, rather than dead quiet. So, I either had to re-normalise everything myself, or get the problem fixed.

I called Lenovo, spoke to a nice man in North Carolina, and was told they’d have to look at the system. I’d have to send it in.

I hate being without my laptop – all the more so because I had to send in my hard drive as well. So, it’s make-a-backup time, plus delete-all-the-secrets. A box arrived, with paid shipping, I stuck the laptop in the box, and sent it back. Over Thanksgiving, so that “5 business days” became naturally closer to two weeks, and because it eventually took a while to fix the problem, closer to three weeks.

When I received the system back, I noticed a few things:

The sound problem had been fixed.
The mainboard had been replaced.
These repairs had all been done for free despite the fact that I was a couple of weeks past warranty expiration when I first called.

You’ll often hear people bad-mouthing non-US companies for having poor technical support that doesn’t speak English and can’t often help – and though this may be true for Lenovo’s online support ‘chat’ (where you type into a browser window), it’s not true for their phone support, and I really can’t argue with the quality of the warranty work they’ve done for me (and how comfortable they were stretching the warranty in the instance that I had been complaining for a while before the warranty expired).

Perhaps it’s a little sad that I have to post a glowing review like this of support that matches roughly what I would expect. But I think Lenovo deserves a pat on the back for this support, and I can only apologise that it has taken me so long to get around to doing so.

I will likely be buying another Lenovo ThinkPad when I finally need to dispose of this one.

Stupid Outlook 2007 RSS Feed Workaround

Alun Jones — Sat, 04 Jul 2009 17:59:54 GMT

I was starting to wonder why other people were getting news stories before me.

Then I realised I just wasn’t getting news at all.

Looking at my Unread RSS Feeds search folder in Outlook 2007, I noticed that I hadn’t received a single post since June 10th 2009. Coincidentally, this is when I installed a number of updates:

None of these updates had any “Known Issues” listed in the Knowledge Base articles associated with them that would stop feeds from updating, so I went searching.

First I went searching at Microsoft’s support page (a supported fix or workaround is generally so much safer and more reliable than an unsupported one), and found that this problem had indeed been fixed in the February 2009 Cumulative Update for Outlook 2007 (“RSS feeds become dormant and do not reactivate.”), which was incorporated into Outlook 2007 Service Pack 2. I’ve already installed those.

Great. They’re obviously talking about a completely different problem cause.

Next I go searching the web in general – I use Bing, simply because it’s easy to get to, and Google when I think the answer is more likely to be in the Usenet newsgroups (is it too much to ask Microsoft to maintain their own Usenet archive and search there from Bing?)

In this case, the web had sporadic references to people deleting “~last~.sharing.xml.obi” and “Outlook.sharing.xml.obi” – I would generally avoid doing this sort of change without a backup and a box of tissues to cry into when things go wrong. Deleting temporary files and hoping they get rebuilt is sometimes a miracle, and sometimes more of a magic trick, making things disappear without a trace. So I continued looking.

One question that was asked – and that I should have asked myself – is what kind of “feeds not updating” issue I was having. There are several kinds:

Feed data present, connection attempted, mismatch in dates
Feed data present, connection attempted, some other error
Feed data present, connection not attempted
Feed data not present

I was in the latter category – when I opened the Tools menu and selected Account Settings, the RSS Feeds tab contained only a few items, rather than the several dozen I was expecting to see. This is what I was expecting:

As it turns out, there is a simple and stupid workaround for this issue, which requires no deletion of files.

Navigate to the RSS Feeds folder (mine is under an RSS Feeds PST file, but if you selected the default, it’ll still be in your Personal Folders file), and for each feed that you’re missing, simply select the feed’s folder, as shown to the right.

For each folder you select, Outlook will display the downloaded items from that feed – and will slyly go behind the scenes to make sure that the feed is in the RSS Feeds tab.

For my several dozen feeds, this took a while, but wasn’t too bad.

[Note: Don’t try to navigate back through the folder history by holding down the ‘back’ key on your keyboard or Alt-Left Arrow – when I did this, Outlook crashed after zipping through a few folders.]

As you can see from my later screenshot of the “RSS Feeds” tab above, all my feeds are re-added, and a new sync caused them to be updated with new content.

It’d be really nice if this process could be automated for a number of folders at a time, to “refresh feeds from RSS Folders” – but for now, this is at least a workaround when you notice that you’re just not as well-informed as you used to be.

Zune – So Nearly Perfect, it Hurts

Alun Jones — Fri, 26 Jun 2009 05:17:39 GMT

For a while now, I’ve been listening to the BBC radio on my MP3 player – even wrote a program to download the audio of various programmes and convert them from RealAudio to MP3 so that I can listen to them on the bus or in my car on the way to and from work. First it was a 512MB Creative Muvo, then a Sandisk Sansa at 2GB.

Then on my birthday, my wife surprised me with a 30GB Zune, just what I wanted. I know there are other more recent models, but I can’t justify the expense of a 120GB model, and the others are too small of a display to be interesting. The Zune HD seems like it would be perfect, but I bet it’ll be too expensive for me to justify.

I really enjoy the Zune, and it solves many of the problems I’ve hated about the Sansa – the biggest being, as I described before, that it requires me to install (and carefully watch for sneaky encroachment) Quicktime, and to run the video/photo converter as an administrator.

So, now that the Zune solves the big problems, I’m starting to become aware of the less horrifying aspects of media player ownership.

Here are the first few little problems (note that this isn’t entirely insurmountable):

Playing a video, or a podcast, kills off the “Now Playing” list.
While you can resume a video, or a podcast, you can’t resume a playlist.
You can’t create a playlist on the device – although you can add Music selections to “Now Playing”, you can’t rename the list, and “Now Playing” gets killed off so easily.
You can’t resume a music item after you’ve paused it and played another. This makes the music folders useless for my radio programmes.
When playing an MP3 file in the music folder, if the MP3 file has a picture (in the ID3 Picture tag), the picture is cropped to fit the display – I’d rather see it shrunk.
Pictures from MP3 files are not displayed individually – one of them is selected as the “Album Art”, and is then displayed for all subsequent MP3s with the same ID3 Album tag. I’d rather see the pictures from the individual MP3s (who knows, maybe they’re important?)
MP3 files from the music folder appear in the “social” under your tag, and the system tries to guess what you’re listening to. Usually appallingly badly. For instance, I play “The Eureka Years”, a radio programme from the BBC, recorded as an MP3 file with appropriate Author and AlbumTitle tags – it lists as the song “Eureka” by “Jim O’Rourke”. I haven’t found where you can correct this, or delete it – goodness only knows how you cope with embarrassing selections made by this guessing algorithm.
You can’t delete a music MP3 file from the device without using the PC. Not much use when I’m on the bus and want to say “yep, I’ve heard that, now delete it”.

Like I said, those are the first few problems I’ve encountered.

Most of these problems seem to be solved by turning my recorded radio programmes into podcasts. Apparently you do this by moving the MP3 files into the podcast directory prior to syncing, and by changing the ID3 Genre tag to “Podcast”. That’s certainly far better, but there are still more problems I’ve encountered with that:

Podcasts without an accompanying XML RSS feed don’t sort right. They should sort primarily by the MP3’s ID3 track #, then by date and time, and finally by name. It appears that the Zune is sorting them primarily by date (ignoring the time!) and then by name, and totally ignoring the track number.
When sorting the tracks in a podcast by name, the sort is alphabetical, with no consideration given to numerical sorting, so my recording of “Journey into Space, World In Peril” plays in the order 1, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 2, 20, 3, 4, 5, 6, 7, 8, 9. And remember, that’s even with the track numbers present and correct (although maybe it is sorting by track number, but doing it alphabetically rather than numerically!)
I’d rather that podcasts were picked up properly without my having to change the Genre tag – I like my Genre tags to read “Comedy”, or “Drama/SciFi & Fantasy” – and it’d be nice if the podcast tool allowed me to sub-sort the podcasts based on the genre, too!
You can’t “queue up” the podcasts into a “now playing” list, or any other kind of playlist.
Podcasts don’t display the Picture stored in the ID3 tag of the MP3 file – not even as “album art”. The only time images are displayed for podcasts is when the image is referenced in an accompanying XML RSS feed.

So, the next solution set would be to publish an RSS feed.

Unfortunately, this leads to the next failure.

You can’t subscribe to a “file://” based URL – podcast feeds must all start “http://”, which means putting a web server to work even if you’re building a personal podcast feed that exists only between your computer and its associated Zune.

Other problems I’ve experienced are DRM-like, and we all know that I find DRM to be hugely objectionable. Specifically, I can’t transfer any IFC programmes onto my Zune from my Windows Vista Media Center PC, because apparently they’re all tagged as “copyright”. Note that’s my Media Center PC, transferring to my Zune so that I can watch programming recorded from my DirecTV subscription – no theft involved there, I paid for that content, but can not watch it in my chosen locale or medium.

I can only hope that someone at Microsoft reads this post, and reassures me that they’re going to do better with the release of the ZuneHD – and, because I almost certainly can’t afford a ZuneHD (although anyone who knows me will tell you how excited I’ve been about OLEDs for the last year or so), I hope that many of these improvements are back-ported to my lowly Zune 30. I’d be happy to expound on any of these points to get them addressed.

Oh, and if you ask – I would definitely and whole-heartedly recommend getting a Zune. I know that I’m going to be buying one for my wife as soon as I can find it at the right price (I’m hoping for a Woot-off or perhaps a bag of crap containing a Zune]. All the problems I’ve outlined above are really minor and piddly, but it’s these kind of tweaks that turn a merely good product into a great product. I only complain about them because the Zune is so close to perfection for me, it can be fixed with relatively little effort. The Sansa and its software were so far from perfection that it seems likely that the development team totally don’t “get it”. [The Creative Muvo was actually pretty much perfect for what was achievable at the time.]

So, am I missing any obvious tricks for my Zune? Can I get the BBC programmes on it in a better way? [Yes, I know about the BBC podcasts, but there are shows that the BBC just don’t podcast.]

Microsoft TechFest

Alun Jones — Tue, 03 Mar 2009 23:45:49 GMT

Last week, I went to Microsoft’s TechFest as part of their “Public Day”. This is the first time MVPs as a group have been invited to this event, and although it’s clear we missed some of the demonstrations that are not public-ready, this is something that I hope can be extended to us in future, even if only to Washington-state MVPs

For general news links on MS TechFest 2009, you can search news.google.com for “TechFest”. Here’s a couple of samples:

http://www.king5.com/video/index.html?nvid=335707 – I didn’t see these guys there.

http://www.guardian.co.uk/technology/blog/2009/feb/25/microsoft-software - I bumped into this guy.

I also saw Chris Pirillo there from LockerGnome and Chris.Pirillo, but he hasn’t written anything yet. I only mention him because it’s about time that I thanked him for being one of the earliest online writers (they were called “e-Zines” back then, apparently) to mention WFTPD in his column. Sadly, I don’t have a copy to remember what it is that he said :(

Apologies to anyone who expected to reach me by email that day – the usual computers spread around the Microsoft Conference Centre for email and web browsing were missing, possibly because the Press were there, and they’ll steal anything that isn’t nailed down, before coming back with crowbars.

So, here’s some description of the things I saw, ranging from the exciting and relevant to the “why is Microsoft spending money on that?” [Note that this is not meant to be disrespectful of ‘pure research’ – often, today’s “useless meanderings” become tomorrows product – WFTPD itself started from a momentary “how hard can it really be?” lapse in my own judgement, followed by a little research and a lot of effort.]

Specification Inference for Security: To improve focus on potential security faults in static analysis tools, this is a toolset whose approach is to divide functions into Sources, Sinks and Sanitizers (although that alliteration is liable to lead to confusion) – Sources generate untrustworthy data from input, Sinks consume data that they trust will fit their expectations, and Sanitizers transform the data along the way, ideally making sure that it goes from untrustworthy to trusted. Thinking in terms of a SQL injection, the Source would be a web server receiving input from a user containing a SQL command, the Sink would be the SQL server, and the Sanitizer would be whatever code packages the input and determines whether to pass it to the SQL server, and what changes to make (such as requiring proper quoting, or using a stored proc or parameterized query). Once these categorizations have been made, the static analysis tool can check that Sanitizers actually do sanitize – rather than having to try and analyse every function for possible sanitization. http://research.microsoft.com/merlin
Concurrency Analysis Platform and Tools: Enhances your test tool set by allowing tests to run with multiple permutations of concurrency. Race conditions are usually caught by users, or in production environments, because the environments cause different threads or processes to run at different speeds – with this toolkit, you get to try out multiple combinations of execution sequence, so that you are more likely to trigger the race condition. Of course, you still have to write tests that consider the prospect of doing more than one thing at a time, and because there are a large number of concurrency permutations, it’s not a turn-key solution, but it does allow you to debug concurrency issues more methodically, and catch those that appear more frequently. http://research.microsoft.com/chess - and this one’s available for download as an add-on to Visual Studio!
Lightweight Software Transactions for Games: Not just for games, the ORCS platform (Object-based Runtime for Concurrent Systems) makes coding multi-threaded applications easier and more problem-free. http://research.microsoft.com/orcs
Closed-Loop Control Systems for the Data Center: Power consumption monitoring and control allows for servers to be brought online or offline as computing demands change, so that as usage ramps up, more servers are turned on, and as usage declines, servers are turned off. I don’t think this is entirely original.
Algorithms and Cryptography: Cryptographic solutions with leakage. Unfortunately, the lady who came up with this wasn’t on hand to discuss her work, and her husband standing in for her didn’t seem to understand much about it either. The poster claimed an algorithm whereby you could leak some of your key to an attacker without reducing the strength of the key. I’m not sure how this works, or where it differs from having redundant information in the keys, or something like M of N crypto, but maybe it’ll be something that will affect our field in the years to come.
Opinion Search: Full of marketing jargon and too dense for me to penetrate, this is something that we could potentially use in the business side of Expedia, making use of customer opinions to allow search results to match the user’s opinion against the opinions of others with whom they have consistently agreed in the past, and can be expected to do so in the future.
Low-Power Processors in the Data Center: Using Netbook processors for data processing in a parallel environment allows for significant power savings.
Audio Spatialisation and AEC for Teleconferencing: Relying on the rise of computer-phone integration, and the fact that most computers have stereo speakers, this is a system for teleconferencing where different parties are given a different spot in the stereo spatialisation. Makes it much easier to tell who’s talking.
SecondLight: Surface computing taken to another level, literally. The surface on which images are projected is usually a light diffuser, so that the image effectively “stays” on the surface. In this implementation, the surface is rapidly switched between diffuse and transparent, so that you can use a secondary diffuser surface on top, which shows a different image. You have to see a demonstration to understand it - mms://wm.microsoft.com/ms/research/projects/secondlight-cambridge/secondlight.wmv - it’s a little flickery, in real-life too, but the team assured me that it can be made less so.
Commute UX – Dialog System for In-Car Infotainment: Will this stop executives requesting shorter passwords for unlocking their phone while driving? Probably not.
Back-of-Device Touch Input: Anyone using an iPhone or similar touch-based device will be familiar with the issue that your fingers are covering the image you’re trying to manipulate. By putting a sensor panel on the back of the device, you can reduce the size of the display without making it impossible to read while you select.
Augmented Reality: Combining GPS location with stock footage of the place you’re in, this is all about placing extra information into a view (such as a cell-phone with a video camera, or maybe eventually a heads-up display in glasses / goggles) of the world around you, by recognising where you are. Can be used for games, directions, advertising, city guides, or post-it notes without the paper.
Recognizing characters written in the Air: Entertaining just to watch people dragging an apple around to make letters on a screen in front of them. Probably more useful in the mode where the lid of an OHP pen is the “bright spot of strong solid colour” being tracked in mid-air.
Colour-structured Image Search: Draw a rough colour picture of the image you want to see, and get a page of search results from around the web. The demonstrations consisted of drawing pictures of flowers, or flags, or a sunset. I foresee widespread abuse once deployed, although it will mean that people who usually draw on bathroom walls will be moving their talents online.

MVP Summit 2009 is here!

Alun Jones — Mon, 02 Mar 2009 18:44:06 GMT

I snapped this picture last week at Microsoft' Research’s Tech-Fest event.

Microsoft always makes the visiting MVPs feel welcome at Global Summit time, when all MVP awardees are invited to visit Microsoft’s campus, and engage in face-to-face conversations with various Microsoft Product Groups about the feedback they’re seeing from the users they talk to in their various forums, whether that’s Usenet newsgroups, web forums, user groups, or book and magazine readers.

This year, in large part thanks to the efforts of one of the other Security MVPs, Dana Epps, we have a fantastic schedule of in-depth sessions on identity frameworks, threat modeling, Microsoft’s internal security, and a number of other topics that I should perhaps keep quiet about.

The other benefit to me, as an MVP, from these sessions is that I get to network with other MVPs – all of whom are intelligent, driven individuals with expertise in a wide variety of fields, not just my own area of Enterprise Security.

Already I’ve spoken to a number of people in conversations that I intend to continue long after the Summit is over. I’ve made some new friends, met plenty of old friends, and expanded and strengthened existing social connections.

It’s a little sad that the worsening economic climate has caused a number of MVPs from outside the US to not attend this year’s Summit, and even some from inside the country. But it does appear that the MVP programme is still strong, as around 1500 MVPs from around the world are in attendance.

For those wondering about the swag bag, we got a cloth bag, stickers, a pen, and a water bottle. The shirts will be arriving on Wednesday (thank you, US Customs!). The benefit is more in the programme of technical sessions than the bag, unlike some technical conferences, where your $2500 entrance fee gets you a rather spectacular bag of ‘freebies’ and a number of sessions scheduled such that all the ones you want to see are in the same time slot.

I have to say, I love the stickers. Being a part of the MVP programme is a really nice thing that Microsoft does to say ‘thank you’ to people who are assisting Microsoft’s customers in newsgroups, user groups, etc, and who would continue to do so anyway, even if Microsoft ended the MVP programme. As such, I think it’s an excellent recognition, and I’m proud of the fact that I was awarded – so I like to show it off, mainly by plastering stickers on my various technology items like laptops and PDAs.

Sad notes – passed over Christmas.

Alun Jones — Fri, 26 Dec 2008 22:42:47 GMT

I’m very sad to note that Eartha Kitt has died – even in her eighties, the woman simply embodied sexiness. Truly the best Catwoman ever. And as the voice of Kaa, in The Jungle Book, purely hypnotic. [To those of you who are saying “huh? Winnie the Pooh played Kaa, just before he testified to the HUAC”, wait for the radio series to repeat on BBC 7. Remember – the pictures are far better on the radio.]

As for Harold Pinter, I think it’s possible that he isn’t dead. Just … pausing.

Running out of disk space? How’s your logs?

Alun Jones — Thu, 25 Dec 2008 21:52:25 GMT

I ran out of disk space today.

This is not entirely a new issue for me, because I like to listen to BBC Radio from back home, and my only way to do that is to download the shows overnight so I can listen to them the next day. [I’m not allowed that sort of bandwidth at work]

I start troubleshooting this in the obvious way – where are my largest individual files, and are they useful? Windows Vista’s Search is great for this – you can ask for files over a certain number of bytes:

Whoa, over a gigabyte in that mysterious file called “setupapi.app.log”? Ah, but it’s in that C:\Windows\inf directory that I really shouldn’t mess with, so I’d better check to see that it’s alright to get rid of the file. Let’s see what the Microsoft Support Knowledge Base has to offer on the subject of huge files created by the Setup API.

http://support.microsoft.com/default.aspx/kb/958909 - “It may take a long time to log on to a Windows Vista-based computer that has antivirus software installed” – well, I haven’t really noticed that logons are that slow, and I don’t actually have antivirus software installed. But visiting the article, I see that this is only the first half of the title. The full title is:

It may take a long time to log on to a Windows Vista-based computer that has antivirus software installed, and you may notice that the file size of the Setupapi.app.log file is very large

So, to use a medical metaphor here, the large setupapi.app.log is the internal haemorrhaging caused by some injury or illness, and the slow logon (or in my case, the inability to use my disk space) is the externally visible symptom – the loss of consciousness, the fainting fit, the going-into-shock. Now that we’ve got the diagnosis, let’s see if the KB article has anything useful to say.

“This problem occurs because the verbose logging policy for the Setupapi.app.log file in Windows Vista is set to the most verbose setting (0x20000FFFF).

“…

“To work around this problem, remove or adjust the value of the following registry entry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\LogLevel”

Hmm… my value is set to 0x20000000. What value should it be?

“Type 0x00000020 in the Value data box.”

OK, that’s a little pedantic – instead, how about you click the “Hexadecimal” radio button, and enter “20”:

There is a hotfix mentioned in the article, but I rarely like to apply hotfixes to my machine if I am sure that the workaround will suffice. I may revisit the hotfix if I can’t see this work to reduce my log file size.

So, how did this happen? How did the setting get put to such a bizarre value?

Quite frankly, I don’t know – and as long as the problem goes away, I’ll just put it down to one of the many programs that I’ve installed or uninstalled. Judging from the fact that this log seems to have been in detail mode ever since November 2007, it’s likely that this setting was chosen (either by me or Microsoft) to gauge how successful the new install of Vista was going.

I now have a gigabyte of my file-space left, and I can go and download “Crisp and Even, Brightly”, one of my favourite Christmas shows from Radio 4. I only wish I could get the TV, because there are some excellent BBC shows that never make it across to this side of the Atlantic – and I just can’t wait for Doctor Who Season 4 – the next Doctor (or is he?), Cybermen, and a Victorian Christmas.

News: Apple, Linux Users repeatedly mash "refresh" button

Alun Jones — Mon, 01 Dec 2008 23:13:00 GMT

Okay, so that's just one way to explain the news story at ComputerWorld "Windows market share dives(*) below 90% for first time" - statistics don't lie, but they don't always answer the question you thought they did.

ComputerWorld also offers other explanations than their title:

Vince Vizzaccarro, Net Applications' executive vice president of marketing, attributed Windows' slip to some of the same factors he credited with pushing down the market share of Microsoft's Internet Explorer browser. "The more home users who are online, using Macs and Firefox and Safari, the more those shares go up," he said. November was notable for a higher-than-average number of weekend days, as well as the Thanksgiving holiday in the U.S., he said.

Uh, in other words, expect to see the trend increase as more Mac and Firefox users get laid off and have to search for *** at home.

(*) For "dives", reads "descends by 0.84%" - view the graph at http://marketshare.hitslink.com/os-market-share.aspx?qprid=9 - yes, those are indeed graphs showing the (ahem) rise and fall of usage patterns. See if you can tell rising months from falling months without cheating by looking at the numbers! Three and a half percent, say, would be more like a "dive". Time to buy Sterling, I think!

Windows 7 officially has a name

Alun Jones — Tue, 14 Oct 2008 17:41:39 GMT

So, what’s the scoop?

It’s going to be called “Windows 7”, according to Mike Nash posting at the Windows Vista Blog.

[Is it just me, or does Mike Nash look a little like the chef who got into trouble for inflating his resume in the opening credits to “Dinner: Impossible”? ]

How sneaky of Microsoft, to fool us into thinking that “Windows 7” was just the code name, when in fact it was also the release name!

Me, I think it’s because there was just no good way to include hints of the code-name in the final release name, like Microsoft have done in the past.

Think about it – “Cairo” spawned “Windows XP” – the Greek letters chi and rho are written: “ΧΡ” (lower-case is “χρ”) (if you don’t have the Greek font, that looks almost indistinguishable from “XP”). I’ll always think of it as “Windows No Parking”.

Windows 6 became Windows Vista – get it, six is “vi” in roman numerals?

So, Windows 7 should have been Windows Viista. Or maybe the name could have made obscure art-house movie references, and been called “A Vee and two ones”. Ah, but anything with VII in it might be perilously close to Intel’s VIIV product (currently residing in our “where are they now” file).

Perhaps this should make us think back to the last time a Windows client operating system was referred to by the word “Windows” followed by its version number – yes, “Windows 7” is designed to hearken back to “Windows 3.11”. Ah, yes, those were the days, indeed.

I can’t wait to see what’s coming in Windows 7, particularly things like Multi-touch support (though I have yet to purchase a system that has even single touch support).

Seven also marks Windows’ transition from an acid into a base.

HTML Help in MFC

Alun Jones — Mon, 13 Oct 2008 04:36:11 GMT

I recently got around to converting an old MFC project from WinHelp format to HTML Help. Mostly this was to satisfy customers who are using Windows Vista or Windows Server 2008, but who don’t want to install WinHlp32 from Microsoft. (If you do want to install WinHlp32, you can find it for Windows Vista or Windows Server 2008 at Microsoft’s download site.]

Here’s a quick round trip of how I did it:

1. Convert the help file – yeah, this is the hard part, but there are plenty of tools, including Microsoft’s HTML Help Editor, that will do the job for you. Editing the help file in HTML format can be a little bit of a challenge, too, but many times your favourite HTML editor can be made to do the job for you.

2. Call EnableHtmlHelp() from the CWinApp-derived class’ constructor.

3. Remove the line ON_COMMAND(ID_HELP_USING, CWinApp::OnHelpUsing), if you have it - there is no HELP_HELPONHELP topic in HTML.

4. Add the following function:

void CWftpdApp::HelpKeyWord(LPCSTR sKeyword)
{
    HH_AKLINK akLink;
    switch (GetHelpMode())
    {
    case afxHTMLHelp:
        akLink.cbStruct = sizeof(HH_AKLINK);
        akLink.fReserved=FALSE;
        akLink.fIndexOnFail=TRUE;
        akLink.pszKeywords=sKeyword;
        akLink.pszMsgText=(CString)"Failed to find information in the help file on " + sKeyword;
        akLink.pszMsgTitle="HTML Help Error";
        akLink.pszWindow=NULL;
        AfxGetApp()->HtmlHelp((DWORD_PTR)&akLink,HH_KEYWORD_LOOKUP);
        break;
    case afxWinHelp:
        AfxGetApp()->WinHelp((long)(char *)sKeyword,HELP_KEY);
        break;
    }
}

5. Change your keyword help calls to call this new function:

((CWftpdApp *)AfxGetApp()->WinHelp((long)(char *)"Registering");

Becomes:

HelpKeyWord("Registering",HELP_KEY);

6. If you want to trace calls to the WinHelp function to watch what contexts are being created, trap WinHelpInternal:

void CWftpdApp::WinHelpInternal(DWORD_PTR dwData, UINT nCmd)
{
TRACE("Executing WinHelp with Cmd=%d, dwData=%d (%x)\r\n",nCmd,dwData,dwData);
CWinApp::WinHelpInternal(dwData,nCmd);
}

This trace comes in really, really (and I mean REALLY) handy when you are trying to debug “Failed to load help” errors. It will tell you what numeric ID is being used, and you can compare that to your ALIAS file.

7. If your code gives a dialog box that reads:

---------------------------
HTML Help Author Message
---------------------------
HH_HELP_CONTEXT called without a [MAP] section.
---------------------------
OK
---------------------------

What it means is that the HTML Help API could not find the [MAP] or the [ALIAS] section - without an [ALIAS] section, but with a [MAP] section, this message still will appear.

8. Don’t edit the ALIAS or MAP sections of your help file in HTML Help Editor – Microsoft has a long-standing bug here that makes it crash (losing much of your unsaved work, of course) unpredictably when editing these sections. Edit the HHP file by hand to work on these sections.

9. Most of your MAP section entries are automatically generated by the compiler, as .HM files, which hold macros appropriate for the specific control in the right dialog. Simply include the right HM file, and all you will need to do is create the right ALIAS mappings.

10. The MFC calls to HtmlHelp discard error returns from the function, so there’s really no good troubleshooting to go on when debugging access to help file entries.

Let me know if any of these helpful hints prove to be of use to you, or if you need any further clarification.

Weak point against Vista

Alun Jones — Sun, 12 Oct 2008 00:49:06 GMT

First rule of demonstrative writing – lead off with an undeniable example of the point you’re trying to make.

Case in point – Dan Lyons’ article in NewsWeek on “A Gloomy Vista for Microsoft”, meant to be a piece defining how bad Vista is.

“Last year I was meeting with the CEO of a PC company who offered to give me a demo of his company's gorgeous new top-of- the-line notebook, a machine that cost several thousand dollars and came loaded with Windows Vista, the latest version of Microsoft's operating system. He flipped open the laptop, pressed the power button, and … nothing. We waited. And waited. It was excruciating. He tried control-alt-delete. He tried holding down the power button. Finally he removed the battery and snapped it back into place. The machine started up—slowly—while the CEO sat there fuming.”

Um, yeah, OK, that sounds bad and all, but seriously, if you’re pressing the power button on a turned-off machine and nothing’s happening, that’s hardware. And if you blame hardware faults on the operating system, well, that’s just a CEO trying to ignore the fact that his hardware system and its developers aren’t providing a totally balanced view of their work.

So, let’s carry on reading. What else is a problem with Vista?

“It was sluggish. It had trouble going to sleep and waking up. It wouldn't work with some printers and accessories.”

I didn’t see “sluggish”, but then again, I bought a higher spec machine than my three-year-old laptop in order to run Vista, because it’s a significant update to the OS. Many of its major features expect there to be lots of memory and a fast 3D video card.

The “trouble going to sleep and waking up” part I definitely had some experience with – but then, I have those problems in XP, too: over 1MB in my machine, and XP decided it was going to turn my laptop bag into a pizza oven – to judge from the popularity of my blog post on the issue, I’m far from alone in this. Laptop manufacturers really haven’t had the best of luck in XP or Vista persuading individual devices – let alone the whole system – that it’s nighty-night time, or that it’s time to wake up when you punch the “wake-up” key. Recent updates from Lenovo made my life a little easier, but the machine will still sometimes go to sleep never to wake up again. Really irritating when I’m in the middle of working as the bus arrives at its destination and I have to press the sleep button, praying that the machine will make it through the nap. And I can guarantee to hang the system if I press the sleep button and then close the lid.

And, as for printers and accessories, it’s clear that any number of device drivers weren’t actually used for any significant length of time in the Vista environment, or they’d have shown their incompatible designs. My HP printer, for instance, pops up this ugly dialog whenever I print from Internet Explorer:

Now, I don’t know much about drivers, but I suspect that this could be fixed by signing the driver. My other HP printer continually offers up a new version of its drivers on Windows Update, and then the installation refuses to start, because the printer isn’t plugged in to my machine. Well, of course not, it’s a network printer.

As has been pointed out by numerous other writers, XP had this same sort of flack when it released (although I don’t remember it going on for quite this long), and then as now, most of the problems were to do with software and hardware developers who weren’t paying even limited attention to the statements Microsoft put out as to features that were deprecated (i.e. made obsolete, going away, or otherwise disappearing).

Of course, my wife hates Vista, and at some point I’ll be able to point you to her ideas on the topic, because she has some actually valid arguments as to why Vista sucks. And none of those arguments are represented in Dan Lyons’ Newsweek article.

Can You Write Good Code for an OS you Despise?

Alun Jones — Sat, 03 May 2008 23:57:20 GMT

No, this isn't another of my anti-Mac frothing rants.

This is one of my "here's what I hate about many of the open-source projects I deal with" rants.

I'm trying to find an SFTP client for Windows that works the way I want it to.

All I seem to be able to find are SFTP clients for Unix shoe-horned in to Windows.

[Perhaps the Unix guys feel the same way about playing Halo under Wine.]

What do I mean?

Here's an example - Windows has a certificate store. It's well-protected, in that there haven't been any disclosures of significant vulnerabilities that allow you to read certificates without first having got the credentials that would allow you to do so.

So, I want an SFTP client that lets me store my private keys in the Windows certificate store. Or at least, that uses DPAPI to protect its data.

Can't find one.

Can't find ONE. And I'm known for being good at finding stuff.

PuTTY is recommended to me. It, too, requires that the private key be stored in a file, not in the certificate store. Its alternative is to use its own certificate store, called Pageant (it's an authorization "Age-Ant" for PuTTY, get it?) Maybe I could do something with that - write a variant of Pageant that directly accesses certificates stored in the certificate store.

But no, there's no protocol definition or API, or service contract that I can see in the documentation, that would allow me to rejigger this. I could edit the source code, but that's an awful lot of effort compared to building a clean implementation of only those parts of the API that I'd need.

What I do find in the documentation for Pageant are comments such as these:

Windows unfortunately provides no way to protect pieces of memory from being written to the system swap file. So if Pageant is holding your private keys for a long period of time, it's possible that decrypted private key data may be written to the system swap file, and an attacker who gained access to your hard disk later on might be able to recover that data. (However, if you stored an unencrypted key in a disk file they would certainly be able to recover it.)
Although, like most modern operating systems, Windows prevents programs from accidentally accessing one another's memory space, it does allow programs to access one another's memory space deliberately, for special purposes such as debugging. This means that if you allow a virus, trojan, or other malicious program on to your Windows system while Pageant is running, it could access the memory of the Pageant process, extract your decrypted authentication keys, and send them back to its master.

I'll address the second comment first - it's a strange way of noting that Windows, like other modern operating systems, assumes that every process run by the user has the same access as the user. Typically, this is addressed by simply minimising the amount of time that a secret is held in memory in its decrypted form, and using something like DPAPI to store the secret encrypted.

The first comment, though, indicates a lack of experience with programming for Windows, and an inability to search. Five minutes at http://msdn.microsoft.com gets you a reference to VirtualLock, which allows you to lock 4kB at a time into physical memory, aka non-paged pool. Of course, there are other options - encrypting the Pagefile using EFS also helps protect against this kind of attack, and the aforementioned trick of holding the secret decrypted in memory for as short a time as possible also reduces the risk of having it exposed.

Now I'm really stretching to assert that this single author despises Windows and that's why he's completely unaware of some of its obvious security features and common modes of use. But it does seem to be a trend prevalent in some of the more religious of open source developers - "Windows sucks because it can't do X, Y and Z" - without actually learning for certain whether that's true. Often, X and Y can be done, and Z is only necessary on other operating systems due to quirks of their design.

Back when I first started writing Windows server software, the same religious folks would tell me "don't bother writing servers for Windows - it's not stable enough". True enough, Windows 3.1 wasn't exactly blessed with great uptime. But instead of saying "you can't build a server on Windows", I realised that there was a coming market in Windows NT, which was supposed to be server class. So I wrote for Windows NT, I assumed it was capable of server functionality, and any time I felt like I'd hit a "Windows can't do this", I bugged Microsoft until they fixed it.

Had I simply walked away and gone to a different platform, I'd be in a different place - but my point is that if you believe that your target OS is incapable, you will find it to be so. If you believe it should be capable, you will find it to be so.

Retro-bundling - another suck of the Apple

Alun Jones — Sat, 22 Mar 2008 04:15:47 GMT

I thought I was done blogging about Apple Software Update, having removed QuickTime from my system completely, and sworn never to install it again or watch another QT or MOV file.

But nooo, someone had to spoil it by telling me what Apple Software Update did next.

If you're unfortunate enough to have QuickTime installed with Apple Software Update, you'll already have seen it.

Not only is Apple going to offer you iTunes and QuickTime as an "update" (despite you not actually having iTunes installed in the first place), they're also going to offer you Safari, the feature-light Apple web browser, as an "update" (again, even though you haven't installed it). And they're going to check the box, so if you think you're just updating components you fetched for yourself, you'll accidentally install this one, too. And they're going to ask you every boot until you disable the check - and then they'll just re-enable the prompt next time they have a patched version to release.

What next, "we suggest you update to Bootcamp and Mac OS X, please wait while we install, and don't mind the reboots"?

Seriously, Apple, this just makes you look seriously unethical. You can't get people to install Safari legitimately, by enticing them to voluntarily download and install it, so you have to sneak it in by implying it's an update to QuickTime. What does that say about Safari? You can't even give it away? You have to foist it on the unwilling?

Grow up.

I suggest we call this behaviour Retro-Bundling.

Bundling, of course, is when you buy a piece of software, or download it for free, and along with it comes Firefox or the Google Toolbar. Irritating, especially if you don't want them, because half of your time in getting the software down was taken up in downloading something that you're going to say "no" to. But at least you only have to say no that one time - or when you download the next version.

Retro-Bundling, then, would be when, after you already have the software of your choice installed, its manufacturer decides that they'd like to have bundled something else onto your system, so they try to slip it in the back door without you noticing.

I am glad to say, to judge from comments at other blogs, that I'm not the only one that thinks this is utterly reprehensible behaviour. Perhaps this is the way things are done in the Apple world - you just sit happily back as your vendor dumps more and more product into your lap.

Consider this - how would you have reacted, if next time Office for Mac was checking for updates, it came back and offered to update Word, Excel Internet Explorer and Silverlight? Even though you didn't have those last two on your system. Oh, and they were selected automatically, and the default button press would install them all.

Update: Someone mentioned to me that Microsoft does indeed offer Silverlight on Windows Update to Windows users even if you don't have Silverlight installed already. That sucks, too. It's not quite as heavy an application as Safari and iTunes, but it's still wrong to offer "updates" that consist of an application you don't have. Actions like this will cause people to stop accepting updates as a regular part of their computing schedule - and that can't help the health of their computers.

Random leap-day events.

Alun Jones — Sat, 01 Mar 2008 02:47:24 GMT

A semi-hobby of mine is that of date- and time-related issues with computers. Something that we all take for granted, and assume to be easy, is actually incredibly complex, with rules that depend on where you are, when you are, which laws you follow, which religion you believe in, and any number of other steps.

I knew there'd be one or two events for leap day to comment on - here's a selection for your amusement:

"Software Snafu delays United's Leap Day check-ins" - a spokesman "says United didn't have any such problems with the software on Leap Day four years ago." - not much thought given, I suppose, as to whether there might have been an update or patch in those four years.

Microsoft's SQL Server 2008 - two days after the product launch in Los Angeles:

“We have recently discovered an issue with SQL Server 2008 CTPs that result
in SQL Server 2008 not starting on Feb 29 GMT only. We recommend that you do
not run or install this CTP on Feb 29 GMT to minimize any impact in your
environment. You can install starting on March 1 GMT. If you have already
encountered issues, contact sqlbeta@microsoft.com before taking any further
steps.”

Microsoft's Windows Small Business Server can't issue itself a certificate today, because when it creates the certificate, it makes it valid until today's date, five years from now. That would be 2/29/2013, which isn't a valid date. Splat.

South Carolina's DMV brought down because of "a bug in one of the programs that calculates the date".

Electronic Arts give their employees a day off for Leap Day - I was going to make some weak joke about "an EA spokesman said that as the following day was a Saturday, they expected everyone in the office as normal" - but then I read the spokesman's comments from the article: “The next leap year isn't until 2012, but the company is trying to come with a reason to give its employees another day off in 2009.” So there you are, if you work at EA, you get another day off work next year. Write down family members' names and addresses so you can contact them again when next you get to leave the office and go out into the "big blue room".

Google on Microsoft / Yahoo! Deal: "Wah!"

Alun Jones — Mon, 04 Feb 2008 20:21:00 GMT

In case you've been under a rock, Microsoft appears to be trying to take advantage of Yahoo! Inc's recent poor performance to make an unsolicited offer (as far as I can tell, it's not a hostile bid until and unless Yahoo! officers declare that they will be fighting against it by offering a deal they think their stockholders will prefer) to buy the company.

Clearly, given Microsoft's intent to compete with Google, this is a great move for Microsoft - the Microsoft search engines have always lacked popularity compared to Google, and Yahoo!'s engines are still hugely popular. With Yahoo!'s large user base for other web pages, this acquisition amounts to a huge number of eyeballs to which Microsoft can expose their Internet product strategies.

Google, obviously, is a little perturbed by this.

How do they choose to express their concern?

By pointing to the openness and innovation which has underscored the Internet's development throughout the years, and which has been the reason that the Internet has remained popular and usable.

Now, I will definitely agree that Microsoft is known for locking up many of their most interesting innovations inside of patents.

However, the company is also very well known for contributing technical standards to the Internet body of knowledge as expressed in the Internet RFCs.

Let's see how innovative and open Google has been, by searching for "Google" in the Internet RFCs - let's see how many employees have written these open and innovative documents.

RFC 4473: "...search engines such as Google." is the only occurrence - so it's not written by a Google employee.
RFC 4646: Tags for Identifying Languages - authored by Yahoo! and Google employees.
RFC 4647: Matching of Language Tags - essentially part II of RFC 4646, by the same authors.
RFC 4657: Contributors include a Google employee
RFC 4772: Notes that Google was searched.
RFC 4693: An administrative note about the IETF, written by a Google employee.
RFC 4838: Delay-Tolerant Networking Architecture - technically, Vint Cerf was a Google employee at the time, but appears to have done this as work for JPL.
RFC 4954: An authentication extension for SMTP, co-written by a Google employee.
RFC 4959: Authentication extension for IMAP, co-written by a Google employee.
RFC 4981: Refers in passing to Google.
RFC 4990: Use of addresses in GMPLS Networks, co-written by a Google employee.
RFC 5023: The Atom Publishing Protocol, co-written by a Google employee.
RFC 5034: POP3 Authentication extension, co-written by a Google employee.
RFC 5050: Vint Cerf of Google is listed as a contributor.

So, the number of RFCs listing Google employees as authors or co-authors is nine. If you are ruthless in your search for originality, and cut out RFCs that appear to be copies or extensions of other Google employee RFCs, as well as those that were written for other employers than Google, you get five. And one of those is a note about the way in which the IETF operates.

What about Microsoft - when have Microsoft employees ever contributed time to the development of Internet RFCs?

Compared to Google's fourteen matches in the RFCs, "Microsoft" is found hundreds of times. So I tried to limit my search to RFCs that were likely written by Microsoft employees - a good search term for this is to find those RFCs in which either "Microsoft" or "Microsoft Corporation" is at the end of a line. I further limited the search to documents where this match was found in the first 25 lines.

175 RFCs.Okay, so maybe some of those were duplicates, or unimportant ones, and Microsoft have certainly been doing this longer than Google.

Google's first employee-written RFC came in September 2006, so in eighteen months, they've written at most nine, at a rate of one every two months; Microsoft's first is dated December 1995 - that's 146 months ago, so that Microsoft employees are producing RFCs at a rate of slightly more than one every month - more than twice as fast as Google.

I think that if Google wants to cry "shame" that Microsoft is not open or innovative, and that this will cause the Internet to shrivel, they should perhaps start with a little introspection.

Buying an Internet founder does not make you into a founder of the Internet.
Buying an RFC author does not make you open and innovative.
Complaining that a competitor's proposed acquisition will stifle openness and innovation only makes sense if you are, by comparison, a champion of those two qualities - by comparison through the reading of RFCs, Google appears somewhat secretive and dull.

P.S. Please don't comment in this entry about "embrace and extend" - let's face it, openness and innovation as they apply to the Internet are all about "embrace and extend" - Internet standards are published so that they can be adopted and advanced. This discussion is not about whether Microsoft copies from other companies - after all, if this is all about openness and innovation, copying is a good thing.