Actually, liscensing models as the principal profit point aren't nearly as scary as ad-revenue driven companies. Microsoft expands revenues by either beating the competition (to which the market always responds in one way or another) or by moving into new theaters - ad-driven companies increase their revenues by selling more ads.
To date, Google's ads have been pretty non-intrusive, but then again Google's not having money problems. What happens if Yahoo or MSN ups their market share substantially. What does Google do to stay afloat. Google's technologies allows them to collect vast quantities of information about anything or anyone, information they can datamine and sell if things get tough. Right now you can pay to increase your site's ranking for a given search - what happens if Google determines there's a valid market for selling the ability to knock your competitors search ranking down a couple steps. Gmail in its current incarnation mines your email for ad placement. I personally don't care because what they offer to me is worth it. But what happens in the future if they decide to sell that personal information to other companies. What happens if Google Desktop Search can gather trends as to what you like/dislike by theme and sell that?
I think kiddie porn is despicable and child stalkers should get the shit kicked out of them daily. Fortunately for a healthy society, I'm not in a position to make that happen. If I worked at Google, with or without company consent, with enough trending data at my fingertips, I could make it happen. Google is in a unique position that technically they as a company or an individual at that company can actually make a list of people who have kiddie porn on their box or people that have chat logs where they try to trick kids. Less controversial, Google could probably build a list of all the contributors to Moveon.org, or a list of all the people in Pacific Northwest that have AIDs. Not cool.
At the moment, I think Google is good. I'm just saying that the danger to the individual is 1000x greater from Google than it could ever be from a company like Microsoft, because at the end of the day, I can switch off Microsoft or Apple if I dislike their policies. You can't escape the datamining Google can do. And that makes them very dangerous.
Also, most critical updates for Win2k3 aren't neccesary.
MS releases updates for IE, DirectX and the desktop system for Win2k3 because it can be used as such. Any 5-nines system shouldn't be used to that extent, so deploying those critical updates are not neccesary. You might as well throw them in when a real Win2k3 vulnerability arises since the downtime will be identical, but that really helps out Win2k3 uptime.
Have to comment on one point - Google did not get into bed with MS on this one. MS has no intent whatsoever with of getting into bed with Google. With the acquisition of Lookout (a very similar technology) and the announcement that MSN Desktop Search will be available in December, they are coming after Google hard, and certainly aren't going to help Google improve their product.
Its a shame from a business perspective, honestly - if Microsoft wasn't so paranoid of the search market, they'd pair up with Google and integrate their solutions together. Sure, MS would lose some content control, but I think it would dramatically improve Windows all-around, in addition to ensuring that Google won't be jumping in and writing software for non-MS systems.
On the outside chance you're a small business that really doesn't need the power of PostGre, I'd still go PG - why? Because a small business cannot afford to make the mistake of being unable to grow in a new direction technically because their existing system is sitting on a very special-case db. Small businesses die because of mistakes like needing to stop development on new features for 6 months to redo their backend so that they can end up in the same spot they started in.
Almost all specialized products are for systems whose requirements are immutable, and only then in cases where a more generic solution is dramatically inferior in some regard. From a business case, if you have to spend an extra 3% on your hardware budget to accomodate a slightly slower db, but that db allows you to rapidly grow in a direction you haven't thought up yet, you take that case in a heartbeat.
I don't know much about the Java world, but I suspect that they have similar caching features to the.NET CLR. In the.NET Universe, commonly called sections of code are optimized to machine code, and cached to the disk for later invocations of the same program / dynamic library.
That said, as the environment in which the program is running changes (such as the supply of available memory decreases), the CLR may decide its worth a recompile to optimize to changed conditions.
Gonna have to call you out on wireless networks. Wireless networks are bad iff you don't know how to configure them right. 802.11g with WPA with preshared public keys is pretty safe. Can it be cracked? Yes. But then again, so can SSL, SSH, PGP and every other encrypted data you throw out there in due time.
The key to proper wireless setup is to associate different levels of trust between the wired and unwired components. Require WPA. Most household wireless routers allow you to specify a physical address list for visiting assets - do not allow unregistered MAC addresses to join your network. Have the wired network use a different subnet than your wireless network, so that the IPSecurity policies on your wired boxes can be set to prohibit access to the wireless agents on your house. Also, some routers let you set firewall rules between your wired and wireless subnets.
Audit everything. Everything. Disk space is cheap.
Also, run a packet sniffer on your wireless network. I once had a Netgear wireless router that would broadcast packets wired computers had sent it to route to the public internet across the wireless network - it had no concept of how to route correctly. If that's happening, throw that PoS away and get a real router.
Can this be compromised? Yes, but it requires breaking through various levels of real, cryptographically enforced security. Remember that only one part of information security is denying access to intruders because at the end of the day, the most locked down boxes plugged into a network can still be hacked. You must be constantly vigilant to detect intruders as they attempt access, you must have a recovery plan if you are compromised (everyone needs AV software and an individual firewall on each computer behind the NAT firewall), and must be sufficiently auditted that you can trace access attempts back to the source. Watch your wireless traffic - with this type of security, in the very very remote chance you are compromised, its going to take a long while. Is someone trying a variety of network attacks on your wireless network? If so, I've got good news - rule out that its not someone in a car outside, and you can pinpoint it pretty quick down to a neighbor. Talk to them if you think its their 16 year old punk teen, call the police, leave a note on their door with a picture of Sauron's eye saying they need to be more sneaky, whatever.
The performance of C# implementations is quickly catching up with Java implementations.
That depends. For single processor 32bit x86 environments, I've found.NET to be significantly faster than Java. It helps to be able to inline short non-virtual methods, perform allocations for simple non-native-typed objects on the stack, etc. The gap will probably only widen as the two camps release their very different implementations of generics.
Java clobbers.NET in the 64 bit world and in the multi-processor world..NET also doesn't really appear in a non-x86 architecture and probably wouldn't perform as well - Not surprisingly.NET IL looks to be pretty biased to the x86 architecture.
But for every runtime optimization the Java world can build, the.NET CLR team can match it and build in another option the Java camp can't without a pretty drastic change to some of the core internals.
(note that when I talk about.NET, I'm referring to the Microsoft.NET CLR - the Mono CLR is still pretty slow to my experience, but getting better by the day
The problem is that alot of people don't think Python/Ruby/Perl fits appropriately into 2) because of the language bindings. One of the advantages of managed frameworks (particularly.NET/Mono) is that once somebody somewhere wrote a.NET library to do something, that library is available immediately for use in any language which compiles to IL or has an IL runtime built into it.
Projects like IronPython give you all the advantages of working in Python, all the advantages of working on top of the CLR framework and toss in the added benefit of every other.NET/Mono application being able to take advantage of your Python libraries.
btw - Being able to run stored procedures written in Python on the SQL Server 2005 beta is pretty cool. I still can't find a good reason to write a stored procedure in any language other than T-SQL, but its still kind of fun.
I'm not a big fan of mySQL at all, but I do wonder what a small shop was doing that they needed Oracle or SQL Server that PostGre or Sybase couldn't handle. If I had to take a guess, they were small enough that they didn't want to pony up for a real dba. If that's the case, that does give some value to SQL Server which can basically run at 75% potential with a respectable disaster recovery plan on a very part time admin unless you're replicating.
At the end of the day, if all your business needs a group of three to five developers hacking out new features on your web application quickly, its hard to not pay attention to Microsoft programs like Empower ISV, which gives you two copies of Windows Server, an Enterprise liscense of SQL Server, 5 copies of XP, Office and Visual Studio, Win2k3 Small Business Edition (Active Directory and Exchange), and a year of MSDN Universal (basically all the upgrades and free software a small business can dream of) for $375. When you consider that one of your developers can spend 10% of his time being the admin for the rest of the IT infrastructure, I'd find it nigh-impossible to talk a business owner out of a situation like that from a cost perspective. If they accept that they're locking themselves into the Windows Server world once they start expanding, no argument you throw at them is going to change their mind.
Microsoft's ability to target the very small companies that want a limitted technology presense is absolutely amazing and I think in general, the Open Source movement does a poor job at targetting these types of businesses.
a) I know its a heavily debated topic, but my company LOVES the embedded DRM protections in documents - and all the federal customers we work with are also paying very close attention to it. Given the frequency with which you see a word doc accidentally posted online or forwarded to a non-company resource by accident... our management digs the ability to limit viewers of a file to our local network, and deny printing, editting, etc, to certain departments. Future versions of the technology promise to allow Active Directory audit access to document resources, so the company can quickly pull up a list and see who read what, when they read it, etc. That has value to us.
b) Integration with Sharepoint products. Again, another MS product, but it has a great deal of value to some businesses, especially businesses that had a large amount of growth in the past 4-5 years and didn't have their own document repository solutions in place. The integration into word, and the versioning support built right into Outlook 2003 attachments has meant that people actually use it around here.
Does OpenOffice support the same level of editting markup and internal versioning? I'll be honest, its nothing I use so I've never looked, but I know alot of people around here who live by it.
That clause is on every shrinkwrap I've ever read. If an "AS IS" clause is all that's neccesary to circumvent liability, then software liability won't exist except for the rare individual developer who tries to write his own liscense without a lawyer.
I'd like to know more how the percentage costs were distributed across companies by size and type of company. Also, what is considered a security cost? Are desktop OS upgrades from Win9x to XP lumped in there? I'd love to datamine their raw results and see what the real trends are.
Smaller companies (500) can oftentimes get by with a single fantastic main admin - As your company grows into the thousands, you probably need multiple main admins at multiple satellite offices, each with his or her own way of doing things. That can effect the results - at the same time, that can mitigate the effects of a less qualified admin.
Larger companies also oftentimes have non-sensical bureacratic IT policies . Smaller companies generally trust their individual admin's opinions more often regarding the purchase of new hardware/software, whereas larger corporations tend to make those types of decisions in the boardroom. I don't think there's a technical upside to that, but I might be wrong.
On the flipside, though, I suspect that smaller companies are more apt to hire underexperienced MCSE's as admins because I suspect their salary offerings won't be as high as companies large enough to have been burned multiple times before - but I could be wrong there too - maybe smaller companies have the edge on better people too.
Do companies that provide technical services (not neccesarily in IT - could be anything like civil engineering) gain anything from having a higher percentage of engineering minds on staff, or does that result in a higher rate of people "fiddling" with their computer in ways that make it more vulnerable.
What's the distribution of desktop OS' within these groups? Like WinXP or not, everyone has to at least admit that its substantially more secure than the Win9x series.
What percentage of companies take advantage of the strong group and ipsec policies in Active Directory? Do they make much difference? Has anyone not living in Redmond actually figured IP Sec group policies out yet?
In any case, I think there's way too many variables to start pointing fingers at Microsoft. Sure, their security policies have bordered on moronic at times, but honestly, to the best of my knowledge, there probably isn't a Linux desktop network large enough to compete with the top 100 largest Windows networks. Its a different ballgame at that scale and while the desktop Linux teams are paying close attention to the failures of Microsoft as they develop their products, we don't know how they'll rate until they're actually out there.
From what I understand, SP2 doesn't fix the problem explicitly - rather the compiler-bounds checking for arrays prevents the bug which is still there in XP2 from being exploited.
UT isn't saying they can't have wireless networks - they're saying they can't have wireless networks which connect to the UT network. This is not airwave regulation, but is a stipulation of usage and code of conduct for their own proprietary wired network - Fully legal.
Give two weeks notice, and leave politely. Its not about burning bridges - its about creating a stigma for yourself.
After all, what will your new employer think of someone who has a job now but is available to start "immediately" - that's a bad first impression.
WinFS doesn't mean you don't have folder anymore - it just means its not the only way of organizing. In my experience, 98% of the time I know about where to look for a file, but search would be really nice for that 2%.
Its also a fantastic way of looking at groups of files - There are plenty of apps that organize music files by metadata, but they use their own system for it. Likewise, there's plenty of apps that organize pictures by metadata, but being different products they use a completely different system. It would be nice if my apps could search my box (or better yet, all boxes on my network) for a specific concert, and not only get the audio but also some pictures I snapped and the album art for the CD. Why stop there - I could use that same search to find emails to my friends leading up to the concert, and notations linking out to websites I viewed related to that concert.
Or how about a friend IMs me a link about going skydiving in two weekends and within the app, it can find the date, search against my calendar and contacts list and come back with the little message that says "You're already going to New Orleans with your brother for his birthday". Not that I'd forget a trip to New Orleans, but maybe for smaller stuff....
I think what we're seeing is MS beginning to adapt to the release schedules of their OSS competitors.
If you think of new paid MS desktop releases as whole number releases of Gnome/KDE (substantial changes, new environment), MS is in pickle trying to compete with the "minor" even numbered releases the Linux desktop teams are pushing out. Every six months, Gnome users get a little more - that's hard to fight when you only release new OS changes every 4 years.
Whenever people asked me why they should upgrade from Win2k to WinXP Pro, I always said "You'll get a new annoying cartoon interface and a couple nice internal things, but mainly, you go with XP because of the periodic updates that become available to it". I think if you look at XP that was released and compare that to the XP users have now (with journal tablet support, two new versions of the windows media framework, three revisions of built in wireless support, and now native bluetooth support all the other stuff tossed into SP2), I think that everyone has to agree (whether they like XP or not is a different story) that its a substantially changed product. This is ignoring the products that were pushed to all previous versions of windows (.NET Framework, IE and OE, DirectX 9, etc). Its also not just cosmetic features - The windows userland driver model is being deployed mid-XP release as opposed to in a new Windows version.
From the look of it, the changes keep coming - by the time Longhorn rolls out, XP users will also have the same major version of.NET 2.0 Longhorn will have a two years beforehand, Indigo a year in advance, the free Yukon embeddable data engine two years beforehand and now a substantial slice of Avalon, not to mention at least 1 more media framework and substantially increased device support - XP is a completely different beast. Hopefully we'll get a new version of IE that isn't the equivelant of shoving a rod of Uranium 235 down your shorts too (and for those who don't think its important when you're using Firefox anyway... have you looked at how many apps mshtml.dll is embedded in?).
It looks like WinFS follows the same strategy - don't buy Longhorn because its completely different from XP - buy it because its slightly different than XP at release, but also because you'll be eligible for a four years update cycle that will end with Longhorn being substantially different than XP's resting place.
WinFS is a very tricky problem (see other replies) but they were originally slated to deploy in 2006. From what I've read, the problem is that WinFS relied heavily on the new indexing strategy for embedded SQL Server 2005 (Yukon) which was delayed a full year based on changing requirements in the.NET 2.0 threading library.
The delays cascaded and six months delay in solidifying the.NET 2.0 library turned into a year delay before Yukon's API had stabilized turned into a year delay for WinFS.
I think that the whole bundle of late releases surrounding.NET 2.0 is the reason why MS is pulling the "three pillars of Longhorn" apart and releasing them as seperate entities.
I don't think Microsoft did this wrong. I do wish the zone carried over when you copied the file on the same machine, but the cmd "vulnerability" is silly. Most enterprises have cmd supressed for non-power users because the windows command line is useless. Could the cmd binary itself be modified to obey the new warnings? Probably, but it'd probably break a good slew of maintenance scripts, and the lack of strong scripting support in Win32 as is makes it hard to script workarounds.
In the end, this feature is a last line of defense "Do you know what you're clicking on" feature of explorer. Smart zoning and code access security ARE built in at the kernel level for the.NET runtime, and I think anyone who has web-deployable apps that don't run on a managed runtime needs to reevaluate what they're doing. Microsoft is putting their foot down with.NET, whether you agree with.NET or not, and saying "This is how Windows development should be done". I think going back and completely revamping the system by which binaries are run would be too much effort for not enough gain.
Besides, if you as an attacker can socially engineer a user to copy an executable into the commandline to run it after a cmd statement, its not a stretch to also get them to click "Yes" when they're prompted. If users fall for that, you've already lost.
There was actually alot of chat about where this protection should be placed prior to SP2 RC1 and the general consensus amoung developers (both in and out of MS was that it should be placed in explorer).
The problem with making it kernel level is that applications which use web auto-update methods to retrieve new binary versions of executables or dlls would block on an exec or CreateProcessEx and prompt the user. This would be such a pain in the ass and confusing in user space that it appeared most developers would rather invent their own auto-update strategies than take advantage of the strategies MS is beginning to push on the market.
In the end, its more beneficial to end users to have a uniform update model - a uniform update model means that in the next generation of Windows Update Services, enterprises will be able to deploy updates and patches to all types of software regardless of vendors from a centralized repository. Also, it helps consumers in future versions of Windows Update when MS begins to allow third party signed binaries to be hosted on Windows Update itself.
Re:Making it small is the trick
on
Latest SP2 News
·
· Score: 1
MS has taken the concept of MAC and rebranded it CAS (Code Access Security), and its an integral part of the.NET runtime. In Longhorn and beyond, CAS rules will apply basically all software running on the machine (including user-level drivers) regardless of whether they were written in managed code or not, because the underlying Win32 framework is being rebuilt to.NET stubs encapsulating the function calls - therefor, even legacy C apps attempting kernel or IO operations in Longhorn will have to run through the CAS authentication cycle and can have security policy filters applied to them.
The fact is that most Americans are averse to paying $50 a month for faster access to email, or $2000 for a fancy HDTV set that plays analog movies. But if more high-quality content were available, consumer interest wou! ld l ikely increase.
Statement by Senator Ernest F. Hollings on the Introduction of "The Consumer Broadband and Digital Television Act of 2002"
I thought the whole crux of his argument was that we were stealing movies and music for free at such a rampant rate that it hurt the content industries... If that's the case, then why would taking away free access to content and making people pay for lower quantities and less selection cause an increase in demand?
Slashdot Mirror
Actually, liscensing models as the principal profit point aren't nearly as scary as ad-revenue driven companies. Microsoft expands revenues by either beating the competition (to which the market always responds in one way or another) or by moving into new theaters - ad-driven companies increase their revenues by selling more ads.
To date, Google's ads have been pretty non-intrusive, but then again Google's not having money problems. What happens if Yahoo or MSN ups their market share substantially. What does Google do to stay afloat. Google's technologies allows them to collect vast quantities of information about anything or anyone, information they can datamine and sell if things get tough. Right now you can pay to increase your site's ranking for a given search - what happens if Google determines there's a valid market for selling the ability to knock your competitors search ranking down a couple steps. Gmail in its current incarnation mines your email for ad placement. I personally don't care because what they offer to me is worth it. But what happens in the future if they decide to sell that personal information to other companies. What happens if Google Desktop Search can gather trends as to what you like/dislike by theme and sell that?
I think kiddie porn is despicable and child stalkers should get the shit kicked out of them daily. Fortunately for a healthy society, I'm not in a position to make that happen. If I worked at Google, with or without company consent, with enough trending data at my fingertips, I could make it happen. Google is in a unique position that technically they as a company or an individual at that company can actually make a list of people who have kiddie porn on their box or people that have chat logs where they try to trick kids. Less controversial, Google could probably build a list of all the contributors to Moveon.org, or a list of all the people in Pacific Northwest that have AIDs. Not cool.
At the moment, I think Google is good. I'm just saying that the danger to the individual is 1000x greater from Google than it could ever be from a company like Microsoft, because at the end of the day, I can switch off Microsoft or Apple if I dislike their policies. You can't escape the datamining Google can do. And that makes them very dangerous.
Also, most critical updates for Win2k3 aren't neccesary.
MS releases updates for IE, DirectX and the desktop system for Win2k3 because it can be used as such. Any 5-nines system shouldn't be used to that extent, so deploying those critical updates are not neccesary. You might as well throw them in when a real Win2k3 vulnerability arises since the downtime will be identical, but that really helps out Win2k3 uptime.
Have to comment on one point - Google did not get into bed with MS on this one. MS has no intent whatsoever with of getting into bed with Google. With the acquisition of Lookout (a very similar technology) and the announcement that MSN Desktop Search will be available in December, they are coming after Google hard, and certainly aren't going to help Google improve their product.
Its a shame from a business perspective, honestly - if Microsoft wasn't so paranoid of the search market, they'd pair up with Google and integrate their solutions together. Sure, MS would lose some content control, but I think it would dramatically improve Windows all-around, in addition to ensuring that Google won't be jumping in and writing software for non-MS systems.
On the outside chance you're a small business that really doesn't need the power of PostGre, I'd still go PG - why? Because a small business cannot afford to make the mistake of being unable to grow in a new direction technically because their existing system is sitting on a very special-case db. Small businesses die because of mistakes like needing to stop development on new features for 6 months to redo their backend so that they can end up in the same spot they started in.
Almost all specialized products are for systems whose requirements are immutable, and only then in cases where a more generic solution is dramatically inferior in some regard. From a business case, if you have to spend an extra 3% on your hardware budget to accomodate a slightly slower db, but that db allows you to rapidly grow in a direction you haven't thought up yet, you take that case in a heartbeat.
I don't know much about the Java world, but I suspect that they have similar caching features to the .NET CLR. In the .NET Universe, commonly called sections of code are optimized to machine code, and cached to the disk for later invocations of the same program / dynamic library.
That said, as the environment in which the program is running changes (such as the supply of available memory decreases), the CLR may decide its worth a recompile to optimize to changed conditions.
Gonna have to call you out on wireless networks. Wireless networks are bad iff you don't know how to configure them right. 802.11g with WPA with preshared public keys is pretty safe. Can it be cracked? Yes. But then again, so can SSL, SSH, PGP and every other encrypted data you throw out there in due time.
The key to proper wireless setup is to associate different levels of trust between the wired and unwired components. Require WPA. Most household wireless routers allow you to specify a physical address list for visiting assets - do not allow unregistered MAC addresses to join your network. Have the wired network use a different subnet than your wireless network, so that the IPSecurity policies on your wired boxes can be set to prohibit access to the wireless agents on your house. Also, some routers let you set firewall rules between your wired and wireless subnets.
Audit everything. Everything. Disk space is cheap.
Also, run a packet sniffer on your wireless network. I once had a Netgear wireless router that would broadcast packets wired computers had sent it to route to the public internet across the wireless network - it had no concept of how to route correctly. If that's happening, throw that PoS away and get a real router.
Can this be compromised? Yes, but it requires breaking through various levels of real, cryptographically enforced security. Remember that only one part of information security is denying access to intruders because at the end of the day, the most locked down boxes plugged into a network can still be hacked. You must be constantly vigilant to detect intruders as they attempt access, you must have a recovery plan if you are compromised (everyone needs AV software and an individual firewall on each computer behind the NAT firewall), and must be sufficiently auditted that you can trace access attempts back to the source. Watch your wireless traffic - with this type of security, in the very very remote chance you are compromised, its going to take a long while. Is someone trying a variety of network attacks on your wireless network? If so, I've got good news - rule out that its not someone in a car outside, and you can pinpoint it pretty quick down to a neighbor. Talk to them if you think its their 16 year old punk teen, call the police, leave a note on their door with a picture of Sauron's eye saying they need to be more sneaky, whatever.
That depends. For single processor 32bit x86 environments, I've found .NET to be significantly faster than Java. It helps to be able to inline short non-virtual methods, perform allocations for simple non-native-typed objects on the stack, etc. The gap will probably only widen as the two camps release their very different implementations of generics.
Java clobbers .NET in the 64 bit world and in the multi-processor world. .NET also doesn't really appear in a non-x86 architecture and probably wouldn't perform as well - Not surprisingly .NET IL looks to be pretty biased to the x86 architecture.
But for every runtime optimization the Java world can build, the .NET CLR team can match it and build in another option the Java camp can't without a pretty drastic change to some of the core internals.
(note that when I talk about .NET, I'm referring to the Microsoft .NET CLR - the Mono CLR is still pretty slow to my experience, but getting better by the day
The problem is that alot of people don't think Python/Ruby/Perl fits appropriately into 2) because of the language bindings. One of the advantages of managed frameworks (particularly .NET/Mono) is that once somebody somewhere wrote a .NET library to do something, that library is available immediately for use in any language which compiles to IL or has an IL runtime built into it.
.NET/Mono application being able to take advantage of your Python libraries.
Projects like IronPython give you all the advantages of working in Python, all the advantages of working on top of the CLR framework and toss in the added benefit of every other
btw - Being able to run stored procedures written in Python on the SQL Server 2005 beta is pretty cool. I still can't find a good reason to write a stored procedure in any language other than T-SQL, but its still kind of fun.
I'm not a big fan of mySQL at all, but I do wonder what a small shop was doing that they needed Oracle or SQL Server that PostGre or Sybase couldn't handle. If I had to take a guess, they were small enough that they didn't want to pony up for a real dba. If that's the case, that does give some value to SQL Server which can basically run at 75% potential with a respectable disaster recovery plan on a very part time admin unless you're replicating.
At the end of the day, if all your business needs a group of three to five developers hacking out new features on your web application quickly, its hard to not pay attention to Microsoft programs like Empower ISV, which gives you two copies of Windows Server, an Enterprise liscense of SQL Server, 5 copies of XP, Office and Visual Studio, Win2k3 Small Business Edition (Active Directory and Exchange), and a year of MSDN Universal (basically all the upgrades and free software a small business can dream of) for $375. When you consider that one of your developers can spend 10% of his time being the admin for the rest of the IT infrastructure, I'd find it nigh-impossible to talk a business owner out of a situation like that from a cost perspective. If they accept that they're locking themselves into the Windows Server world once they start expanding, no argument you throw at them is going to change their mind.
Microsoft's ability to target the very small companies that want a limitted technology presense is absolutely amazing and I think in general, the Open Source movement does a poor job at targetting these types of businesses.
http://www.microsoft.com/downloads/details.aspx?Fa milyId=6A63AB9C-DF12-4D41-933C-BE590FEAA05A&displa ylang=en
A couple of features at least my company loves...
a) I know its a heavily debated topic, but my company LOVES the embedded DRM protections in documents - and all the federal customers we work with are also paying very close attention to it. Given the frequency with which you see a word doc accidentally posted online or forwarded to a non-company resource by accident... our management digs the ability to limit viewers of a file to our local network, and deny printing, editting, etc, to certain departments. Future versions of the technology promise to allow Active Directory audit access to document resources, so the company can quickly pull up a list and see who read what, when they read it, etc. That has value to us.
b) Integration with Sharepoint products. Again, another MS product, but it has a great deal of value to some businesses, especially businesses that had a large amount of growth in the past 4-5 years and didn't have their own document repository solutions in place. The integration into word, and the versioning support built right into Outlook 2003 attachments has meant that people actually use it around here.
Does OpenOffice support the same level of editting markup and internal versioning? I'll be honest, its nothing I use so I've never looked, but I know alot of people around here who live by it.
-Steve
That clause is on every shrinkwrap I've ever read. If an "AS IS" clause is all that's neccesary to circumvent liability, then software liability won't exist except for the rare individual developer who tries to write his own liscense without a lawyer.
I'd like to know more how the percentage costs were distributed across companies by size and type of company. Also, what is considered a security cost? Are desktop OS upgrades from Win9x to XP lumped in there? I'd love to datamine their raw results and see what the real trends are.
Smaller companies (500) can oftentimes get by with a single fantastic main admin - As your company grows into the thousands, you probably need multiple main admins at multiple satellite offices, each with his or her own way of doing things. That can effect the results - at the same time, that can mitigate the effects of a less qualified admin.
Larger companies also oftentimes have non-sensical bureacratic IT policies . Smaller companies generally trust their individual admin's opinions more often regarding the purchase of new hardware/software, whereas larger corporations tend to make those types of decisions in the boardroom. I don't think there's a technical upside to that, but I might be wrong.
On the flipside, though, I suspect that smaller companies are more apt to hire underexperienced MCSE's as admins because I suspect their salary offerings won't be as high as companies large enough to have been burned multiple times before - but I could be wrong there too - maybe smaller companies have the edge on better people too.
Do companies that provide technical services (not neccesarily in IT - could be anything like civil engineering) gain anything from having a higher percentage of engineering minds on staff, or does that result in a higher rate of people "fiddling" with their computer in ways that make it more vulnerable.
What's the distribution of desktop OS' within these groups? Like WinXP or not, everyone has to at least admit that its substantially more secure than the Win9x series.
What percentage of companies take advantage of the strong group and ipsec policies in Active Directory? Do they make much difference? Has anyone not living in Redmond actually figured IP Sec group policies out yet?
In any case, I think there's way too many variables to start pointing fingers at Microsoft. Sure, their security policies have bordered on moronic at times, but honestly, to the best of my knowledge, there probably isn't a Linux desktop network large enough to compete with the top 100 largest Windows networks. Its a different ballgame at that scale and while the desktop Linux teams are paying close attention to the failures of Microsoft as they develop their products, we don't know how they'll rate until they're actually out there.
From what I understand, SP2 doesn't fix the problem explicitly - rather the compiler-bounds checking for arrays prevents the bug which is still there in XP2 from being exploited.
UT isn't saying they can't have wireless networks - they're saying they can't have wireless networks which connect to the UT network. This is not airwave regulation, but is a stipulation of usage and code of conduct for their own proprietary wired network - Fully legal.
Give two weeks notice, and leave politely. Its not about burning bridges - its about creating a stigma for yourself. After all, what will your new employer think of someone who has a job now but is available to start "immediately" - that's a bad first impression.
WinFS doesn't mean you don't have folder anymore - it just means its not the only way of organizing. In my experience, 98% of the time I know about where to look for a file, but search would be really nice for that 2%.
Its also a fantastic way of looking at groups of files - There are plenty of apps that organize music files by metadata, but they use their own system for it. Likewise, there's plenty of apps that organize pictures by metadata, but being different products they use a completely different system. It would be nice if my apps could search my box (or better yet, all boxes on my network) for a specific concert, and not only get the audio but also some pictures I snapped and the album art for the CD. Why stop there - I could use that same search to find emails to my friends leading up to the concert, and notations linking out to websites I viewed related to that concert.
Or how about a friend IMs me a link about going skydiving in two weekends and within the app, it can find the date, search against my calendar and contacts list and come back with the little message that says "You're already going to New Orleans with your brother for his birthday". Not that I'd forget a trip to New Orleans, but maybe for smaller stuff....
I think what we're seeing is MS beginning to adapt to the release schedules of their OSS competitors.
.NET 2.0 Longhorn will have a two years beforehand, Indigo a year in advance, the free Yukon embeddable data engine two years beforehand and now a substantial slice of Avalon, not to mention at least 1 more media framework and substantially increased device support - XP is a completely different beast. Hopefully we'll get a new version of IE that isn't the equivelant of shoving a rod of Uranium 235 down your shorts too (and for those who don't think its important when you're using Firefox anyway... have you looked at how many apps mshtml.dll is embedded in?).
If you think of new paid MS desktop releases as whole number releases of Gnome/KDE (substantial changes, new environment), MS is in pickle trying to compete with the "minor" even numbered releases the Linux desktop teams are pushing out. Every six months, Gnome users get a little more - that's hard to fight when you only release new OS changes every 4 years.
Whenever people asked me why they should upgrade from Win2k to WinXP Pro, I always said "You'll get a new annoying cartoon interface and a couple nice internal things, but mainly, you go with XP because of the periodic updates that become available to it". I think if you look at XP that was released and compare that to the XP users have now (with journal tablet support, two new versions of the windows media framework, three revisions of built in wireless support, and now native bluetooth support all the other stuff tossed into SP2), I think that everyone has to agree (whether they like XP or not is a different story) that its a substantially changed product. This is ignoring the products that were pushed to all previous versions of windows (.NET Framework, IE and OE, DirectX 9, etc). Its also not just cosmetic features - The windows userland driver model is being deployed mid-XP release as opposed to in a new Windows version.
From the look of it, the changes keep coming - by the time Longhorn rolls out, XP users will also have the same major version of
It looks like WinFS follows the same strategy - don't buy Longhorn because its completely different from XP - buy it because its slightly different than XP at release, but also because you'll be eligible for a four years update cycle that will end with Longhorn being substantially different than XP's resting place.
WinFS is a very tricky problem (see other replies) but they were originally slated to deploy in 2006. From what I've read, the problem is that WinFS relied heavily on the new indexing strategy for embedded SQL Server 2005 (Yukon) which was delayed a full year based on changing requirements in the .NET 2.0 threading library.
.NET 2.0 library turned into a year delay before Yukon's API had stabilized turned into a year delay for WinFS.
.NET 2.0 is the reason why MS is pulling the "three pillars of Longhorn" apart and releasing them as seperate entities.
The delays cascaded and six months delay in solidifying the
I think that the whole bundle of late releases surrounding
In the end, this feature is a last line of defense "Do you know what you're clicking on" feature of explorer. Smart zoning and code access security ARE built in at the kernel level for the .NET runtime, and I think anyone who has web-deployable apps that don't run on a managed runtime needs to reevaluate what they're doing. Microsoft is putting their foot down with .NET, whether you agree with .NET or not, and saying "This is how Windows development should be done". I think going back and completely revamping the system by which binaries are run would be too much effort for not enough gain.
Besides, if you as an attacker can socially engineer a user to copy an executable into the commandline to run it after a cmd statement, its not a stretch to also get them to click "Yes" when they're prompted. If users fall for that, you've already lost.
There was actually alot of chat about where this protection should be placed prior to SP2 RC1 and the general consensus amoung developers (both in and out of MS was that it should be placed in explorer). The problem with making it kernel level is that applications which use web auto-update methods to retrieve new binary versions of executables or dlls would block on an exec or CreateProcessEx and prompt the user. This would be such a pain in the ass and confusing in user space that it appeared most developers would rather invent their own auto-update strategies than take advantage of the strategies MS is beginning to push on the market. In the end, its more beneficial to end users to have a uniform update model - a uniform update model means that in the next generation of Windows Update Services, enterprises will be able to deploy updates and patches to all types of software regardless of vendors from a centralized repository. Also, it helps consumers in future versions of Windows Update when MS begins to allow third party signed binaries to be hosted on Windows Update itself.
MS has taken the concept of MAC and rebranded it CAS (Code Access Security), and its an integral part of the .NET runtime. In Longhorn and beyond, CAS rules will apply basically all software running on the machine (including user-level drivers) regardless of whether they were written in managed code or not, because the underlying Win32 framework is being rebuilt to .NET stubs encapsulating the function calls - therefor, even legacy C apps attempting kernel or IO operations in Longhorn will have to run through the CAS authentication cycle and can have security policy filters applied to them.
That was fixed in a critical update released earlier this year - SP2 includes all critical updates released since SP1.
Statement by Senator Ernest F. Hollings on the Introduction of "The Consumer Broadband and Digital Television Act of 2002"
I thought the whole crux of his argument was that we were stealing movies and music for free at such a rampant rate that it hurt the content industries... If that's the case, then why would taking away free access to content and making people pay for lower quantities and less selection cause an increase in demand?
www.w3c.org didn't come out either. Methinks something's broken.