Mark Russinovich on Windows Kernel Security

An anonymous reader writes to mention that in the final part of his three part series, Mark Russinovich wraps up his look at changes made in the Windows Vista Kernel by exploring advancements in reliability, recovery, and security. "Applications written for Windows Vista can, with very little effort, gain automatic error recovery capabilities by using the new transactional support in NTFS and the registry with the Kernel Transaction Manager. When an application wants to make a number of related changes, it can either create a Distributed Transaction Coordinator (DTC) transaction and a KTM transaction handle, or create a KTM handle directly and associate the modifications of the files and registry keys with the transaction. If all the changes succeed, the application commits the transaction and the changes are applied, but at any time up to that point the application can roll back the transaction and the changes are then discarded."

Comments

Not dupe, but almost

[vivaoporto]

Although this is technically not a dupe, it is almost, as the above linked article is the Part 3 and the other submitted and discussed article was the Part 1, isn't it kinda repetitive? What now, someone post a multipart article and we will get one story here on front page for each part?

On topic now, I don't like the way Russinovich is blowing Vista's horn now. I liked him more when he was more critical and analytical on what could be improved, instead of what has already been done.

Re:Not dupe, but almost

[Bonker]

MS made a good move in hiring Russovitch. We can hope that he has more positive influence over kernel changes to XP and Vista than MS has bad influence over things that he does and does not get to say and software (sysinterals) he does or does not get to release.

Re:Not dupe, but almost

[suv4x4]

On topic now, I don't like the way Russinovich is blowing Vista's horn now. I liked him more when he was more critical and analytical on what could be improved, instead of what has already been done.

He's working at Microsoft now, you do realize that "what could be improved" he's actually doing right now, so he can call it "already been done".

You don't really prefer pointless critique with no improvement, do you.

Re:Not dupe, but almost

[LordSnooty]

Yeah, GP is a rather odd comment. Maybe what he said should be done has been done, and now he can talk about how it's implemented. He's a clever guy, I'm sure MS didn't employ him just so they could get their hands on Process Explorer. I guess this factoid was lost on 'first post'

Re:Not dupe, but almost

[vivaoporto]

He's working at Microsoft now, you do realize that "what could be improved" he's actually doing right now

You don't really prefer pointless critique with no improvement, do you.

Point conceded.

Re:Not dupe, but almost

[dedazo]

On topic now, I don't like the way Russinovich is blowing Vista's horn now. I liked him more when he was more critical and analytical on what could be improved, instead of what has already been done.

Fresh blood always brings fresh perspectives. Mark has been on the outside looking in for long enough that he probably has a fairly asymetrical view of the NT kernel to that of the core MS developers, and in software development (especially at that level) that tends to be extremely useful.

Re:Not dupe, but almost

[EllynGeek]

Sysinternals was one the very few companies with the expertise to dissect and analyze Windowses truthfully. It's no accident that after the Sony rootkit fiasco they were quietly acquired by microsoft. Just one more assimilation.

Re:Not dupe, but almost

[Anonymous Coward]

Uhh...not to ruin your perspective here, but that's not a horn....

Re:Not dupe, but almost

[Anonymous Coward]

You don't really prefer pointless critique with no improvement, do you[?]

You must be new here.

Re:Not dupe, but almost

[JackMeyhoff]

He should be the kernel code pope that was talked about :)

Re:Not dupe, but almost

[lundqvist]

Sysinternals created some really useful stuff, I agree the guy may be making improvements but its MS marketing thats giving him the script now. Vista wont ever be really secure until MS totally rework their approach to OS design and its default install. The problem is its mass market mostly consists of users with less than average technical know-how and thats why so many compromised systems are out there. If it was secure by default then viruses and malware wouldnt be the huge problem they are now although the tech support overhead would be higher.

Re:Not dupe, but almost

[acidosmosis]

>>I don't like the way Russinovich is blowing Vista's horn now. I liked him more when he was more critical and analytical on what could be improved, instead of what has already been done.

Are you sure that you do not mean that you don't want to hear anything that does not shed negative light on a Microsoft product?

Message to Microsoft

[bonefry]

Just leave my applications alone !

Re:Message to Microsoft

[Anonymous Coward]

Message from Microsoft: "We hold all the cards, and we have the monopoly. Dance or die: we don't care."

doesn't belong in the kernel

[nanosquid]

There is little reason to put these kinds of transactional services into the kernel: they don't involve security or user permissions and they must be efficiently implementable in user code anyway (otherwise, most databases wouldn't work well on NT). So, I'd classify this as "kernel bloat".

Re:doesn't belong in the kernel

[Bacon Bits]

Yet PS3 portability was *absolutely vital*.

Re:doesn't belong in the kernel

[Lally Singh]

They also involve atomic I/O to multiple systems simultaneously. Userland can't do this. Databases work on one system, their own data files, and have full control over these files.

Userland apps don't have that kind of control over the registry. Hell they may not be sure to have that kind of control over the files they're manipulating.

Besides, I'd rather have this code once in a DLL than 10 times in 10 different apps. That's real bloat.

Re:doesn't belong in the kernel

[Anonymous Coward]

Here's a tip: C has a handy feature called #ifdef. Check it out sometime.

Re:doesn't belong in the kernel

[Anonymous Coward]

Because, unlike a DB's transactional system, Vista's is fully pluggable meaning that anything can build volatile transaction management into their application or driver and automagickally gain the benefits of a single logging mechanism and full support for distributed transactions.

And yes, this is a really big deal. Other than maybe OS/400 I know of no system where file system operations can be done atomically with database operations. I can poll data, write a file and update that data all in one atomic operation. Either the data has been exported and marked as such, or not. No in-betweens. No incomplete files. No complete files despite a failure to mark the data in the database. No attempt to manually compensate for errors. It's all there, one operation, atomic and automatically so. This is absolutely massive for my world where financial and business transactions are moved constantly in such a fashion.

Yes, Microsoft does innovate sometimes. This is one of those occasions.

Re:doesn't belong in the kernel

[Anonymous Coward]

I would hardly concider transactional file systems not worth the effort - from what I understand NTFS journal already makes various operations atomic. The vista improvements just allow you to group a series of changes using a explicit transaction concept.

Database servers in effect implement their own storage primitives within single files on the operating systems file store and have nothing to do with this issue.

If the kernel file system driver does not provide primitives to control transaction functions the result is the kludge of temporary files/locking approaches with all of the classic issues developers have been facing with these approaches for years.

Its very similiar to the reason online defragmentation of disk drives require OS primitives to control. Sure applications or libraries can try and reserve contiguous spaces on disk but it is more effective and more benefical that it be done at a lower layer where applications are allowed to be ignorant of what is happening.

Re:doesn't belong in the kernel

[Anonymous Coward]

The majority of the framework is implemented in userland. See the Distributed Transaction Coordinator service.

Re:doesn't belong in the kernel

[Anonymous Coward]

Think outside your small box. These features can provide significantly more than current user-mode transaction management that databases (or OLTP monitors) provide today.

For instance, how does a user-mode controlled file-system transactions rollback changes on reboot? Consider what happens when the change involves system files. NTFS handles this cleanly in Vista but any attempt to do this with a user-mode service would fail because the system files would already be in-use by the time the service started. Further, any transactions in-doubt would remain in-doubt until the service started (if you could get that far).

Similarly, what about settings in the registry? Consider if the transaction spanned installing a driver and updating its settings. What happens if the system powers down midway through that update? Without kernel-level transactions that are available at boot-time you cannot easily recover before inconsistent settings are used with the driver.

Beyond the boot-level support; another exciting aspect about the KTM is that this is a transaction-manager that provides transactions that can be shared across multiple processes. Try that with a user-mode transaction manager like XA or DTC and see your per transaction performance. By managing the transaction in the kernel, the 2PC performance is significantly improved.

In the end, NTFS and the registry live in the kernel -- so their tramsaction manager also has to live in the kernel. That is just the way it works.

Another exciting aspect covered is the ability to coordinate DTC transactions with KTM transactions. Meaning, you can coordinate your SQL Server (or Oracle) updates with your file-system updates. This is cool! No longer do you have to worry about finding orphan-files in workflow applications or other applications that manage both files and relational data.

Lastly, they are talking about full ACID properties with NTFS's transactions. Think about it -- you could update every file on your web server, in place, while its wild with activity. All your changes are isolated from the users until you say "commit" in your application.

Re:doesn't belong in the kernel

[Bacon Bits]

#ifdef is a pre-processor instruction. It's not C code at all.

Re:doesn't belong in the kernel

[Anonymous Coward]

Whoosh.

Re:doesn't belong in the kernel

[EvanED]

Here's another top... the preprocessor is part of C.

Not that you should be using ifdef to separate platform-specific code anyway... it should be put into another file.

Re:doesn't belong in the kernel

[Anonymous Coward]

A truly pathetic attempt at getting the last word on the (completely accurate) previous post by being pedantic.

You prat.

Re:doesn't belong in the kernel

[Bacon Bits]

It's not really part of C, though. It's a common program that parses C code for errors and also listens to instructions means specifically for it. It's run as part of the compiler, but the compiler is not C either. C is a language, not a program.

It's like saying that PHP *is* HTML.

Re:doesn't belong in the kernel

[TheRaven64]

The ISO C specification includes the preprocessor functionality. The original K&R spec did too.

I have not seen a copy of the HTML specification that included any mention of PHP.

Re:doesn't belong in the kernel

[EvanED]

C is a language, not a program.

Yes, I realize that.

And the preprocessor directives are part of that language. Or perhaps you missed sections 5.1.1 and 6.10 of the description of that language? (Assuming the numbering stayed the same from draft to final.)

Re:doesn't belong in the kernel

[nigelo]

> Yes, Microsoft does innovate sometimes. This is one of those occasions.

Well, DEC VMS had this capability decades ago, so is it really innovation?

http://h71000.www7.hp.com/commercial/decdtm/index. html

Re:doesn't belong in the kernel

[Bacon Bits]

Yes, I'm aware it's standardized in the ANSI spec. Nevertheless, I still don't consider it true C code. Preprocessor code is metacoding. Similarly, I don't consider !doctype to be true HTML, and so on. Metacode is extremely useful, and in the case of C it was decided that it is so useful that standardizing it was required. But metadata and metacoding is a secondary language used to facilitate the requirements of the primary language.

If you want to stomp your feet and pout, go ahead.

Still. Not. C.

Re:doesn't belong in the kernel

[swillden]

They also involve atomic I/O to multiple systems simultaneously. Userland can't do this.

Of course it can. As long as the OS provides atomic I/O operations on individual files, the logic for implementing two-phase commit is the same in userland or in kernel space. For that matter, atomic I/O can be implemented entirely in userspace, as long as the OS provides a mechanism for userspace to find out when the data has actually been written. It's more convenient to put single-file atomic I/O in the kernel, though (or at least in the file system).

Besides, I'd rather have this code once in a DLL than 10 times in 10 different apps.

That's not an argument for putting it in the kernel.

Re:doesn't belong in the kernel

[ChrisA90278]

NO. it DOES belong in the kernel. The reason is because these changes must appear to be atomic to other processes. Can't do this in user space

Re:doesn't belong in the kernel

[Anonymous Coward]

this is why i love reading slashdot... the very first reply to this article is, "why is this in userland?" the second replay is, "why is this in the kernel?"

you correctly realize that not every api should be implemented in the kernel, but incorrectly believe that every api is. another posters correctly realizes that this api is not implmented in the kernel, but incorrectly believes that every api should be.

and you're both the highest modded posts in the whole damned thread.

Re:doesn't belong in the kernel

[Anonymous Coward]

Yes, it is innovation. The feature you linked to in VMS is a distributed transaction coordinator. Windows has had this component (called DTC) for years.

The actual innovation is making a Kernel Transaction Manager, along with a resource manager for the filesystem. The KTM means that transactions can be inherited from parent process to child or joined by a cooperating process. Having a transactional filesystem means that all file operations can be all-or-nothing. Power goes out during a major update? No problem, because when you boot up again the filesystem will be recovered and it will be like the update was never started. And the beauty of having the resource manager in the filesystem is that you can combine the filesystem transactions with any other ones in the system (via the DTC). In fact, they could even make it so that you can combine transactions across systems so that moving files from one server to another would be atomic.

dom

Re:doesn't belong in the kernel

[dgatwood]

Of course it can be done in user space. If a user space app can't do it, neither can the kernel. And it isn't atomic I/O. There's no such thing as atomic I/O. I/O operations are reordered, split, combined, etc. by everything from the OS to the controller to the hard drive, and for network volumes, it is even worse. There's no practical way to guarantee atomicity, so you have two choices: have filesystems (including remote filesystems) with rollback capabilities (which still don't completely guarantee anything) or design a file structure that achieves the same thing (which still doesn't guarantee anything). The former is nice for a lot of reasons (e.g. so that every developer doesn't have to reinvent the wheel), but isn't essential by any means. It also would greatly increase the complexity of the VFS layer and filesystems written for it, so if that is the only purpose for doing transactions, it makes a LOT more sense to implement them in a user space library instead of in the kernel.

If your sole purpose is to be able to do multi-file rollbacks, user-space transactional support is as easy as designing your file format and/or layout around it. There are two easy ways to do this: files with built-in history and using swappable directories.

Files with built-in history:

For the initial modification pass, modify each file by appending what amounts to a diff footer. If an error occurs, you can undo all of the changes by truncating the files prior to the latest diff footer. Once these modifications are complete, you no longer need to worry about rolling anything back (except for cleaning up temp files if something fails in the second pass) because the data is safely on disk. (Note: this does require that the kernel and all devices and/or network disks reliably flush data to disk upon request. Don't get me started on buggy ATA drives.)

In the second (optional) pass, you coalesce the diff into a new copy of the file and swap the compressed version in place of the original file. This is generally an atomic operation in most operating systems. If anything occurs during the second stage, it is a recoverable failure, so there is no need to roll anything back. Heck, Microsoft's file formats pretty much do this anyway. (Notice the 500 megabyte single page MS Word document that occurs when you make lots of changes and always "save" rather than "save as".)

Swappable directories

The easiest way (tm) to handle system configuration files in an atomic fashion is to modify config files in the same way you would perform a firmware update: you have an active configuration directory and an inactive configuration directory. You read the active one, make changes, and write to the inactive one. Then you trip a magic switch (tm) that says that the previously inactive directory is now active, and vice versa. Assuming you don't have out-of-order writes going on (which the kernel can't really guarantee any better than user space, sadly), this is a very easy, effective way to perform an atomic commit. And if you have an "exchange in place" operation in which the data for two files or directories in the same directory are swapped in a single atomic operation, that's a really lightweight way to implement an atomic commit/rollback mechanism without most of the complexity.

Considering how easy this is to deal with in user space, the only legitimate reason I can think of to do it in the kernel is so that you can take it out of application control entirely (e.g. to make it easier to sandbox an untrusted application). Otherwise, it makes a lot more sense to do this in a library. Now if it had snapshotting where you could roll back the entire filesystem to arbitrary points in time, that might be interesting (for different reasons)... but basic transactional support in a filesystem is much less so, IMHO, unless your purpose is to be able to sandbox an application. If so, then all this other stuff basically comes for free. In that context, doing this in the filesystem layer makes sense. However, if that is not their purpose for doing this in Vista, then kernel bloat definitely strikes me as an accurate depiction.

Just my $0.02.

Re:doesn't belong in the kernel

[nanosquid]

Of course, you can do it in user space. You could do that in user space already in UNIX V7, and it's been used for anything from atomic system upgrades to maintaining gigabyte mail spool directories without data loss (something that Exchange doesn't seem to be able to achieve to this day). You really don't need a transaction manager in the kernel for that; any one of a number of existing kernel operations is sufficient.

Re:doesn't belong in the kernel

[Anonymous Coward]

Other than maybe OS/400 I know of no system where file system operations can be done atomically with database operations ... Yes, Microsoft does innovate sometimes. This is one of those occasions.

Ummm, you say this features exists in OS/400, so it's hardly innovation. Mass-marketing, maybe.

Re:doesn't belong in the kernel

[Anonymous Coward]

For instance, how does a user-mode controlled file-system transactions rollback changes on reboot?

When the file is first opened, the library code rolls it back if necessary.

Consider what happens when the change involves system files. NTFS handles this cleanly in Vista but any attempt to do this with a user-mode service would fail because the system files would already be in-use by the time the service started.

When the file is first opened, the library code rolls it back if necessary.

Similarly, what about settings in the registry? Consider if the transaction spanned installing a driver and updating its settings. What happens if the system powers down midway through that update? Without kernel-level transactions that are available at boot-time you cannot easily recover before inconsistent settings are used with the driver.

With that approach to design, it's no wonder Windows wedges so much: there are many ways in which settings and drivers can become inconsistent, so relying on transactioned updates to prevent that from happening is unreliable.

Beyond the boot-level support; another exciting aspect about the KTM is that this is a transaction-manager that provides transactions that can be shared across multiple processes. Try that with a user-mode transaction manager like XA or DTC and see your per transaction performance. By managing the transaction in the kernel, the 2PC performance is significantly improved.

Well, that may be true for Windows, since Windows appears to have trouble with the performance of user-mode services, but on UNIX, I'd expect a user mode implementation to be faster, not slower, than a kernel mode implementation.

In the end, NTFS and the registry live in the kernel -- so their tramsaction manager also has to live in the kernel. That is just the way it works.

Well, one bad design decision drives another.

Another exciting aspect covered is the ability to coordinate DTC transactions with KTM transactions. Meaning, you can coordinate your SQL Server (or Oracle) updates with your file-system updates. This is cool! No longer do you have to worry about finding orphan-files in workflow applications or other applications that manage both files and relational data.

If this is a problem for MS SQL Server, then it is poorly designed; UNIX RDBMs do not have this problem.

Lastly, they are talking about full ACID properties with NTFS's transactions. Think about it -- you could update every file on your web server, in place, while its wild with activity. All your changes are isolated from the users until you say "commit" in your application.

I can do that already, without NTFS, or a transaction manager, or any form of kernel level transactions.

Well, mainly what your comments illustrate is that on Windows, one bad design decision drives another.

Re:doesn't belong in the kernel

[Herby Sagues]

It IS atomic IO. IO commands can be reordered as much as you want, but commands can be tagged for flush or immediate execution, and if a device doesn't comply with those, it is either badly writen or it has incorporated enough safeguards so it doesn't matter. For all practical purposes it is atomic IO. In addition, how do you expect a user mode component to be able to implement transactional services for kernel components? This is not only about begin trans /end trans for copying files. It is about bringing transactiona capability to every operation in an application and in the kernel. Yes, it is not yet exploited by every single kernel process, and probably will never be, but it is already being used by kernel code to simplify error handling and to provide better guarantees of consistency. Making it user mode would only increase state transitions with no real benefit to anyone.

Re:doesn't belong in the kernel

[dgatwood]

IO commands can be reordered as much as you want, but commands can be tagged for flush or immediate execution, and if a device doesn't comply with those, it is either badly writen or it has incorporated enough safeguards so it doesn't matter.

I'm laughing. No, really. A lot of devices lie in one way or another. It's not just a few badly written devices. You'd be shocked. My favorite are the drives that completely lie and say that the cache has been flushed when it really hasn't. Most of those drives, you can issue a second flush request and it will block, but there are some that always instantly return success for a flush request. It's not even all that uncommon, ESPECIALLY with external drives because of bridge firmware bugs.

I've heard some true horror stories about the number of problems companies find when qualifying off-the-shelf ATA drives for server use. If you heard them, you would cry. Truly, all you can assume is that the operating system has made a best attempt at a guarantee. Anything more than that is just kidding yourself... and you can get that same level of guarantee just as easily from user space (at least in UN*X) by executing two sync system calls in a row.

In addition, how do you expect a user mode component to be able to implement transactional services for kernel components?

WHAT!?!?!?!?!?! Why in you-know-where would anything in the OS kernel need filesystem transaction support? Stuff in the kernel shouldn't even be READING files, much less writing them! Yes, I'm serious. The kernel should provide only the most critical, basic system-wide OS services. Anything that requires such heavy lifting is NOT providing such a critical, low-level service, and thus, does NOT belong in the kernel. It's that sort of thinking that has led to such abominations as khttpd....

I'm going to go hide now. I'm very scared....

Re:doesn't belong in the kernel

[Anonymous Coward]

"And yes, this is a really big deal. Other than maybe OS/400 I know of no system where file system operations can be done atomically with database operations." "Yes, Microsoft does innovate sometimes. This is one of those occasions."

I'm sure, over the years, many people have been tempted to tease elephants, but it takes a special kind of idiot to actually do it. The moral? It's innovation, just not the good kind.

Re:doesn't belong in the kernel

[sych]

Another exciting aspect covered is the ability to coordinate DTC transactions with KTM transactions. Meaning, you can coordinate your SQL Server (or Oracle) updates with your file-system updates. This is cool! No longer do you have to worry about finding orphan-files in workflow applications or other applications that manage both files and relational data.

If this is a problem for MS SQL Server, then it is poorly designed; UNIX RDBMs do not have this problem.

I think he was talking about this:

Step 1. Program writes a file to a directory.
Step 2. Program updates database to say "file X written to location Y"

I think he's saying single transaction can surround both of those actions... so, if the DB update or insert fails inside the transaction, then the file write or move or whatever will also be rolled-back.

Re:doesn't belong in the kernel

[nanosquid]

This issue crops up in just about every major software system: database servers, web servers, mail server, multimedia servers, package install managers, etc. UNIX has been used for these kinds of applications for decades. Do you seriously think UNIX systems would be lacking a general purpose kernel transaction manager if it was useful for solving this issue? It's not rocket science to write one, and if it's not there, it's a good bet that it's not needed.

The functionality you want can be encapsulated neatly in user code, using standard UNIX file system semantics, with the same guarantees and behavior as if you had a kernel transaction manager.

Re:doesn't belong in the kernel

[Lally Singh]

Atomic I/O generally (I'm from the posix side of things, so maybe there are different definitions on win32) means that the entire operation's done by the kernel at once. E.g. I write 16 bytes at offset 0 to this file, and another app's writing 16 bytes at offset 0 to this file. When we're both done writing with a single write() call, the file's got 16 bytes from one of us, not some from one and some from another. No amount of userspace I/O calls will guarantee this (outside some godawful locking, which essentially forces the same thing, only with more context switches and a lot more userland complexity).

In terms of filesystem changes, all the files are created (possibly overwriting other files) or, if one fails, they all undo. Same for registry changes. Them all running together to completion or not at all sounds great. I definitely want registry changes to be atomic, b/c there's a good chance other apps are mucking around with it too. Also, I want those changes to be consistent -- with an atomic change that includes both the registry and a filesystem change, I can make sure I don't change a file with the registry pointed to the old value, or visa versa. In userland I could roll back, but I couldn't stop that time period when it's inconsistent.

Re:doesn't belong in the kernel

[EvanED]

As long as the OS provides atomic I/O operations on individual files, the logic for implementing two-phase commit is the same in userland or in kernel space.

Really? How?

You CAN'T do it without kernel support. You can do it for cooperating programs through auxilary files and such, but not in general. If you have a program create two files, even if you can create each file atomically, you have to make two system calls which means you could be preempted between them and have another program see only one file.

I'm not *totally* convinced of the real world benefits of this, but it's something that *can't* be done in userspace.

Re:doesn't belong in the kernel

[EvanED]

Give me a program that will create two files in a directory while guaranteeing that no program can see only one of them.

Re:doesn't belong in the kernel

[maxwell demon]

Stuff in the kernel shouldn't even be READING files, much less writing them!

Well, I'd expect the kernel's read system call to read files, and the kernel's write system call to write them. :-)

Re:doesn't belong in the kernel

[maxwell demon]

Simple:
Step 1: Add commands creating those files at the beginning of the boot sequence (directly after mounting the file systems, before starting anything else).
Step 2: Reboot.
Step 3: Remove the commands from the boot sequence.
SCNR :-)

Re:doesn't belong in the kernel

[nanosquid]

Give me a program that will create two files in a directory while guaranteeing that no program can see only one of them.

mkdir newdir; touch newdir/file1; touch newdir/file2; mv newdir dir

On UNIX, dir/file1 and dir/file2 both appear at once, atomically.

This is only one of a large number of design possibilities for atomic updates/changes on UNIX. People tend to pick designs that offer robustness not only against interruptions, but also against other kinds of corruptions, which is probably why UNIX systems tend to be more robust than Windows.

Re:doesn't belong in the kernel

[dgatwood]

Of course, this doesn't completely solve consistency for the registry. Atomicity does not guarantee consistency with shared data structures. It just guarantees that everything (right or wrong) happens at once. Only exclusive locking can guarantee consistency.

For example, say that you have two values, A and B, and two processes, 1 and 2. Both of these are counters, both set to zero. Process 1 intends to increment both counters, so it reads the contents of both counters. Process 2 increments counter A in an atomic operation. Process 1 now writes changes to both counters in a single atomic operation. The resulting values are 1 and 1, but if you want true consistency, the values should have been 2 and 1. The problem is that, while the writes were atomic, the reads were not part of the same atomic operation. You can't prevent that unless you prevent process 2 from modifying the data after process 1 has read the data and before it has written the data. This requires exclusive locking. While exclusivity can be used to guarantee atomicity, atomicity does not inherently guarantee exclusivity. More accurately, the presence of atomic operations is only one of the requirements for exclusivity. The best you can really do without locking is to order your modifications from least to most volatile and hope for the best.

Further, atomic commits do not even fully solve the problem of the registry and files being inconsistent with each other in a real-world environment. Processes do not read the registry and files in a single atomic operation. Processes 1 and 2, registry entry E, file F. Process 1 wants to read the file. It asks the registry. Process 2 commits a change that simultaneously changes the registry and changes the name of file F to F1. Process 1 tries to read file F (at the old location) and fails. The data on disk is consistent---the registry entry points to F1---but from the perspective of process 1, the data was not consistent.

The -only- way to guarantee absolute consistency is to not allow any process to read any portion of the data that is being modified until after all modifications are complete, which means locking. Otherwise, there is still a period if inconsistency, and thus, atomicity does not guarantee consistency. If you have to lock to guarantee consistency anyway, you might as well do it all in user space.

Re:doesn't belong in the kernel

[swillden]

Upon further thought, I stand corrected. There are lots of cases you can implement without kernel support, either with cooperating programs or with symbolic links, but a fully general implementation has to be in the file system.

Re:doesn't belong in the kernel

[EvanED]

mkdir newdir; touch newdir/file1; touch newdir/file2; mv newdir dir

If dir/ already exists, that will move newdir/ INTO dir/.

Perhaps I should have said that you need to create two files in an existing directory.

(I'm not sure about the use cases of this, if they are actually helpful in any real world programs, but that's not what I'm arguing.)

Re:doesn't belong in the kernel

[nanosquid]

If dir/ already exists, that will move newdir/ INTO dir/.

Of course it will. So what? The code I wrote illustrated how your requirement can be satisfied. In fact, this is not the way real UNIX programs usually do atomic operations (there are far better ways).

(I'm not sure about the use cases of this, if they are actually helpful in any real world programs, but that's not what I'm arguing.)

Yes, there are many kinds of operations you cannot make atomic with the UNIX file system primitives. My point is that you don't actually need those. Therefore, adding the bloat and complexity of a general purpose transaction manager to the kernel simply is not necessary.

learn from biology

[wizardforce]

I wonder if these new "security features" put into Vista no matter how good they at first appear to be, will over time be bypassed, comprimised and made obsolete. The main problem is that security only goes as far as the person using the OS lets it. just look at the UAC- it's annoying, and many people disregard it or shut it off entirely. what now is the security benefit? These features only make VIsta "more secure" because they have not yet been exposed to the wild for sufficient time to be comprimised as thoroughly as prior versions. It is much like in biological systems, for example penicillin was not widely utilized in fungal kindoms and it was thus effective as an antibiotic- once we spread its interactions with bacteria, bacteria developed a resistance. Vista is no different- only this time security threats are the bacteria and Vista is the antibiotic.

Re:learn from biology

[quux4]

OK, good points about users turning off security protections. But hardly unique to Vista; you can do that in any OS. It's the price of popularity.

Kernel enhancements? Are you sure?

[Applekid]

According to the bottom of just one function of the KTM reference:

"Requires Ktmw32.dll."

Why would a kernel add-on require a .dll, exactly? Did I miss some Windows fundamental about it's kernel? And if it's not really a result of a kernel enhancement, is this yet another potentially useful technology specificly excluded from earlier versions of Windows entirely for business purposes instead of technological limitations?

Re:Kernel enhancements? Are you sure?

[Cyberax]

Because this DLL is just an interface to kernel features.

Windows NT was initially designed to use single kernel for different subsytems (OS/2 subsystem, POSIX subsystems, etc.). Subsystems are implemented as dynamic modules talking with the kernel through LPC (Local Procedure Call, see http://en.wikipedia.org/wiki/Local_Procedure_Call ). So in this case ktmw32.dll just wraps LPC calls in a nice API. That's actually a rather good design.

Re:Kernel enhancements? Are you sure?

[Anonymous Coward]

Um, so that you can access it from userland? How the heck do you expect applications to be able to use it?

Re:Kernel enhancements? Are you sure?

[Keeper]

The dll performs the mapping from the "nice" function call you see in MSDN to the system call(s) required to perform the desired operation.

Re:Kernel enhancements? Are you sure?

[EvanED]

Windows NT was initially designed to use single kernel for different subsytems (OS/2 subsystem, POSIX subsystems, etc.)

Not just initially designed, it DOES use a single kernel for different subsystems. You can't get the OS/2 one any more, but the POSIX subsystem morphed into (part of) the Services for Unix which has become the Subsystem for Unix-based applications.

On 32-bit Windows, 16-bit Windows applications are handled by the "Windows on Windows" subsystem. On 64-bit Windows, 32-bit Windows applications are also handled by a "Windows on Windows" subsystem, though a different one than WOW16.

Re:Kernel enhancements? Are you sure?

[anImortal]

Its a small DLL that provides you with Win32 APIs to call kernel (Nt) functions.

What is the registry in Vista?

[mosel-saar-ruwer]

For years, the "Registry" was some weird mish-mash of binary files, many of which represented Jet databases.

Has Jet been completed abandoned in Vista?

If so, did they switch to the slimmed down SQLServer [that was supposed to be part of WinFS]?

Re:What is the registry in Vista?

[allanw]

Nope, the registry is still a bunch of binary files, located in the same folder.

Re:What is the registry in Vista?

[Foolhardy]

The registry is a single root hierarchical database with registry hive files mounted at the second level (below \REGISTRY\MACHINE and \REGISTRY\USER for the computer's config and user config, respectively). The registry engine is implemented in kernel mode as an executive subsystem (inside ntoskrnl.exe), where it is known as the Configuration Manager. Registry hives use a transaction journal (like many filesystems do) to avoid corruption during a power failure or crash. Standard system hives are located in %SYSTEMROOT%\System32\Config and include SAM for local user accounts, SECURITY for various secrets held by the computer, SYSTEM for core system configuration early during boot, and SOFTWARE that stores all other config associated with the computer in the registry. Every user profile has its own registry hive for user-specific configuration. Everything above is still the same in Vista as it was in NT 3.1.

There are two database engines that have been known as Microsoft "Jet", known as Jet Red and Jet Blue. Jet Red is also known as the Access database engine. It is a fairly featureful SQL database. Jet Blue is now officially the Extensible Storage Engine (ESE), and has been a system component since Windows 2000, backing WMI data, Active Directory, Exchange, and others. It is an ISAM database and is optimized for large sparse tables and also supports a transaction journal. Both are 100% user-mode and were not a part of the initial release of Windows NT. Microsoft has said that Jet Red is depreciated, and that future versions of the Access database engine will be integrated with Access and not have a public interface. Jet Blue's interface is well documented and will continue to see use for some time to come. Both being user-mode, dependent on Win32 and the wrong type of database (relational vs hierarchical), the Jet engines would not be suitable replacements for the registry.

SQL Server is a high-end SQL database engine. It was rumored that WinFS would use SQL Server Express and that Microsoft eventually plans to move some of the services that use Jet Blue to SQL Server (such as Active Directory). In any case, SQL Server is an even less possible replacement for the registry.

Microsoft has not gotten rid of the Registry in Vista. In fact, the new boot manager uses a registry hive to store boot configuration, replacing the old boot.ini.

Re:What is the registry in Vista?

[textureglitch]

Microsoft has not gotten rid of the Registry in Vista. In fact, the new boot manager uses a registry hive to store boot configuration, replacing the old boot.ini.

Oh wonderful. Does this mean that WHEN Windows crashes and refuses to boot up again I'll have absolutely no way of editing the boot configuration with a rescue disc?

Re:What is the registry in Vista?

[Anonymous Coward]

"Does this mean that WHEN Windows crashes and refuses to boot up again..."

Vista doesn't crash.

I think someone forgot to drink their Koolaid today.

Re:What is the registry in Vista?

[Foolhardy]

Like I said, you can mount any registry hive on a running Windows system, including the %SYSTEMDRIVE%\Boot\Bcd hive. bcdedit.exe does exactly that. A windows-based rescue disc can just as easily mount the hive for editing. It will make editing boot config from a different operating system's rescue disc a lot harder, though. More about bcdedit.exe and the BCD hive

To mount a registry hive manually from regedit, select either HKEY_LOCAL_MACHINE key or HKEY_USERS and select File->Load Hive. Note that you can also save and restore any key as a hive by selecting "Registry Hive Files" as the file type during export or import. See also reg.exe's load, unload, save and restore functions.

Hmmm... Upgrade to Ultimate Vista perhaps?

[pegr]

"If all the changes succeed, the application commits the transaction and the changes are applied, but at any time up to that point the application can roll back the transaction and the changes are then discarded."
 
What, was my credit card declined for my upgrade to Vista Ultimate Edition?

Mod up

[Anonymous Coward]

It's what I was going to say

Not exactly "error recovery"

[Ancient_Hacker]

Recovery? The Windows Registry is the exact opposite of recoverable:

• "Regedit" has no Undo command. It applies changes immediately.
• The Registry file is in a proprietary and undocumented format.
• One scrozzled byte in the Registry can make it completely broken and make the system unbootable.

Not exactly most people's idea of robust and recoverable.

Re:Not exactly "error recovery"

[Anonymous Coward]

Possibly because you're not supposed to fuck with it!. MS rarely suggest you tinker in the registry and when they do they tell you to be damn careful, there are confirmation prompts before you delete keys as well. This is like complaining about rm borking your box because you pressed f instead of d or whatever.

Re:Not exactly "error recovery"

[bmajik]

The registry can be backed up and restored, in whole or in subsections.

The format of the registry is largely irrelevant, but it is described to some extent in the "Inside Windows xxx" series of books (which Russinovich co-authored)

Which specific byte would you "scrozzle" in the registry to render a machine unbootable? How and why would you do it?

Extra credit:
Which files under /boot, /etc, /sbin, and so on would you be willing to stake your career on being "safe to corrupt by 1 byte" and still guarantee a bootable system?

There are things to like or dislike about either a registry based approach (opaque data storage with a defined interface) vs a flat text based approach (clear data storage with an undefined interface). I don't think you make a compelling "anti-registry" argument with the points you list, however.

Re:Not exactly "error recovery"

[DeifieD]

It does have an undo command, just not Edit - Undo. Welcome to a post Windows95 world.

If you screwed up the registry you could always make them bootable again, you just had to screw around at the command line. Linux does not make leaps and bounds over this fix. X not booting? Time to go screw around at the command line again.

Re:Not exactly "error recovery"

[Anonymous Coward]

I am surprised that no one mentioned the registry should be a CVS revisioning system. Being able to roll back/audit and have full control on what gets to read/write registry should help on security.

Re:Not exactly "error recovery"

[Anonymous Coward]

One scrozzled byte in the Registry can make it completely broken and make the system unbootable.

What is that magic, dangerous byte? If it ever existed, wouldn't be trivially easy to write a virus and scrozzle it? Where are these viruses?

Re:Not exactly "error recovery"

[Doctor Crumb]

You are confusing a windowing system (X11) with an OS (Linux). While you may have to "screw around on the command line" to get X working again, everything else will continue to work just fine (filesystem, webserver, internet, etc), all of which you can use either from a virtual console or a remote connection. If explorer.exe won't start, how exactly do you fix that without sitting down with a recovery CD?

Re:Not exactly "error recovery"

[fabs64]

Difference being you're not supposed to modify things in /boot and /sbin for all your settings, and /etc is text and therefore much harder to screw up. (you could put an EOF as the first byte in the file, but the system will still probably at least give you a "file x is empty" error message).

What you've said is correct, the gp's gripe is really about using a binary configuration file.. a fairly stupid decision but that is only my opinion.

My argument for flat text (or xml or whatever) over binary, is the same as every argument about the two for the past 5 years, binary is too system specific, reading/writing it is almost always more painful (faster though), reverse-engineering the format is always a much bigger job.

The "defined interfaces" argument doesn't really wash, you can define an interface just as easily for a text file as you can for binary, however with text someone may be able to edit it by hand or write their own interface, with binary this is much more difficult.

I think what it really comes down to is this; If you decided to write a new OS today from scratch and wanted to have a central configuration database (a good idea, as shown by /etc), would YOU come up with the windows registry?

Re:Not exactly "error recovery"

[Zwaxy]

Viruses which immediately kill their hosts don't survive very long. Modern viruses mostly want cause as little disruption to their host as possible in order to avoid detection while they carry out their owner's bidding.

Re:Not exactly "error recovery"

[Penguinisto]

What is that magic, dangerous byte? If it ever existed, wouldn't be trivially easy to write a virus and scrozzle it? Where are these viruses?

You can't pump V1@grA spam or DDoS packets out of a dead machine, and malware writers are definitely in it for the cash nowadays. (IIRC, a large percentage of malware specifically hides in the registry...)

/P

Re:Not exactly "error recovery"

[Talchas]

/boot - kernels/initrds I'm not using (which should be tossed out). configs. I don't know what would happen if an insignificant byte in grub.conf changed, but I generally wouldn't bet on being safe. /sbin - oddly enough, lots. fdisk/cfdisk. fsck + friends would probably boot somewhat. e2image, e2label, ctrlaltdel,shutdown,mkfs*,installkernel. /etc - much of it, just to boot. Boot and have everything work, far less of it - but at least I could usually boot and I would usually know what was broken.

But yes, I understand your point. However - a broken byte in an unbacked up (yeah a bad idea) registry that causes complete failure is far far harder to find than one in /etc, as the one in /etc would generally be in a single plain-text file, and you'd often be able to guess which file from error messages. /sbin and /boot are binary files that don't contain custom configuration data - if something breaks, you can easily replace it without thinking hard. If you lost all of /etc or the registry, you would have to reconfigure your system, which may be far more work.

Re:Not exactly "error recovery"

[Anonymous Coward]

Explorer.exe doesn't run until you login. If it won't start, you can always run remote diagnostics and fix it over the network. If your server has that problem, you might never notice. As a matter of fact, Longhorn Core server doesn't even come with Explorer.

The GP's point stands. The registry is no more vulnerable than any number of Unix config files. An extra newline in /etc/password will cause the same problem.

dom

Re:Not exactly "error recovery"

[EvanED]

The registry is no more vulnerable than any number of Unix config files. An extra newline in /etc/password will cause the same problem.

Even if you accept that, it's still easier to diagnose and recover from the extra newline.

Re:Not exactly "error recovery"

[Beryllium Sphere(tm)]

I've been known to put my /etc into cvs.

Re:Not exactly "error recovery"

[Anonymous Coward]

Mac Users love to bash the "registry". It's like the way they used to fo complaining about "Thegmented Architectures" (with a mincing lisp) until Apple started to use Intel. (As if these mac freaks with the purple hair and eyebrow rings even need to know anything about the CPU inside their box as long as their apps run fast enough.) Apple enourages propagandists to make postings like that because its the only way they can get any sort of advantage. Their 32-year-old Unix with a little NextStep and OS-9 slapped on top of it is not gaining any market share. iPods are keeping the company afloat.

Re:Not exactly "error recovery"

[CliffSpradlin]

Just to be clear, there are some standard unix programs that store binary configuration information in /etc, such as tripwire. Either way, you can quite definitely completely fuck up your system by editing the wrong files in /etc. /etc is NOT a central configuration database by any means, and it certainly is not one with a standardized interface. This is not to say that the registry is any better or worse. (Note, I hate the registry, but it's largely in part due to the below reason)

What it comes down to is it's not the configuration system provided at fault as much as how the system is used by applications and system libraries. Any configuration paradigm can be abused.

Re:Not exactly "error recovery"

[drsmithy]

Difference being you're not supposed to modify things in /boot and /sbin for all your settings, and /etc is text and therefore much harder to screw up. (you could put an EOF as the first byte in the file, but the system will still probably at least give you a "file x is empty" error message).

Users aren't supposed to modify the Registry, either.

What you've said is correct, the gp's gripe is really about using a binary configuration file.. a fairly stupid decision but that is only my opinion.

It was designed in the late '80s (well, arguably the late '70s) when a 20Mhz 386 with 4MB of RAM was "bleeding edge". Text-parsing is expensive.

I think what it really comes down to is this; If you decided to write a new OS today from scratch and wanted to have a central configuration database (a good idea, as shown by /etc), would YOU come up with the windows registry?

Windows NT wasn't designed today, it was designed in the late 80s.

Re:Not exactly "error recovery"

[fabs64]

How is the interface to /etc not standard..? Last I checked we have the navigation of filesystems pretty down-pat.
Obviously what an app puts into its configuration files is undefined, but I'm pretty sure you can put Strings in the registry as well?
The registry is essentially a (bad) re-implementation of a filesystem, it's no more standardised (less so really) than just USING the filesystem.

Re:Not exactly "error recovery"

[manastungare]

either a registry based approach (opaque data storage with a defined interface) vs a flat text based approach (clear data storage with an undefined interface).

The GP's point was not entirely about automatic recovery from a broken structure; it was about human-led recovery. In a binary dump, even with defined interfaces, a single byte can render the entire structure non-human-readable. With a plain text file, a human can look at it and try to diagnose the problem -- simply by looking.

Re:Not exactly "error recovery"

[fabs64]

So about when did /etc become the de-facto standard in Unix for configuation?
"It was designed a long time ago" is not a valid argument for how something is today.
"Users" aren't supposed to modify the registry, but it's still where apps store settings, what app is storing settings in /sbin or /boot?

Re:Not exactly "error recovery"

[drsmithy]

However - a broken byte in an unbacked up (yeah a bad idea) registry [...]

The Registry is automatically backed up at the completion of a successful system boot. This has been true since at least Windows 2000, and probably longer.

Re:Not exactly "error recovery"

[newt0311]

I am being picky here but oh well. Most UNIX systems and at least Linux if nothing else have gotten rid of the EOF character in favor of just recording the file size seperately. Tossing a ^D or multiple ^Ds in a file doesn't have an effect on reading it though the parser used may make a difference.

Re:Not exactly "error recovery"

[drsmithy]

So about when did /etc become the de-facto standard in Unix for configuation?

No idea, but since /etc and the Registry are worlds apart in function, purpose, usage and capabilities, it's hardly relevant.

"It was designed a long time ago" is not a valid argument for how something is today.

It most certainly is. You can't just remake something as big as a modern operating system from the ground up every time the latest cool fad comes around.

(And I'm sure you'd be happy to defend the train wreck that is /etc with some line about how long it's been around, so that's just the way it is.)

"Users" aren't supposed to modify the registry, but it's still where apps store settings, what app is storing settings in /sbin or /boot?

How is it relevant ? The complaint was that twiddling the right bit in the Registry could render the whole system unbootable. The point is that the same thing can happen on any system.

Re:Not exactly "error recovery"

[ScrewMaster]

How is it relevant ? The complaint was that twiddling the right bit in the Registry could render the whole system unbootable. The point is that the same thing can happen on any system.

Not to dispute your conclusion, but one relevant aspect is that it seems to happen one hell of a lot more often in registry-based systems. For example, my development system at work is XP-based, and for no apparent reason my Recycle Bin disappeared. Off the desktop, My Computer, just gone. No idea where it went. I first tried Microsoft's "Recycle Bin Recovery" procedure to re-enter the appropriate keys: no dice, the corruption was deeper. Fortunately found a registry tweaks site that had a reg file that restored all the required keys. I was lucky that time, other times I've been less so.

As a developer, I do use the registry for storing some settings, but only non-critical ones. I don't like the idea of putting my customer's configuration data (and in the software I work on, there's a lot of it) into the registry. Too risky, and there's no easy way for a customer to back anything up. Personally, I've never really seen the light when it comes to application data storage using the registry. I've been burned too many times.

Re:Not exactly "error recovery"

[bmajik]

There's no file to look at. The computer didn't boot.

If you've booted the computer off of some other media and are attempting to repair the configuration info, you're using a special tool to do it (like a text editor for /etc files, or a registry editor for the registry)

Also, I've not seen evidence that a single byte defect renders the registry unreadable or the computer unbootable. I don't dispute that this is possible, but I'd be curious to know if this is a practical issue or a theoretical complaint. For instance, there is redundancy in the registry (last known good being a different spot than current control set, for example).

Re:Not exactly "error recovery"

[bmajik]

Are you seriously asking?

what is the comment convention?
What is the whitespace convention?
Does this version of this flavor use spaces or tabs in /etc/fstab (or is it /etc/vfstab on today's OS?)
What are the file locking semantics?
Which set(s) of files are logically related to the same peice of functionality?
What character encodings are supported?
What _line termination_ is supported?

nfs export your /etc directory r/w some time. Let someone edit your /etc/fstab in TextEdit on a Mac. Make sure they cut-and-paste from a sample they saw on a website, or that they got via an email. Are you willing to bet your uptime on that working correctly? Even if you control the email or webpage they're pasting from.. are you _sure_ it would work? That there'd be no conversion problems?

Have you ever done a *nix upgrade on a machine? What happens to most of the files in /etc? The answer is NOT "your changes are seamlessly rolled forward"

Re:Not exactly "error recovery"

[Anonymous Coward]

On Vista, if it got the portion of the registry that stores which OSes are installed, it is simply not booting. (e.g. one byte change renamed that key).

Re:Not exactly "error recovery"

[Anonymous Coward]

if you're going to be picky, try being correct first. EOF isn't a character, it's the physical end of the file. There are a handful of toy computer OSes from the late 70s/early 80s which used an EOF character to mark the end of the file (they only kept track of the number of blocks in the file). Unix (minix, linux, bsd, etc) have never operated that way.

Re:Not exactly "error recovery"

[larry bagina]

I've been known to put my /penis into vagina.

Re:Not exactly "error recovery"

[bmajik]

Care to explain that? The "list of OSes" information that i think you're talking about is in the BCD store, which i dont think is part of the Vista registry. You muck with that via bcdedit, and the bcdstore is specifiable as an argument.

Re:Not exactly "error recovery"

[daverabbitz]

The GP's point stands. The registry is no more vulnerable than any number of Unix config files. An extra newline in /etc/password will cause the same problem. Firstly, there is no such file /etc/password, it is /etc/passwd since K&R didn't like typing and skimped on letters.

Secondly, I just tested this and it is completely untrue. extra newlines have absolutely no affect on the functioning of /etc/passwd in a linux-pam system.

Thirdly, transparent human readable and logically laid-out config files in /etc are much easier to diagnose and fix than an arbitrary (and slow) binary registry where the typical entry is something like "0x67386768787ab7aab87b78cd87687" and the key is "GRPAccountMaskFoo" (made up). Even when you take into account that files in /etc don't have any uniform format.

Sadly, some unix developers are oblivious to this simple truth, and are intent at re-creating the windows registry and COM *glares at Gnome developers*.

Re:Not exactly "error recovery"

[TrancePhreak]

Clearly trolling.. Since the days of at least Windows 98 there were built in mechanisms to backup and restore the registry. Windows XP even does this on its own when needed.

Re:Not exactly "error recovery"

[weicco]

If explorer.exe doesn't start, user gets (at least in XP) blue screen (not that BSOD, but just a blue screen) in front of him. Then user can press CTRL+ALT+DEL, execute Task Manager and use that to start other applications. You can test this by terminating all explorer.exe processes with Task manager. But you must be quick, since XP will try to automatically start shell process if it sees it has been terminated. Btw. there's a registry entry which tells which shell should be started: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon Shell=Explorer.exe

Maybe you are confusing windowing system to NT kernel :)

Re:Not exactly "error recovery"

[Anonymous Coward]

> "Which files under /boot, /etc, /sbin, and so on would you be willing to stake your career on being "safe to corrupt by 1 byte" and still guarantee a bootable system?"

Heaps of 'em. As I write this I have a RedHat box awaiting repair which I tried to do an upgrade on - the upgrade failed and nuked most of the /usr partition on the way. Still boots though, and even tries to load the (now non-existant) X windows system.

It's also somewhat usable for minor tasks including backing up the /home partition to DAT tape before repair (I know, I know I should've backed up first, but I didn't). /usr contains how many bytes again? Rather a lot in my recollection. So if the bet is my career versus a 1 byte change somewhere in a system directory against having a bootable system, you'd need to be offering pretty punitive odds before I said no.

Re:Not exactly "error recovery"

[Talchas]

Huh, to where? I recently had to fix a computer which wouldn't boot because part of the registry was corrupted, and I couldn't find any backup other than in a System Restore point. Maybe I just didn't know where it was.

Re:Not exactly "error recovery"

[Keeper]

System restore is the backup mechanism. If you've got system restore enabled, it manages creation of restore points (which include registry backups) and deletion of old restore points on a regular basis. If your registry is corrupted, it is supposed to fallback to a version of the registry contained in a previously generated restore point. If none of the restore points have a valid snapshot of the registry (ex: you've disabled system restore or your drive is horked) you're SOL.

Re:Not exactly "error recovery"

[weicco]

But tell me, how do you add extra new-line to registry? It's much more easier to mess up text files with text editor than mess up registry with registry editor. And trust me, I've done both :)

Re:Not exactly "error recovery"

[Penguinisto]

nfs export your /etc directory r/w some time

Dunno about him, but... I'm crazy, not stupid.

/P

Re:Not exactly "error recovery"

[Bu11etmagnet]

Extra credit: Which files under /boot, /etc, /sbin, and so on would you be willing to stake your career on being "safe to corrupt by 1 byte" and still guarantee a bootable system?

/etc/motd ?

Re:Not exactly "error recovery"

[Penguinisto]

True, but it doesn't always work as advertised, especially in teh case of a half-munged registry. Say a user screws something up, thinks "reboot!", and does so... after it reboots, the registry is still hosed, and if it can get even barely to a running state (not necessarily one in which you can do anything...) Then the bad registry now gets copied over the backup, and now the once-good registry is now gone. I think (don't know for sure) that was one of the reasons and rationales for putting in the System Restore stuff when XP and Win2k3 came out - so that at least there's something to fall back on.

/P

Re:Not exactly "error recovery"

[Foolhardy]

The BCD store is implemented as a registry hive, kept in either EFI or \Boot\Bcd. It's not mounted most of the time though; the boot loader mounts it long enough to read it and bcdedit mounts it just long enough to make an edit.

On the topic of one byte corruption of binary databases, what about the filesystem database? How many FSes could break boot with a single corrupted byte, e.g. in a filename record?

Re:Not exactly "error recovery"

[Talchas]

OK, then, that makes sense. Fallback mechanism must have screwed up or something, as copying all the old registry data from a recent restore point worked just fine.

Re:Not exactly "error recovery"

[Ancient_Hacker]

>The registry can be backed up and restored, in whole or in subsections.

... not when it's scrozzled so the ReadRegistry API crashes to the BSOD. I'm not typing thru my hat-- I've had this happen more than once.

>Which files under /boot, /etc, /sbin, and so on would you be willing to stake your career on being "safe to corrupt by 1 byte" and still guarantee a bootable system?

Apples and Oranges. I can edit the text files and cp the binary files. Can't do either with the Registry.

>The format of the registry is largely irrelevant, but it is described to some extent in the "Inside Windows xxx"

Well, when my Registry got scrozzled I looked all over the net for source code that could read a Registry and didnt find anything. So the descriptions out there are likely less than usable.

Re:Not exactly "error recovery"

[DeifieD]

What I meant by that was: It's easy to screw up Windows and go fix it if you know what you are doing.

It's easy to screw up Linux configs and go fix those too, whether it be webserver, internet, whatever. Albeit probably much easier.
  (Didn't need a windows CD pre NT4 or 2K, but that's kinda reaching).

Just some screwing around at the command prompt. I see your point on usability of the entire system though.

'Protected Processes' and PC games

[JanusFury]

A fairly common trend these days in PC games (mostly multiplayer ones) is the use of a kernel-mode windows driver (effectively a rootkit in most cases) to 'protect' the game from hacking. Many eastern (korean, taiwanese, etc.) game development companies opt to use this mechanism to secure their games instead of writing secure client and server code - for example, GunBound, Maple Story, Ragnarok Online, Rakion, etc... pretty much any MMO you see an ad for these days that isn't from a US or European studio uses this stuff for security. The basic mechanism it uses is that it hooks all the low level operations you can do on your system (file access, process access, etc.) and prevents you from touching anything related to the game. The end result is that you can't even so much as end-task a misbehaving game 'protected' by this driver.

With the huge amount of popularity this approach seems to have (I personally suspect it's a result of some very, very aggressive marketing on the part of the driver's developers), I wouldn't be suprised to see many games start demanding that users run them on Windows Vista, so that the 'protected process' mechanism can be used to fully 'protect' the games from users' interference. While you'd at least be able to end-task them, I can't say I see this as an improvement. It's saddening that many companies believe the solution to security is a series of hacks, workarounds, and black boxes - the only real solution is careful, methodical design and engineering. It seems very likely to me that within a few years, many PC games will refuse to run on anything except a Vista system with nothing but signed drivers loaded, and that's saddening. I dislike the notion that I am denied even basic rights to investigate what an application is doing on my machine simply for the sake of 'security', when it's trivial to set up a second machine to inspect and modify a game's network packets and cheat all I want.

Re:'Protected Processes' and PC games

[mpapet]

the solution to security is a series of hacks, workarounds, and black boxes

Outside of some very specific gov't spooks contract work, no one is willing to adopt the other because it's more expensive and requires more thought and risk than the average PHB can handle.

Case in point: The number of cashless casino gaming systems that are centrally managed. The average casino manager understands their casino systems are a single, massive, point of failure. Just wait till they go to cashless floors and someone engineers a jackpot for themselves.

Security programming is hard. Really hard. The developers at these companies may _want_ to do the right thing, but they don't because of the complexity and limited resources.

The big-digital-bank-robbery just hasn't happened yet.

Re:'Protected Processes' and PC games

[nuzak]

> Just wait till they go to cashless floors and someone engineers a jackpot for themselves.

That would be a neat trick to do with the end-user UI of a slot machine. Physical security is a pretty important first step.

> The big-digital-bank-robbery just hasn't happened yet.

Actually, when you look at identity theft and fraud, you can see it's happening every single day. Think breadth and not depth.

Re:'Protected Processes' and PC games

[admactanium]

> Just wait till they go to cashless floors and someone engineers a jackpot for themselves. That would be a neat trick to do with the end-user UI of a slot machine. Physical security is a pretty important first step.

unless i'm misunderstanding you, slot machines already work this way. you can play a slot machine with cash, or you can use a bar-coded receipt from other slot machines. i've sat down and played a few slot machines with no cash and, even after winning some money, stood up and walked away with my winnings without any additional cash. at some point i did have to put cash into the system (the first slot machine) but you can interact with slot machines, execute transactions (plays) and be paid all without cash.

Re:'Protected Processes' and PC games

[mpapet]

It's clearly not going to happen on the floor in front of a slot machine.

The backend running those games is on a network.

What are the chances they've got a gateway that goes to the interweb?

What are the chances they are relying on Windows for their security?

The people running the casino are pretty busy with their day-to-day stuff, not infosec.

Re:'Protected Processes' and PC games

[Anonymous Coward]

The basic mechanism it uses is that it hooks all the low level operations you can do on your system (file access, process access, etc.) and prevents you from touching anything related to the game. The end result is that you can't even so much as end-task a misbehaving game 'protected' by this driver.

This is not true, and it's also not what a rootkit is. These games use rootkits to hide files and drivers from the Windows API, which you can do yourself just by creating a share that starts with '$' or a registry key with a NULL in it. The game is not monitoring your every action, it is simply hiding itself from your interference (and potential reverse engineering).

It goes around and comes around though - the most commonly installed rootkit is Daemon Tools, which uses rootkits to hide from games. :-)

Re:'Protected Processes' and PC games

[Joe The Dragon]

I don't think that you will see chips go a way even more so in poker games.

Re:Hmmm... Upgrade to Ultimate Vista perhaps?

[anImortal]

Just like any database -- from any vendor. If you start running out of system resources, your transaction will likely roll-back.

Russinovich knows his stuff

[StarKruzr]

But I wonder how long it will be before "APK" aka "AlecStaar" comes out of his rathole to talk about how Mark is a witless academic who can't possibly know more than he does, since he's the author of ZDNet-approved APKTools 2007+++++++ 99.8.10101022 SR6.

Re:Russinovich knows his stuff

[Anonymous Coward]

I know that APK and Dr. Russinovich certainly know more about this field than yourself StarKruzr.

I know who both APK and Dr. Russinovich are. They both know their stuff. You on the other hand? Who are you and what exactly qualifies you to even begin to think you can mention either person's name in a manner that sounds like a put down? You're not anywhere near their level, or I would recognize your name. Obviously, you are just another * great critic *, but never had the courage to do anything of note yourself in this field obviously of worth. I don't mean putting up your kiddie script website you built in FrontPage either. I mean programs that do dangerous or potentially risky jobs and do it well that are not run inside a webbrowser.

I know of sysinternals.com and their work, and that's Dr. Russinovich, now of Microsoft (though he cowrote his wares with Bryce Cogswell, & often collaborates with Dave Solomon).

I know that APK has a program out now that's the only registry cleaner I know of that works guaranteed safely on every Windows 32-bit & 64-bit platform since Windows 95,98,ME,NT,2000,XP,Server 2003, and even VISTA (using it here now on that in fact). That program is his "APK Registry Cleaning Engine 2002++ SR-7" featured here:

http://www.techpowerup.com/downloads/389/foowhatev ermakesgooglehappy.html

What have you done of the likes of APK's program, or that of Dr. Russinovich, StarKruzr?

Probably nothing to show on your end, rignt StarKruzr? You're just another lazy, big talk but no action or accomplishments forums dweller. You haven't got a thing to contribute here have you StarKruzr, nothing of technical worth.

StarKruzr, it's the ne'er do-well speaking ill of others types like you online that make it a bad place. You obviously don't have a pot to piss in to contribute to this topic here, and certainly, nothing to put up to compare the work either APK or Dr. Russinovich have done in programs and articles online.

StarKruzr, You really ought not toss stones when you live in less than a glass house in this field by comparison to those you mentioned above in APK and Dr. Russinovich. Prove me wrong, show me wares in commercial, shareware, or freewares you have done that are as good as APK or Dr. Russinovich's are and have been for more than a decade out here in those realms, and I will eat those words. I am pretty fairly sure you can't.

I've seen that before...

[harry666t]

...Somewhere... ...Yeah, I know where!

So, they reinvented the wheel once again? It seems to be: every database more complex than a flat file processed by a pair of simple perl scripts has support for transactions like this. So they invented nothing, just applied an old patch to new code.

Re:I've seen that before...

[EvanED]

It seems to be: every database more complex than a flat file processed by a pair of simple perl scripts has support for transactions like this.

Yes, DBs do. But traditionally file systems don't. The only other system that provides this that I know of that isn't a full-fledged database is VMS.

Re:I've seen that before...

[textureglitch]

Yeah, they reinvented the wheel again, but they still haven't figured out how to make it round.

i will explain what he is saying...

[DeadDarwin]

when the NTFS files access the GHY it extends a random signal to the DFT which emulates the chip switch Architecture (CSA). Hard drives can be extruded and raised to the eye level, the apt facing the sun and look for errors at the kernel module. Then the stubs in the IIOP cloud extends its virginity toward the distributed computing components. thats how the Eifel tower was made. Hope I cleared your doubts.

Sysinternals Utilities

[NearlyHeadless]

I just noticed today that Russinovich's utilities are available in a single-file download: http://www.microsoft.com/technet/sysinternals/Util ities/SysinternalsSuite.mspx

Re:Sysinternals Utilities

[PetoskeyGuy]

I have a spider of sysinternals.com and all file downloads in a 24MB Zip file from the day it was announced Mark was hired by Microsoft. Not sure if anyone is interested in it. I don't have any where to host the files but I can try to email them to someone via Gmail if anyone can host it or wants a copy.

Re:Sysinternals Utilities

[user24]

you won't be able to gmail exe files, even inside a zip unless you rename the extension.

slap it on mytempdir.com or rapidshare.de and then anyone can grab it.

Re:Sysinternals Utilities

[Anonymous Coward]

Or do what I do: pass whatever archive file through bzip2.exe: gmail doesn't look inside that.

Re:Sysinternals Utilities

[Anonymous Coward]

Thanks. That's a fantastic heads up. Nigger.

Re:Sysinternals Utilities

[Reziac]

Well, I'd be interested, in case there's anything I missed in my own smash-and-grab from that fateful day. (Not very organized here, I'm afraid)

OT: sig

[Anonymous Coward]

Digg is what would happen to SlashDot if Fark invaded.

There's another theory that says that this has already happened...

Hmm

[mixxu]

I believe there is a bug in the tagging system. I see "security" next to "windows".

Mod Parent (Farther) Up

[jthill]

This is cross-facility transaction management: registry and filesystem updates combined into a single transaction. The example in TFA that an entire install can be atomic: multiple filesystems, registry, everything appears complete and as requested, all at once, or it never happened.

It's extensible, if TFA is to be believed at all, and the facility works. It's actually there and in use, rather than an it'll be there someday and won't it be wizzo promise, so I'm in "trust-but-verify" mode. It'll be interesting to see if it's actually extensible by coders excluded from the Blessed Realm.

Whether it belongs in the kernel or not is all but irrelevant: so what if it could be implemented as a userland service? Where they choose to put their code is up to them. They wanna play micro-kernel, Giga-kernel, or kernel-a-la-carte, that's up to them; the only question is whether the result is as reliable as they want us to believe.

If it is, it will make building absolutely-bulletproof applications a whole hell of a lot easier. I know something about that. Being able to say ~`if (!quickcheck()) die(fromhere());`~ without leaving a mess means, just for starters, that you don't have to concoct a file format for complex data; you can just use the filesystem, and that choice won't complicate your life. Big win. Big.

Re:Mod Parent (Farther) Up

[nanosquid]

The example in TFA that an entire install can be atomic: multiple filesystems, registry, everything appears complete and as requested, all at once, or it never happened.

UNIX has been able to do atomic installs/updates without a general purpose kernel transaction manager for decades; you simply don't need it for that. More importantly, a kernel transaction manager simply doesn't solve the problem because partial/inconsistent installs can exist for many other reasons besides interruptions; assuming that this case doesn't happen because you're using a transaction manager is a surefire way of making the system less robust.

Whether it belongs in the kernel or not is all but irrelevant: so what if it could be implemented as a userland service? Where they choose to put their code is up to them.

Well, it's "irrelevant" only if you don't care about things like performance, bug count, or reliability.

If it is, it will make building absolutely-bulletproof applications a whole hell of a lot easier. I know something about that. Being able to say ~`if (!quickcheck()) die(fromhere());`~ without leaving a mess means, just for starters, that you don't have to concoct a file format for complex data; you can just use the filesystem, and that choice won't complicate your life. Big win. Big.

If you write code like that, I hope you're actually just a CS undergraduate with an overactive imagination and people let you nowhere near writing applications that need to be "bullet-proof".

Re:Mod Parent (Farther) Up

[jthill]

So "UNIX" has a non-general-purpose or non-kernel transaction manager, and has for decades. Seeing as how UNIX has been implemented at just about every conceivable point on the spectrum from microkernel to OneBigBlob, we can take that as a general assertion that you can find some kind of transaction manager out there somewhere for some variant of UNIX. Good. So what? Now Vista's going to have one too. Good for them.

I'm already on record here as saying that VM boundaries aren't the only way to maintain module independence, isolation, abstraction, coherence, whatever the POV-du-decade is on good design. You've got it or you don't. <shrug> I still don't see how their choice of toolset, whatever it is, is relevant here.

And what, pray tell, does your recovery code for ~can't-happen~ errors do if it isn't to spill its guts and get out without adding to whatever mess it encountered? Are you saying you *don't* put cheap sanity checks at strategic locations? That you don't try to recover when they fail? That recovery should leave detritus? That you've never anticipated a situation that needs human intervention to fix? That I should have put detailed recovery-routine code in a /. post? That a pre-existing rollback facility *won't* greatly simplify bailout code? I'm having a really hard time making sense of that criticism.

Oh, well.

This is...

[Organic Brain Damage]

Windows Kernel. This is Windows Kernel on ACID. Any questions?

Re:This is...

[textureglitch]

That expression is just sooooo wrong. Have you ever been on acid? It's only wild and colorfull and amazing and explosive and out there for YOU, not for everyone else. You end up examining the pattern of your floor tiles for 8 hours straight and to you it's the most fascinating thing you've ever seen in your entire life, but to everyone else you become the most boring person in the world. ...come to think of it, your analogy was fairly accurate after all.

Yet another lock-in ?

[Anonymous Coward]

Ok, so M$ reinvented process checkpointing in essence, how sweet!
I don't know if it is new to offer the control of this mechanism to the process actually being checkpointed,
may be there is in fact some innovation here, and it seems more granular too so let's say it has in deed some value.

Yet i feel there is a trap: how should it work over network ?
Sure you can have yr OS revert an I/O to a file, but what about a tcp socket ?
Well, i, for one, am sure there will be some closed/patended protocol to propagate rollbacks over connected app.
Once agan we will end up locked in M$ only environement.

No, thanks!

Transactional File Support?

[endianx]

I really think that transactional file support is cool. I try and make sure any software I design works on multiple operating systems though. Now I know code that specifically uses DTS won't work on other operating systems. However, I write in .NET, which means the specifics of how a feature works doesn't matter. For example, I know Mono implements the FileSystemWatcher class using a completely different mechanism than Microsoft does.

Anyway, what I am asking is if anybody knows if the Linux Kernel and/or popular file systems have support for this. How about Mac?

Re:Transactional File Support?

[EvanED]

Anyway, what I am asking is if anybody knows if the Linux Kernel and/or popular file systems have support for this. How about Mac?

AFAICT, this is a feature unique to NTFS/Vista and maybe VMS. (The latter wouldn't surprise me; NT is a descendant of VMS designwise.)

Re:Transactional File Support?

[Assimilated Member]

This is unique to NTFS. It is also the only implementation of transactional file systems that can coordinate cleanly with a database. For VMS, you were thinking of RMS Journaling. HP still keeps the manuals on-line. As you can see, RMS/J with recovery unit journaling is "close". Combine RMS with DEC ACMS (a TP monitor) and DEC RDB (a relational DB) and you are very very close to what Transactional NTFS provides "but not quite there". Further, RMS/Journaling was said to be a dog -- and it was very expensive. When you start looking closely, you see many many differences between NTFS and any other attempt. For instance, it work works closely with the Volume Snapshot Service to provide transactionally consistent backups; transactional support for memory-mapped files; and enhancements to the mini-filter framework.

Microsoft rarely suggests you tinker with the reg?

[Anonymous Coward]

Hardly. Outside of problems addresed by hotfixes or service packs, tt's rare to find a solution to a problem on TechNet that doesn't involve manually tinkering with the registry.

Can we please drop file systems in favor or RDBMS?

[master_p]

Instead of putting more and more RDBMS features in file systems, why don't we drop file systems entirely and use RDBMS instead? RDBMS already provide all the required mechanisms for information management (transactions, security, duplication, distribution, strong typing, queries, caching etc), and the concepts of file/directory/hard-soft link are outdated and create more problems than what they solve, in the end.

So what is this thing?

[mosel-saar-ruwer]

The registry engine is implemented in kernel mode as an executive subsystem (inside ntoskrnl.exe), where it is known as the Configuration Manager. Registry hives use a transaction journal (like many filesystems do) to avoid corruption during a power failure or crash...

So you're saying that the engine which drives "the Configuration Manager" is neither Jet Red, nor Jet Blue, nor SQLServer Express?

So what is it? YAMIHDE [Yet Another Microsoft In-House Database Engine]?

Everything above is still the same in Vista as it was in NT 3.1.

I could have sworn that I read a few years ago that they were ditching the existing registry engine, and were going with a new engine for Longhorn/Vista.

So did that initiave prove to be YALFTEUOTCRF [Yet Another Longhorn Feature That Ended Up On The Cutting Room Floor]?

Re:So what is this thing?

[Foolhardy]

So what is it? YAMIHDE [Yet Another Microsoft In-House Database Engine]?

Yes, and a fairly old one. The NT registry format was created at the same time as NTFS. Here are some pages about it. There are at least two versions of the format-- the newest one was introduced in XP. XP also made loading registry hives more efficient, and allows much larger hives to be created and loaded.

The Jets, the registry, NTFS, FoxPro (which they bought), and SQL Server are all the Microsoft multi-purpose binary database engines that I can think of. Jet Blue, the registry and NTFS are the only ones that the OS uses for itself today.

I could have sworn that I read a few years ago that they were ditching the existing registry engine, and were going with a new engine for Longhorn/Vista.

There was something about Cairo being a directory, registry, filesystem, etc. (and everything else under the sun). This blogger remembers it too.

I know that some Microsoft teams have been using the registry less, e.g. IIS6 now uses a new XML database for config instead, but not all of MS's many developers are moving in the same direction. The registry is required very early in the boot process to determine which drivers are necessary to load to access the boot volume and filesystem. Unless that changes, there would be little reason to replace the entire registry as it is with something else.

Re: DEC DTM

[BBandCMKRNL]

The actual innovation is making a Kernel Transaction Manager, along with a resource manager for the filesystem. The KTM means that transactions can be inherited from parent process to child or joined by a cooperating process. Having a transactional filesystem means that all file operations can be all-or-nothing.

Yes. DEC DTM does this with the file system (RMS). I've been away from DEC and VMS for too long to remember if it handles the cooperating process part. Perhaps someone can refresh my memory.

A file system is still needed

[gr8dude]

How can that be possible? The DBMS itself sits on top of a file system; you can hide this detail from the user using a layer of abstraction, but the file system is still there.

YES!!!!

[StarKruzr]

HAHAHAHAHAHAHAHAHAHAHAHA

I knew you wouldn't be able to resist. It never ever fails. I'm convinced I could troll you on a Russian forum about opera and you would STILL find it and HAVE to say something.

Re:YES!!!! StarKruzr you are obviously some nut

[Anonymous Coward]

Is this StarKruzr somekind of obsessed psycho stalker or what. Look at that reaction. Obviously, he is insane, as well as somekind of demented loser who has not accomplished anything with his life in the area of computer science other than being a pest on forums. The most his obviously limited intellect allows for no doubt. Please answer the question above StarKruzr. What have you done better than APK or Mark Russinovich in the way of programming the last decade now as they have online for all to see and use? Answer = Nothing. Don't bother answer, we all know you are a useless miserable loser.

Sure, I'm a nut

[StarKruzr]

You managed to find ONE POST about you in ONE PLACE on the Internet. I put out the bait and you chomped onto it like a hungry piranha.

I think to be "stalking" someone you have to actively track them down, Alec. This was about as passive as it gets.

And the best part? I know that you will keep this up as long as I do because you can never, EVER give up having the last word. It's hilarious. You are the most reliable infinite-supply lulzcow on any of the internets.

I can't decide what I love more -- your bombastic language or the way you pretend to be a third party in every post you write about yourself.

Re:Sure, I'm a nut

[Anonymous Coward]

No, you're just a sick little a-hole basically. Still, answer that question... what have you done in this field that's any good, since you have put down myself, MySpace, & who knows what else today here?

You like taking shots @ your betters apparently... well, if you don't like that, then prove otherwise: Show folks here what you've done better than this:

http://www.techpowerup.com/downloads/389/foowhatev ermakesgooglehappy.html

By APK, & also better than MySpace, or Mr. Russinovich's work then. If you can, this is good, but something tells me all you are is a lot of talk - no actions/good deeds.

(So, instead of bitching, or complaining about others? Well, why don't you spend time doing something worthwhile, like learning more about this field & accomplishing something in it instead (and getting paid to boot))?

Somehow I get the feeling all we will see is more of you evasive b.s., especially when you get confronted about it, you cowardly b.s. artist. AND, if you don't LIKE that? You can come meet me face to face sometime, & we can discuss it THAT way (ala Good Will Hunting), ok??

Dorks like you, the 'internet iron-men' that think they can take pokes @ anyone & are invulnerable behind a keyboard wonder WHY women don't want them... look @ how you act!

This just keeps getting better.

[StarKruzr]

I simply adore your hierarchy of human beings that is based on what kind of and how much software they've developed. Wonderful.

Are you STILL clinging to the TPU forums? I suppose there are enough passive little sycophants there to jerk you off that you just can't resist hanging out there, can you?

Not that it matters, but I happen to be a graduate student in computer engineering, and expect two papers I've submitted to be published within the next two months. What do YOU know about low-power reconfigurable computing using nanotechnology, "Iron Man?"

Also, in point of fact (it's personal note time!), I actually just broke up with my girlfriend tonight. It just wasn't working out -- she's 4 hours away from me driving and in the end, despite how attracted we were to each other, we just didn't have that much in common. Sad, but it happens.

Nevertheless, I suspect that over the next couple of weeks I'll still get about 4X more tail than you do, since you must be a true social maladjust in person.

Re:This just keeps getting better.

[Anonymous Coward]

StarLOSER:

You just can't stand the fact that you tried to put me down, behind my back no less, as the backstabbing little runt coward you are, & then YOU got yourself caught in the act doing so!

(& now are trying to justify yourself when you were confronted with "Well, put me down? What have YOU personally done better??")

So, what HAVE you done better than say this:

http://www.techpowerup.com/downloads/389/foowhatev ermakesgooglehappy.html

OR, what Dr. Russinovich has done, or MySpace (which you also said sucks & their developers are lazy... hmmm, if ANYONE is lazy here, it is YOU!).

LOL, you're STILL a 'graduate student' w/ papers to submit, & you have the audacity to try to cut others down? You're NOT EVEN REAL yet... you're an academic. I know there's a BIG difference (mainly in that I know you PAY to learn, not learn on the job & get paid), because I've been to both places, & you still haven't.

End of discussion on that note. You're still just a BOY.

Plus, to coin a phrase?

Talking to you?? IS ACADEMIC...

Simply because you're not even a has-been - you're a 'never was'... & I strongly suspect a never WILL be w/ your back-stabbing deceitful ways.

As far as women: Boy, when you have been with as many as I have, then we can talk...

You'll be catching up (doubtful if ever, especially today in the disease riddled 'social strata' out there now w/ AIDS & Herpes + who-knows-what) sometime next century, IF ever. I doubt you will boy.

(One just left you it seems from what you say: Ever consider it is because you are a snide, deceitful, & cowardly wannabe only? CONSIDER IT!)

Re:This just keeps getting better.

[Anonymous Coward]

starkruzr, give up. He is light years ahead of you in this field. He is a known pro and pretty well respected. I've been online for a couple decades now and know this for a fact. I am also a TPU forums member and do not like what you said about us either. I mean, who are you? Some anonymous slashdot troublemaker who just got himself spanked badly. I know he has done work for very respected Microsoft partners like EEC SYSTEMS/SuperSpeed.com on paid contract to improve their supercache II product as well as having his work for it in 1996 iirc where it was reviewed by Mr. John Enck of Windows NT/2000/.NET/IT Pro magazine as well as having been a freeware-shareware of the year featured user several times over the years. He wrote up a few more but that is the one I can recall where he appeared in numerous publications, books, magazines, and on corporate websites that are respected in this field. Have you done at least that? Apparently not judging by your evasions of his question. Your woman left you, and I have to admit, it makes sense to me what he said in regard to that as well. You are a definite prick who likes to start trouble and put others down, but when confronted all you can do is say "I am a grad student" which means nothing in this field. You are just a student (supposedly) and nothing more, versus a seasoned pro who is well known and respected in this field. Pick your battles more wisely next time and try to be a man about it and do it to someone's face, not a woman. You lost this one badly.

C'mon, gimme facts please!

[Anonymous Coward]

Yada yada yada...

Can my IRCBot worm take over a million Vista desktop in less than 3 hours?

roofles

[StarKruzr]

You are so incredibly predictable, but now you're getting boring, using the same old tropes you always have -- responding to graduate education with "boy," claiming hundreds of conquests with your 3" dong, and pointing again and again to your silly Delphi software as evidence of your uebermanhood.

Can't you get some new material, you poor, twisted fool? Come on. Keep me entertained over here!

Re:roofles

[Anonymous Coward]

The same old tropes he apparently has on you that you can't answer. You're just a student, whereas he is definitely above your mere grad student status and he has a point on that too, you cant prove that either, whereas he is a known quantity and respected in this area. He got to you, this is obvious, but you had it coming. You are so stupid starkruzr it is not even funny. You were asked to show what you had done better than he did after you put the man down as well as the people at myspace. You have nothing to show for it, except your alleged grad student status, which is no big deal compared to years of professional standing in this field as he has. Yes, I know who he is, and he is a bit abrasive when confronted, but he never starts with others. He often does finish them though as he has you here. Your 3" dong reaction only proves that to myself and others. Man, it never ceases to amaze me how unintelligent you are starkruzr.

You can't write.

[StarKruzr]

Did you pass your grammar classes in elementary school, APK?

WHY do you keep pretending to be someone else?

And why DOES MySpace suck so much?

Re:You can't write.

[Anonymous Coward]

I didn't write that reply, lol! Bit 'paranoid' are we?

Until you do something of higher quality in terms of coding which we can all see & use such as this?

http://www.techpowerup.com/downloads/389/foowhatev ermakesgooglehappy.html

Well, anything you say is just "dust in the wind" b.s., but that is mostly what YOU are about which is being a bullshitter:

You are TONS of forums talk & critique of others, but no actual visible results &/or accomplishments we can see or use to test the quality of your skills or work come out of you do they?

"The great critic, never the cook though", eh? Any idiot can do THAT...

You're NOBODY (the price of your anonymity, you coward, is that you will never be more than you are now, languishing in anonymity. Safe, yes, but still a non-entity)...

You like to pick fights & cause trouble out online, and criticize everyone & everything, but having done nothing yourself.

I also see that IF anyone disgrees with you, you have to say:

"Oh it's YOU again APK" ... & this to me only makes me laff my tail off...

(& it is good to see others agree with me, vs. you! This you CANNOT stand, lol... it brings a dumb lazy nitpicking "wannabe expert", with no visible accomplishments to his name much less, lol, like you RIGHT down, doesn't it?)

ROTFLMAO!

Plus, you only tip your hand on how YOU personally operate by saying that - so, I have to agree with that last poster's statement: You ARE stupid.

APK

Re:You can't write.

[Anonymous Coward]

Did anybody pass grammar school? Interesting question! I have 1 for you on that note: He cant write? What exactly might I ask, is * roofles * (the title of one of your posts here) and a good percentage of your posts titles lately the past week or more, then?? Many of their titles appear to be unintelligible blatherings, lol, like many of your posts with their numerous put-downs and critiques of others work, which is especially amusing, considering you have not put out anything of note in this field yourself professionally, which I find absolutely foolish on your end. Practice what you preach on the spelling and grammar above all else here though. You seem to dispense all this advice and critique you yourself do not seem to practice or have anything to show your quality of work in either in this area of computers. Does anybody have to tell you what others think of windbags like that??? Having to resort to spelling and grammar checks here or anywhere online in forums is very lame, considering this is not our last will and testament, and if you cannot deduce the meaning of words by the context in which they are used, then, it is you with the problem mentally. Spelling and grammar checks are the resort of those on the ropes typically, when left with nothing else, but rotflmao, seeing you do the same and yet giving others a hard time over it is even worse. You are so simple to out think, using your own weak advice, it is pitiful. Above all else, you are so simple to goad and get a rise out of, it is amazing. Especially using your own methods and own words + philosophies you yourself spout, yet are unable to follow.

Dear Mr. Kowalski,

[StarKruzr]

Your "writing style" is inimical. You couldn't hide it behind a mountain range. It is obvious that no one has "agreed" with you except for your own AC sockpuppets.

I like picking fights with you because I know you cannot ever let anything go. I knew it would be utterly impossible for you to see something posted about you somewhere without your massive ego needing to reply to it with your usual string of self-important bombast. Do you actually presume that I have anything personally invested in calling you a narcissistic twit with an inflated sense of his own internet celebrity? You are a sad little flea, Alec, and worth my time only so long as I derive enjoyment from wasting yours.

Also, regarding my being a "critic" -- the funny thing is that NOT "any idiot" can do that. I don't even consider myself a "critic," but that's beyond the point -- to be a critic of anything, a serious critic, what is required is a broad comparative knowledge of the subject, not having created something in the subject themselves. It is not often, for example, that a film critic is an accomplished filmmaker. They are two different skillsets.

I also note that you're not commenting logged in. Why's that, pray tell?

Re:Dear Mr. Kowalski,

[Anonymous Coward]

http://it.slashdot.org/comments.pl?sid=227563&thre shold=1&commentsort=0&mode=thread&cid=18435701

I see you started up trouble there with this person, and he shot you down hard. You didn't have anything better than he did in the way of quality work out here online, or better than Dr. Mark Russinovich, or the folks at myspace you put down as well. You talk a good game, but, everyone knows you are just a student with no actual real world experience in the field of computer sciences. Give up on trying anyone there you child, and do something with yourself to look more credible. You claim to like starting up trouble with others no less, and you seem to be the one posting here trying to get the last word. It was never established this apk person who did this program:

http://www.techpowerup.com/downloads/389/foowhatev ermakesgooglehappy.html

ever even posted here to begin with. A bit paranoid are we starloser? Do you have a doctorate in English or professional forensic analysis as regards who is writing what here or anyplace, and for making psychiatric evaluations, do you have a PHD in that field or a related one?? No, as is usual for you, you do not. Why should I or anyone listen to you then??? I note you also toss many names while you froth at the mouth, haha, but the main point is, that you have no standing or rather less standing, than those you put down such as this apk bloke and myspace's website and development teams. I tried his program from that url by the way, it is nice and a keeper. Can you show me something you have coded that is better for this job???? No, again, you cannot. Another windbag critic wanna be online, in our very own starloser. Also, why should I register to post where little idiots like you start up trouble with others - so I can be just as trackable as yourself?? Sorry to disappoint you, but not everybody is as stupid as you apparently are, causing your own trouble and expecting no retaliation from others you give a hard time to. Spoiled little boy that you are.

"Everyone knows"

[StarKruzr]

Right. Everyone on Slashdot. Because everyone on Slashdot is reading this thread, right? Everyone is very, very concerned with the fact that poor APK is getting trolled.

You don't have a single original thought in your head, APK. It's really quite amazing. It's like your brain is a finite state machine, going from "show me what you've done" to "you're just a student" to "you don't have a degree in psychology" and back to "show me what you've done" again.

You live such a sad little life. And I am so, so enjoying wasting your time.

Re:"Everyone knows"

[Anonymous Coward]

I do not think that trolling others, which looks more like being a nuisance to others on your part starkruzr, is very cool. It seems like you are trying to be a jerk starkruzr. How original does he have to be starkruzr when you put his works down and when he asks if you have done any better things and to show him you have and you cannot? It does the job and quite well to illustrate you talk a lot but have no production on your part.

Re:"Everyone knows"

[Anonymous Coward]

I just looked over this loser's post history here. I know why he is down on apk. He lost badly to him on these forums for starting up with him before right here:

http://slashdot.org/comments.pl?sid=161862&thresho ld=1&commentsort=0&mode=thread&cid=13532123

Where apk was modded up +4, and starloser did the impossible and got a -2 score, lol! StarLoser even said a "-2" was impossible to get, but somehow he did.

ROTFLMAO - he has accomplished something impossible to do online apparently: That is to get a -2 moderation score, lol.

It is funny, he is trying to tell a person that's done good things online for more than a decade how to spend his time, and that starloser likes to try to waste apk's time (if it was apk to begin with, could be starkruzr for all we know)!

The absurdest part is starloser the idiot can't see he/she (whatever starloser is, now he says he is a woman, but yet said he lost a girlfriend recently? Lesbian mental abberation/genetic error??) wastes his/her own time in this life 'trolling' (harassing) his/her betters. Some people are a waste of life, starloser is one such example.

Figures you'd be a conservative bonehead, too

[StarKruzr]

Now lesbians are "mental aberrations and genetic errors?" Intolerance AND stupidity in one package! Man, what a bargain you are.

Re:Figures you'd be a conservative bonehead, too

[Anonymous Coward]

They are: Are they normal? Are they having sex with men & being with men as they are designed to be?? NO. They are definitely aberrations. I dated one, many 'swing both ways', in fact, but they are WAY off, no questions asked.

Above all? LOL, You're not a woman, you lying fool, & you said you were (evidence below). Caught in the act. Typical, dishounourable scum from arstechnica is what you are.

E.G. #1: StarKruzr said he was a woman here:

http://slashdot.org/comments.pl?sid=227475&cid=184 94155

StarKruzr is not a woman though (but sure is a liar, another Jeremy Reimer/Jay Little style liar, lol, & like they, got his ass beat in thru his own dishonesties) and is from Staten Island NY, and this is him:

http://gallery.r3v3ng.net/albums/BoardyPhotos/jare tt_katey_maria.jpg

ROTFLMAO, but surely he isn't much of a man either. Look at that flabby little dweeb!

(No wonder he is pissed @ apk. Anybody that looks like this little flimsy freak will never get laid, not by pretty women @ least. Look @ those hounds he is with, lol!)

Yes, yet another arstechnica liar, lol, another arstechnica weasel liar caught in the act again, ROTFLMAO! Why? Too stupid. Most arstechnicans are.

Thanks again for this evidence of that, how scumbag'ish arstechnica people are.

E.G. #2: Jeremy Reimer (your "hero" who has no degree in comp. sci., not even an A+ lol, let alone an MCSE & no professional experience in this field either, & yet you think he is an expert? LOL! You ARE a fool, aren't you!) lied about impersonating apk on his crappy OSY forums! He admitted it after being caught, lol. This is your hero? Figures: Scum gravitates to scum.

Jeremy Reimer, like a child & not a 36 yr. old man, just ended up doing even MORE childish things like writing a libellous tune about apk, dumb move, grounds for lawsuit, and also edited photos about him, but as far as technical knowledge?

See the url from Windows IT Pro mag below.

E.G. #3: Jay Little his pal the great technical expert (not) got blown away by APK as well, on what he said he was an 'expert' in no less, in Exchange Server. What a pair of dumbos. The evidence is in the Windows IT Pro url below in fact. lol...

http://www.windowsitpro.com/articles/index.cfm?art icleid=41095&cpage=190#feedbackAnchor

Arstechnica: HOUSE OF LOSERS & LIARS ONLINE, rotflmao! Arstechnica, always losing to apk, everytime. It gets their goats badly, lol, but if they had any sense? They would stop already, but you see "StarLOSER" there, another arstechnica worm, at it again, and thanks (emailing this apk's way now in fact, lol).

Plus, EVERYONE @ slashdot will know now too, every time you post fool.

Get used to it. You brought this one on yourself, and like I said I would? I will finish it and you, arstechnica loser.

(I am going to run your outta slashdot town, by letting you do it yourself, via your lies & in every post you do from now on here, promise, by posting this again & again in each of your posts so others can see just WHO you REALLY are, a weak pathetic liar.)

StarLOSER also looks a lot younger than grad school age, which he claims to be in, more b.s. on his part, just like his lies he is caught in now above.

LOL, this alleged "grad school status" he has been saying here on slashdot for years now (longer than grad school is lol no less) is yet another lie on his part, just as he said he was a woman earlier in the url's above.

StarLOSER (lol, good name for him) is doomed to a life of lies. So much for his credibility right? One lie, after another. Yet another he is caught in is this saying he is a woman.

What a loser

You've officially crossed the Rubicon, chuckles

[StarKruzr]

Your ranting actually caused Slashdot to cut the post to a "Read more..." link.

Re:You've officially crossed the Rubicon, chuckles

[Anonymous Coward]

LMAO, starkruzr said he's a woman here

http://slashdot.org/comments.pl?sid=227475&cid=184 94155

and later here is proof starkruzr is not a woman here

http://gallery.r3v3ng.net/albums/BoardyPhotos/jare tt_katey_maria.jpg

What a liar. I bet if Dr. Russinovich reads this one he is laughing at this * personal identity crisis * starkruzr's having, lmao.

The arstechnica loser StarLOSER exposed as a liar

[Anonymous Coward]

Good! I am GLAD you said that, as it will make people here on this forums want to read this, all the more. And, facts are not rants, & all of this IS fact.

Do you think you have any credibility here on this forums now? LOL! That's a laugh if you think they will listen to you 1 bit. I will make sure the people here don't, or rather, do & throw this in your face every day of your LIFE here. If not, I will. Promise.

After all, you've just proven yourself to be another worthless arstechnica liar, and it is SEVERELY doubtful you are the 'mighty grad student in this field' you claim to be.

You provided so much ammo, along with your loser charlatan FAKE 'computer expert' and fellow arstechnican Jeremy Reimer (who needed help from his buddy Fat ass Jay Little, and lost ontop of it to apk, lol), no wonder it is that long. I am sure APK has more, but this will do!

Proof of your TRUE self and my statements?

E.G. #1: StarKruzr said he was a woman here:

http://slashdot.org/comments.pl?sid=227475&cid=184 94155

StarKruzr is not a woman though (but sure is a liar, another Jeremy Reimer/Jay Little style liar, lol, & like they, got his ass beat in thru his own dishonesties) and is from Staten Island NY, and this is him:

http://gallery.r3v3ng.net/albums/BoardyPhotos/jare tt_katey_maria.jpg

ROTFLMAO, but surely he isn't much of a man either. Look at that flabby little dweeb!

(No wonder he is pissed @ apk. Anybody that looks like this little flimsy freak will never get laid, not by pretty women @ least. Look @ those hounds he is with, lol!)

Yes, yet another arstechnica liar, lol, another arstechnica weasel liar caught in the act again, ROTFLMAO! Why? Too stupid. Most arstechnicans are.

Thanks again for this evidence of that, how scumbag'ish arstechnica people are.

E.G. #2: Jeremy Reimer (your "hero" who has no degree in comp. sci., not even an A+ lol, let alone an MCSE & no professional experience in this field either, & yet you think he is an expert? LOL! You ARE a fool, aren't you!)

At BEST, he makes $100 per 'article', & I earn that in 1 hour, each day! Then again, I actuall possess degrees and decades of experience in this field, like APK has as well, unlike the MORONS from arstechnica you 'worship', lol.

YOU CANNOT BE A GRAD STUDENT in this field, no way, if you believe JEREMY REIMER is a computer expert. lol... far from it.

Arstechnica are ambulance chasers that spit back what they read from others is all, derivative DRIVEL, everytime, & just recently here on slashdot no less they reposted what was on ExtremeTech a year ago regarding IBM using channels on their cpu's to cool them, no less as evidence of THAT? See here -> http://hardware.slashdot.org/comments.pl?sid=22819 7&cid=18490479 )

Reimer lied about impersonating apk on his crappy OSY forums! He admitted it after being caught, lol. This is your hero? Figures: Scum gravitates to scum.

Jeremy Reimer, like a child & not a 36 yr. old man, just ended up doing even MORE childish things like writing a libellous tune about apk, dumb move, grounds for lawsuit, and also edited photos about him, but as far as technical knowledge?

See the url from Windows IT Pro mag below.

E.G. #3: Jay Little his pal the great technical expert (not) got blown away by APK as well, on what he said he was an 'expert' in no less, in Exchange Server. What a pair of dumbos. The evidence is in the Windows IT Pro url below in fact. lol...

http://www.windowsitpro.com/articles/index.cfm?art icleid=41095&cpage=190#feedback

Yet another lie by StarKruzr: Doctoral Student?

[Anonymous Coward]

http://slashdot.org/comments.pl?sid=161862&thresho ld=1&commentsort=0&mode=thread&cid=13532123

Now, I have another question that disputes the validity of your claim here in this & your other recent threads per that URL above.

There, did you not (in your series of replies) state you were a 'doctoral student'? I thought it was graduate school student, per your latest replies in THIS thread series??

More b.s. outta StarLOSER: The arstechnica liar pinned down by his own patented lying deceitful style, gained doubtlessly by seeing how his cohorts @ arstechnica TRULY operate.

It's your loss, your reputation, and you are running yourself out of this forums through your own dishonesty and harassing others, much to your own detriment.

Thank you for the additional information, and I'd like to see your answer to this latest point. Are you a doctoral student as you said in the URL series above, or a graduate school student as you are saying lately?

Somehow, I doubt you are either @ this point. You said you were a woman, now not. Case in point, you cannot be believed, or trusted. You ARE truly, arstechnica forums board material. Just like Jay Little & Jeremy Reimer (your no degree in comp. sci., no certifications even, or professional experience hands-on in the trenches in this field hero), who were kicked from their ISP/BSP/Hosting providers and chastised for email harassing others as well.

See where your hero's examples have taken you BOY? Down a road I would wager you wish you NEVER trod attacking apk, because like your buddies up there in Reimer and Little?? It has shown you are just like they - liars & nobodies, who got caught in the act.

Re:Yet another lie by StarKruzr: Doctoral Student?

[Anonymous Coward]

This was the funny one here starkruzr said he's a woman in 1 post

http://slashdot.org/comments.pl?sid=227475&cid=184 94155 [slashdot.org]

and I saw the post showing that starkruzr is not a woman here

http://gallery.r3v3ng.net/albums/BoardyPhotos/jare tt_katey_maria.jpg [r3v3ng.net]

hahaha. This starkruzr idiot's unbelievable. He'll try anything to get out of his crap at this point. Does not matter to me though. He is a liar point-blank.

Oh, now you're Russinovich's BUDDY?

[StarKruzr]

That's rich.

Remember, APK -- all you have to do is stop replying to my posts and this is over. I won't hunt you down and stalk you the way you did to me.

Re:Oh, now you're Russinovich's BUDDY?

[Anonymous Coward]

You've constantly stalked and trolled apk here and elsewhere online along with your freaky arstechnica pals, lol, much to your own detriment though. You arstechnica losers always get yourselves beaten by apk.

The IP Address is: 76.208.2.84. The host name is:
adsl-76-208-2-84.dsl.sbndin.sbcglobal.net

"Also, I never said I was from Staten Island. You did. I never said I was the girl in that picture either, you did." - by StarKruzr (74642) on Thursday March 29, @06:16PM (#18536049)

I never said you were a girl, YOU did, lol! Here is the posting where you did:

http://slashdot.org/comments.pl?sid=227475&cid=184 94155

You are a guy, or look like one, sorry to tell you, lol... NOT A WOMAN, even though you said you were, lol! You surely act like one, rotflmao.

More typical arstechnica forums members online lies, now from this nut StarKruzr (from Jeremy Reimer's disciple, lol, he gets caught in lies like Jeremy Reimer: The ULTIMATE liar, pretending to be some computer expert, yet has no degrees in computer science, nor even A+ or MSCE certs, or years if not decades of professional experience in this field in the trenches), that starts up crap with everyone?

StarKruzr is not a woman though (but sure is a liar, another Jeremy Reimer/Jay Little (arstechnica morons who operate the same way and get caught everytime) style liar, lol, & like they, got his ass beat in thru his own dishonesties) and starLOSER is from Staten Island NY, and that is him in the photo below and his name's jarett.

You are such a liar, you just will not stop will you? StarKruzr from Staten Island?? You said it on other forums.

StarKruzr
Geek Apprentice
On your being starkruzr and from Staten Island?
Posts: 49
From: Staten Island, NY, USA, Earth, Sol System
Registered: Jul 2000

That's from this site -> http://www.geekculture.com/ultimatebb/Forum11/HTML /000009.html

You're from staten island and being named Jarrett, we already know this is your photo at this point in the url below, and if you note it's name? You see Jarett in that photo name. Again: You are a guy, or look like one, sorry to tell you, lol... NOT A WOMAN, even though you said you were, lol! You surely act like one, rotflmao.

http://gallery.r3v3ng.net/albums/BoardyPhotos/jare tt_katey_maria.jpg

Though it may come as a shock to you, considering your pud's probably too tiny to see, lol, you probably THINK you are a woman, lol! But, you are a guy, or a liar... lol!

AND THIS THREAD HERE SHOWS YOU ARE MATCHING AN EMAIL TO YOUR NAME starkruzr, to jarett

http://www.opacity.us/search.php?q=starkruzr%40sta rkruzr.com&submit=search&where=comments&u=1#result s

Posted by: Jarett
Hi guys, Anyone know what her name is? starkruzr@starkruzr.com

Man, You're a TOTAL liar starLOSER, who's been caught, and the arstechnica member trend and typical pattern continues, lol, BUSTED as a liar.

Are you proud of this?

Because if so, do not consider politics as a career. ROTFLMAO!

If you do, I am talking to the next Richard Nixon, and lol, certainly NOT George Washington ("I cannot tell a lie") lol... except you are chopping down your credibility faster than George Washington could whack down his cherry tree, & your own lies are the axe, lol!

Man, you are TOO easy to see through & far too easy to prove you are a liar.

What a waste of time, I am dealing with a total liar! Another dishonorable arstechnica coward, oh well, typical of them!

"I think it's HILARIOUS to harass YOU online. Just you. O

Russinovich's BUDDY? U.R.A.liar AND dyslexic I see

[Anonymous Coward]

APK and Russinovich both have done decent work, both can show things in this field they have done over time, unlike you when I asked you for them, and you avoid this at all costs, though you cut others down like apk, myspace, and most likely even Dr. Russinovich, lol, knowing you.

I am sure even if apk and M.R. do not get along at times, they can respect one another for that much and can accept the fact each can do the job.

I know that apk helped Mark Russinovich fix an error in his work in fact in pagedefrag.exe, a tool of his, for instance, but the reverse cannot be said which imo, is in apk's favor, and M.R. thanked him for it in email, and he won't deny it. Even though he and apk had done some head butting 6-8 years before that!

It's called professional courtesy.

apk has helped quite a few coders like Jay Loden of AIMFix, & even Mozilla's FireFox Teams a few years back tracking down and isolating bugs @ NTCompatible.com and had their team show up there, and did the same with Belarc Advisor's coders at techpowerup.com (this I saw myself).

Oddly, he even helped Arstechnica's late (oddly, but the man he helped out never bothered him) Roelof J. Englebrecht (god rest his soul) to use Low & High cpu priorities code on his SetiSpy program, but the guy died before implementing it, and also oddly even the fellow that wrote CoolMon (an arstechnica mobo monitor extension iirc), yet another arstechnican apk oddly helped by helping him fix bugs he had in his work regarding lacking error traps, and how to tell if drivers have their performance counters cut off (a performance enhancement if you are not monitoring them, why generate them, using extctrlst.exe) since he was abending on that, & lol, could not figure out HOW to fix it when his program broke down when those are turned off for performance purposes!

and many more over time in helping other coders.

That small and only partial listing alone is more than you can say in this field that is verifiable for just helping other coders online. Russinovich has done the same I have seen it.

apk like M.R., has done work for wares that took his ideas on ramdisks to a finalist with EEC Systems/SuperSpeed.com in the HARDEST category there was, SQLServer performance enhancement, as well as doing work to boost their SuperCache II product to up to 40% better than its stock performance on a paid contract in commercial wares & was reviewed VERY favorably in 1997 Oct. issue for SuperCache and SuperDisk by Mr. John Enck, a fellow technical editor and writer for the same magazine that features M.R. in it, Windows NT/2000/.NET/IT Pro magazine.

APK has more, but I can't even recall them all, lol, too many. Those just stood out.

So, can you even begin to say the same? Until you can, don't cut someone down that's worlds above you in this field. You don't have the status, know how, or understanding.

As far as stalking people? You people from arstechnica are way, WAY guilty of that, & that can be seen and verified here, windowsitpro mag forums, 3dfiles (now majorgeeks), ntcompatible.com, techpowerup.com, and more. Don't you think you can pull the wool over anyone's eyes on that account. Dr. Russinovich of all people has seen that happen in fact, to name one of a notable few.

Also, each time you arstech fools start trouble with apk? apk has finished each one of you that has lol, so badly?? It's hilarious: Ask Jeremy Reimer about losing his hosting provider, being caught email harassing apk, and his pal Jay Little having the same happen. Funniest part is, they tried it on apk and it backfired on them instead, lol! And, like you? Neither Jay Little nor Jeremy Reimer had any decent accomplishments of the likes of apk or dr. russinovich have.

Also, I guess your thinking I am apk is guilt perhaps? It seems now that everyone you are talking to is turning to apk it seems (yes, the 'voices in your head tell you it is so' lol), if they disagree with you at all.

LOL!

I am going to start call