Interesting then that I, with XP Pro SP2 and hotfixes have never seen such a beast. Perhaps you're running some third party app that does this or some screwed version?
The core thing here is that there is no way to tag an executable in Windows. You're blowing smoke. See below for more on MS's digital signing strategy. This is the default behavior of XP since (I believe) sp2.
All executables (maybe all files? not sure) that come in from outside the local machine get flagged as dangerous. The first time you try to run them you get an extra popup box that says as much.
The funny thing is that, if you're NOT seeing it, then its likely either you've been doing some amateur surgery on your box, or you've been pwned, and that was disabled by the malware.
my problem with UAC is that it is trying to cover a non-permissioned based filesystem (fat32 or NTFS, same deal). Not sure what you mean by this... how is NTFS non-permissioned?
The reason your software (games or whatever) have permission to write to C:\Program Files? Because that is what the filesystem allows. But it doesnt, it only allows system administrators to write to those directories. The filesystem doesnt allow it for regular users.
I guess I'm confused. You seem reasonably clueful but these comments dont make any sense to me.
Just as an example, many applications that support plugins store the plugins under their own directories in Program Files so that they are accessible to all users, not just the user installing the plugin. It may or may not be the 100% approved Microsoft Certified Correct Way Of Doing Things, but the fact remains that many, many Windows apps do this or other similar operations and all such apps are broken by Vista and require patches to fix. You say that its not 'the 100% approved Microsoft Certified Correct Way of Doing Things', as if that was an unreasonable expectation. MS says, in many places, that this is bad.
Heck, thats what docs & settings\all users\app data\company\product\plugins is for. This is well known in the industry if you're an ISV.
The folks that did this knew that what they were doing was a violation of the protocol, so why do it? Or why gripe when you did something you knew you werent supposed to do, and it caused you problems?
Thats the equivalent of using an undocumented/unsupported API, and then bitching when it gets changed. Or not following the documented behavior of an interface, and relying on the typical behavior of one version.
Yes, there are some challenges with Vista and installers/isv-stuff. But its been there available for us to test since like June 2006 when the RC's started rolling. Why is this a problem now?
Open Source software generally comes along with the interface document, the code itself. The 'code itself' isnt an interface document, or even interface documentation. It's an implementation.
It may or may not include any documentation on the interface. Heck, it may not even have interfaces, and may just be a big pile of monolithic, tightly-coupled crapola with little-to-no documentation.
And its arguable that if you do your interfaces right, you shouldnt need to or even want to see the impl, as that may encourage you to depend on behavior that's not documented in the interface (and therefore may change).
Are you sure NetApp didnt just buy the spec from MS years ago? It's not like MS wasnt selling, it was just at an 'ask-me' price (ie, high), and probably lots of non-compete/nda terms.
The old exchange protocol which was nearly impossible to emulate is on its way out for a number of reasons. All newer Microsoft clients are aiming to switch from this original RPC driven protocol to WebDAV through OWA. Where do you get this information?
Outlook 2007 still does MAPI over RPC. Thats as new as they get.
Right now my Cable Modem delivers speed up to 10Mbs for $10 more a month I can get 15Mbs. But it really doesnt.
Your download speed is going to be more like 5-8, with 'burstable' up to 15mbps. If you're lucky. And I wouldnt be surprised if the burstable stuff is just things comcast can stream from its cache.
And thats the downstream speed.
Your upload is going to be 1mbps if you're lucky. You probably arent. You'll probably be in the 500-800kbps range for uploads.
And what is your latency? What's the round trip time between you and Adobe's servers? What is the packet loss rate?
For online apps to work well, you need more than just occasional fast streaming downloads. You need low latency, low packetloss, and reasonable upload.
Anyway, I'm not saying online apps wont work... I'm saying that the numbers you get from the marketing dept of the cable company probably isnt within a factor of 4 of the truth.
And dont count on dslreports speedtesting and such, as its entirely possible and likely that they optimize for that traffic, to make their systems look better.
Yes you can. Though in all honesty, you probably dont want to pay for premium on the precision.
What you can't get is an Inspiron or a Vostro. And Dell doesnt make a 17" in the Latitude.
Of course, this is mostly due to the fact that Dell doesnt have a business class laptop in 17". They have consumer level garbage (inspiron, vostro) in a 17", and an engineering workstation (precision), but no latitude in a 17".
The deal with Dell and XP is that you can get XP or Vista on all their business class machines. And despite their marketing, that doesnt include the Vostro's.
Some of the things you mention are configurable (auto-delete of accepted meetings), some things are present in the current version (instant search of entire mail store, auto-hyperlinking of http references, though spaces will break).
Some of these irritate me too, but only very mildly (names instead of emails, embedded images in html mails).
TFA (where A = Author) is an idiot, and didnt bother to read the KB article which he linked to on his post.
From the KB article describing the problem, ie TRFA (where R = Real):
http://support.microsoft.com/kb/942435/en-us
This problem occurs because of a memory leak in the Windows OLE component. This memory leak is triggered by the way that Windows Explorer deals with the extended attributes of the files. This is 100% in the shell and UI layers, not in the kernel.
For this kind of stuff, where its important that the copy goes right, or complains, then use another more appropriate tool, like XCOPY or (even better) ROBOCOPY.
Both of these are freely available tools made by MS for windows, and will give you much more reliability in what you're doing.
Yup. I've just about given up trying to copy gigabytes of files from large drives to backup drives because of this. I mean, once you've done this ONE TIME, it should be OBVIOUS to ANY designer that it needs to be fixed to allow the copy to continue - or resume - or SOMETHING other than just DYING.
Also, if Windows sees a zero-byte file, it can't handle it. I have to boot Linux and use it to delete the file. The strange thing is, both of these are idiosyncracies of the explorer.exe shell. Both of these things work fine from the command line from within windows, and if you want lots of move/copy options, you use xcopy.
Which is sad, because clearly its not required for the OS to have these problems, but they exhibit these problems in the GUI shell, where the vast vast majority of people will encounter them.
Guess it depends what you mean by 'Automatic Updates Disabled'.
From the article you linked:
[UPDATED - Just to clarify, I can confirm that this stealth update was applied to systems where Windows Update was set to Download updates but let me choose whether to install them and for updates but let me choose whether to download and install them but not on systems set to Never check for updates.] I generally mean, and thought most did, that when a person says that AU is disabled, it means either: 1. Service is disabled, or 2. Set to 'Never check for udpates'.
If you mean 'AU disabled' to include the 'Notify but dont download' setting, then you're correct.
For desktops/laptops its not cost effective, and even volume licensing usually requires you to buy the machine with a windows OS on it for your VL licenses to work.
So basically buying a naked PC is more expensive if you're going to install Windows then, it's only cheaper if you're installing one of the unices, BSD or Linux. Not sure what you mean here, but I dont think thats an accurate re-statement of what I said. Basically, what I meant is that all the MS VL programs I've seen requires you to buy your PCs (ie, desktops & laptops, but not servers) with a windows OS for your OS licenses in the VL program to work. So in effect, all the desktop OS licenses in the VL programs are 'upgrade' licenses.
It sounds worse (cost-wise) than it is, as you're usually paying a per-head or per-machine licensing, not directly for the OS again.
I don't know about NewEgg, are you talking about buying PCs or licenses from them? Can you order custom PCs from them? If so, I wonder if it's cheaper to have NewEgg build you one or if you can build your own cheaper. Right now it doesn't matter to me much, a bit over a year ago I bought a PC with Linux preinstalled, which I plan on setting up as a server. And I'm typing this on a Macbook Pro I got 2 months ago. So I should be set for two or three years. Heck unless things change dramatically I expect them to last twice as long. I meant windows licenses, not PCs. You can definitely build a PC for yourself from parts from NewEgg cheaper than most manufacturers. But its not worth the time/trouble to everybody (for me for example... used to be fun, not any longer).
I hardly ever do, and they tend to not be the best ones. But I just dont see that many. The good admins are usually too lazy to go get a cert, to be honest.:)
Also, I should say that I come from a programmers background, so dont mind the MS stuff. And I actually appreciate the philosophy behind it (abstraction, etc), but I do also agree that its more complicated.
Of course, thinking about it now... the fact that it is more complicated and more programmer focused on windows is probably bad... as the average windows admin isnt that great of an admin, much less a competent programmer.
Mostly due to the fact that Dell servers were not that good at the time. Nothing really to do with being good enough, its a fundamentally different type of system. Dell pretty much only sells x86 stuff.
Dell doesnt offer anything thats in the same class of equipment as the Himalayas (also known as the Tandom NonStop). Those things have massive, massive internal redundancies and (IIRC) a mini-os to manage the hardware. It's very specialized hardware and operating systems.
So think of it as basically buying a mainframe. It's not anything to be ashamed of, because Dell doesnt sell mainframes (or products like the himalayas).
For desktops/laptops its not cost effective, and even volume licensing usually requires you to buy the machine with a windows OS on it for your VL licenses to work.
For servers though its pretty common. As someone else noted, Dell's price for Windows server products is not that good. You can do better with NewEgg or your own volume licensing program.
You also then end up with a copy of the OS not tied to the hardware (unless you're sticking OEM server stuff on it).
If you have an uptime any greater than 30 days on a Windows server, it's probably because the box hasn't been patched, or because it's been patched but not rebooted (which is fundamentally the same thing). In either case, the OS is in a less than optimal state, either due to outstanding bugs or vulnerabilities, or both. So while it's technically possible to have a high uptime on Windows, it's not best practice by a mile. On a UNIX system like Linux, the updates are performed live with no reboot necessary. The clients already connected to a running service which is updated out from under them don't even realize the server's been updated, everything just works. A couple comments.
Yes, the way windows does 'in-use' files is annoying, and this is the root cause for the reboot need.
But what most people are talking about with uptime is avoiding unplanned downtime. 60-120 seconds of planned downtime once a month is very reasonable and manageable for most shops. Where its not, you load-balance.
Note as well that that both Linux and Windows require reboots for the same things: updates to kernel. Unfortunately, more things in Windows are in there than probably should be.
All that being said, its not too uncommon to have an MS super tuesday go by with servers not needing to reboot. Tons of things can get patched without rebooting: sql server, IIS, exchange, IE, office, many explorer components if they're not being used. AD stuff usually requires a reboot, and so does core explorer elements.
In addition, dont abstract too far over the way unix systems handle this. If you have apache running with a nasty vuln, and you patch it, but dont restart apache, all old existing connections are still using the vulnerable binaries. I realize that you dont tend to have long-running connections to apache, just using it as an example. In both windows and unix case, you just patch apache/iis, then restart apache/iis.
And come now, Windows has a registry. It's a spaghetti tangle of cryptic and archaic settings, many of which are purposefully obfuscated, and is prone to corruption. UNIX systems use flat config files, usually in plain old English. The registry is largely a non-issue nowadays. It's not like unix, where you use 'white box' access, and directly modify the config files. On windows, there is an abstraction layer, and its much more of a 'black box' interaction. You use the programmatic interface to tell the service what to change, it handles storage issues for you, and you dont need to know. There are a lot of benefits to doing it this way, and in the programming world, thats the superior approach.
Would probably take 1-2 hours the first time for me to do that. Much less after that.
Mind you, some of the interfaces arent as clean to the Unix'y eye as the iptables solution. MS automation tends to be more oriented towards a programmer or an SA with strong programming skills. Unix automation tends to be more oriented towards an SA with minor coding skills but an interest to poke around. Lower barrier of entry on the unix side, cause things tend to be a little simpler.
(assuming I'm understanding from the quick link what the 'self-updating firewall rules' are doing)
It's not that Linux is actually the measuring stick.
It's just that you are always having to beat some sense and reality into the heads of the linux zealots. So it's always in response to that.
The real measuring stick would probably be VMS or the mainframe.
Every large organization I've seen, there are huge numbers of linux boxes getting owned constantly. Mostly due to poor management. Strange how thats the same with windows.
In both cases, weak passwords will own both.
In both cases, zero-day exploits plus open holes in the firewall will own both.
In both cases, userland software vulns plus an elevation exploit will own both.
We get more bang for our buck with a *nix admin than we do with an MS Windows admin. From what I have seen in the past 10 years, a very good *nix admin can handle almost twice as many servers as a good MS Windows admin. I am not dissing MS Windows admins, it is just that MS Windows really lacks the tools of automation that have been a part of *nix for decades. Are you comparing apples to apples here?
Are the windows admins as good on that platform as the Unix guys are on their platform?
Do the windows guys do scripting and automation for all their group management tasks? Because despite the popular belief, windows has a huge amount of automation tools available, its just a different approach than unix. But there isnt really anything that cant be done from the command line and the scripting environment on windows.
For some reason though, most windows admins choose not to use them. I dont know why.
What I can agree with is the general tradition is very different. Only amongst the very best windows admins will you see that they manage huge numbers of machines, all using perl/com/adsi/wmi or vbscript/com/adsi/wmi (and plus powershell up and coming).
You can tell instantly as well when you watch them work.
Do they prefer to go into the machine room and work at the console? Do they prefer to use term-serv and work at the virtual console?
Or do they use a big combo custom MMC console for single-machine admin, and a huge library of scripts to manage whole sets of machines?
The best windows admins are the smartest/laziest, and they can manage whole hordes of windows machines from their couch or office chair.
Slashdot Mirror
The core thing here is that there is no way to tag an executable in Windows. You're blowing smoke. See below for more on MS's digital signing strategy. This is the default behavior of XP since (I believe) sp2.
All executables (maybe all files? not sure) that come in from outside the local machine get flagged as dangerous. The first time you try to run them you get an extra popup box that says as much.
The funny thing is that, if you're NOT seeing it, then its likely either you've been doing some amateur surgery on your box, or you've been pwned, and that was disabled by the malware.
I guess I'm confused. You seem reasonably clueful but these comments dont make any sense to me.
Heck, thats what docs & settings\all users\app data\company\product\plugins is for. This is well known in the industry if you're an ISV.
The folks that did this knew that what they were doing was a violation of the protocol, so why do it? Or why gripe when you did something you knew you werent supposed to do, and it caused you problems?
Thats the equivalent of using an undocumented/unsupported API, and then bitching when it gets changed. Or not following the documented behavior of an interface, and relying on the typical behavior of one version.
Yes, there are some challenges with Vista and installers/isv-stuff. But its been there available for us to test since like June 2006 when the RC's started rolling. Why is this a problem now?
It may or may not include any documentation on the interface. Heck, it may not even have interfaces, and may just be a big pile of monolithic, tightly-coupled crapola with little-to-no documentation.
And its arguable that if you do your interfaces right, you shouldnt need to or even want to see the impl, as that may encourage you to depend on behavior that's not documented in the interface (and therefore may change).
What 'Linux Protocols' replace CIFS? And dont say NFS, because that has nothing to do with Linux, and predated Linux.
And what does OpenOffice working on Ubuntu have to do with this conversation? Are you suggesting that OpenOffice is a replacement for CIFS?
Are you sure NetApp didnt just buy the spec from MS years ago? It's not like MS wasnt selling, it was just at an 'ask-me' price (ie, high), and probably lots of non-compete/nda terms.
Outlook 2007 still does MAPI over RPC. Thats as new as they get.
Your download speed is going to be more like 5-8, with 'burstable' up to 15mbps. If you're lucky. And I wouldnt be surprised if the burstable stuff is just things comcast can stream from its cache.
And thats the downstream speed.
Your upload is going to be 1mbps if you're lucky. You probably arent. You'll probably be in the 500-800kbps range for uploads.
And what is your latency? What's the round trip time between you and Adobe's servers? What is the packet loss rate?
For online apps to work well, you need more than just occasional fast streaming downloads. You need low latency, low packetloss, and reasonable upload.
Anyway, I'm not saying online apps wont work
And dont count on dslreports speedtesting and such, as its entirely possible and likely that they optimize for that traffic, to make their systems look better.
Yes you can. Though in all honesty, you probably dont want to pay for premium on the precision.
What you can't get is an Inspiron or a Vostro. And Dell doesnt make a 17" in the Latitude.
Of course, this is mostly due to the fact that Dell doesnt have a business class laptop in 17". They have consumer level garbage (inspiron, vostro) in a 17", and an engineering workstation (precision), but no latitude in a 17".
The deal with Dell and XP is that you can get XP or Vista on all their business class machines. And despite their marketing, that doesnt include the Vostro's.
Thanks for posting.
Some of the things you mention are configurable (auto-delete of accepted meetings), some things are present in the current version (instant search of entire mail store, auto-hyperlinking of http references, though spaces will break).
Some of these irritate me too, but only very mildly (names instead of emails, embedded images in html mails).
Anyway, thanks for responding!
From the KB article describing the problem, ie TRFA (where R = Real):
http://support.microsoft.com/kb/942435/en-us This problem occurs because of a memory leak in the Windows OLE component. This memory leak is triggered by the way that Windows Explorer deals with the extended attributes of the files. This is 100% in the shell and UI layers, not in the kernel.
For this kind of stuff, where its important that the copy goes right, or complains, then use another more appropriate tool, like XCOPY or (even better) ROBOCOPY.
Both of these are freely available tools made by MS for windows, and will give you much more reliability in what you're doing.
FYI, you have alot more control with XCOPY.
/? /V Verifies each new file. /C Continues copying even if errors occur.
C:\>xcopy
Also, if Windows sees a zero-byte file, it can't handle it. I have to boot Linux and use it to delete the file. The strange thing is, both of these are idiosyncracies of the explorer.exe shell. Both of these things work fine from the command line from within windows, and if you want lots of move/copy options, you use xcopy.
Which is sad, because clearly its not required for the OS to have these problems, but they exhibit these problems in the GUI shell, where the vast vast majority of people will encounter them.
Where are you shopping? Dell, HP, and Lenovo all offer XP on their laptops.
From the article you linked: [UPDATED - Just to clarify, I can confirm that this stealth update was applied to systems where Windows Update was set to Download updates but let me choose whether to install them and for updates but let me choose whether to download and install them but not on systems set to Never check for updates.] I generally mean, and thought most did, that when a person says that AU is disabled, it means either: 1. Service is disabled, or 2. Set to 'Never check for udpates'.
If you mean 'AU disabled' to include the 'Notify but dont download' setting, then you're correct.
For desktops/laptops its not cost effective, and even volume licensing usually requires you to buy the machine with a windows OS on it for your VL licenses to work.
So basically buying a naked PC is more expensive if you're going to install Windows then, it's only cheaper if you're installing one of the unices, BSD or Linux. Not sure what you mean here, but I dont think thats an accurate re-statement of what I said. Basically, what I meant is that all the MS VL programs I've seen requires you to buy your PCs (ie, desktops & laptops, but not servers) with a windows OS for your OS licenses in the VL program to work. So in effect, all the desktop OS licenses in the VL programs are 'upgrade' licenses.
It sounds worse (cost-wise) than it is, as you're usually paying a per-head or per-machine licensing, not directly for the OS again. I don't know about NewEgg, are you talking about buying PCs or licenses from them? Can you order custom PCs from them? If so, I wonder if it's cheaper to have NewEgg build you one or if you can build your own cheaper. Right now it doesn't matter to me much, a bit over a year ago I bought a PC with Linux preinstalled, which I plan on setting up as a server. And I'm typing this on a Macbook Pro I got 2 months ago. So I should be set for two or three years. Heck unless things change dramatically I expect them to last twice as long. I meant windows licenses, not PCs. You can definitely build a PC for yourself from parts from NewEgg cheaper than most manufacturers. But its not worth the time/trouble to everybody (for me for example
Agreed for the most part.
:)
... the fact that it is more complicated and more programmer focused on windows is probably bad ... as the average windows admin isnt that great of an admin, much less a competent programmer.
Do you really see that many MS certified folks?
I hardly ever do, and they tend to not be the best ones. But I just dont see that many. The good admins are usually too lazy to go get a cert, to be honest.
Also, I should say that I come from a programmers background, so dont mind the MS stuff. And I actually appreciate the philosophy behind it (abstraction, etc), but I do also agree that its more complicated.
Of course, thinking about it now
Ick, just made myself sad.
Dell doesnt offer anything thats in the same class of equipment as the Himalayas (also known as the Tandom NonStop). Those things have massive, massive internal redundancies and (IIRC) a mini-os to manage the hardware. It's very specialized hardware and operating systems.
More here.
So think of it as basically buying a mainframe. It's not anything to be ashamed of, because Dell doesnt sell mainframes (or products like the himalayas).
This is true, but only applies to desktops/laptops, at least everywhere I've seen. There is no such requirement for servers.
For desktops/laptops its not cost effective, and even volume licensing usually requires you to buy the machine with a windows OS on it for your VL licenses to work.
For servers though its pretty common. As someone else noted, Dell's price for Windows server products is not that good. You can do better with NewEgg or your own volume licensing program.
You also then end up with a copy of the OS not tied to the hardware (unless you're sticking OEM server stuff on it).
Yes, the way windows does 'in-use' files is annoying, and this is the root cause for the reboot need.
But what most people are talking about with uptime is avoiding unplanned downtime. 60-120 seconds of planned downtime once a month is very reasonable and manageable for most shops. Where its not, you load-balance.
Note as well that that both Linux and Windows require reboots for the same things: updates to kernel. Unfortunately, more things in Windows are in there than probably should be.
All that being said, its not too uncommon to have an MS super tuesday go by with servers not needing to reboot. Tons of things can get patched without rebooting: sql server, IIS, exchange, IE, office, many explorer components if they're not being used. AD stuff usually requires a reboot, and so does core explorer elements.
In addition, dont abstract too far over the way unix systems handle this. If you have apache running with a nasty vuln, and you patch it, but dont restart apache, all old existing connections are still using the vulnerable binaries. I realize that you dont tend to have long-running connections to apache, just using it as an example. In both windows and unix case, you just patch apache/iis, then restart apache/iis. And come now, Windows has a registry. It's a spaghetti tangle of cryptic and archaic settings, many of which are purposefully obfuscated, and is prone to corruption. UNIX systems use flat config files, usually in plain old English. The registry is largely a non-issue nowadays. It's not like unix, where you use 'white box' access, and directly modify the config files. On windows, there is an abstraction layer, and its much more of a 'black box' interaction. You use the programmatic interface to tell the service what to change, it handles storage issues for you, and you dont need to know. There are a lot of benefits to doing it this way, and in the programming world, thats the superior approach.
It's not really that hard.
You can still use Python, wget, and throw in some com bindings for your python.
Then use the COM automation for the windows firewall.
Would probably take 1-2 hours the first time for me to do that. Much less after that.
Mind you, some of the interfaces arent as clean to the Unix'y eye as the iptables solution. MS automation tends to be more oriented towards a programmer or an SA with strong programming skills. Unix automation tends to be more oriented towards an SA with minor coding skills but an interest to poke around. Lower barrier of entry on the unix side, cause things tend to be a little simpler.
(assuming I'm understanding from the quick link what the 'self-updating firewall rules' are doing)
It's not that Linux is actually the measuring stick.
It's just that you are always having to beat some sense and reality into the heads of the linux zealots. So it's always in response to that.
The real measuring stick would probably be VMS or the mainframe.
Every large organization I've seen, there are huge numbers of linux boxes getting owned constantly. Mostly due to poor management. Strange how thats the same with windows.
In both cases, weak passwords will own both.
In both cases, zero-day exploits plus open holes in the firewall will own both.
In both cases, userland software vulns plus an elevation exploit will own both.
Are the windows admins as good on that platform as the Unix guys are on their platform?
Do the windows guys do scripting and automation for all their group management tasks? Because despite the popular belief, windows has a huge amount of automation tools available, its just a different approach than unix. But there isnt really anything that cant be done from the command line and the scripting environment on windows.
For some reason though, most windows admins choose not to use them. I dont know why.
What I can agree with is the general tradition is very different. Only amongst the very best windows admins will you see that they manage huge numbers of machines, all using perl/com/adsi/wmi or vbscript/com/adsi/wmi (and plus powershell up and coming).
You can tell instantly as well when you watch them work.
Do they prefer to go into the machine room and work at the console? Do they prefer to use term-serv and work at the virtual console?
Or do they use a big combo custom MMC console for single-machine admin, and a huge library of scripts to manage whole sets of machines?
The best windows admins are the smartest/laziest, and they can manage whole hordes of windows machines from their couch or office chair.