IE 10 Security's Bumpy Roadblock

If you are relatively young, you think protected mode is an IE feature that stops hackers from loading malicious code (or tries to) or changing your security settings (or tries to).

If you have graying hair and are overdue for a colonoscopy you think protected mode is a way of tricking an Intel 80286 processor into addressing more than 640K (yes kilobytes) of memory so it can run Windows.

IE 10 now has an enhanced protected mode (EPM), a feature testers will eventually stumble over.

The news is good and bad. Whenever you tighten security you harm user experience. Just look at what Maxwell Smart had to go through to get into Control headquarters (if you get this reference, you probably know the first definition of protected mode, something Bill Gates pontificated on at many gatherings.)

In the case of IE 10 and the Metro interface, there is the AppContainer Sandbox. The great part is this doesn't share cookies across apps. The bad part? It doesn't share cookies across apps, so you are putting in user names and whatnot to get base level functions from some Web sites.

The nice part? When a hacker hijacks one page, he can't steal your data from another.

Posted by Doug Barney on 03/28/2012 at 1:19 PM1 comments


Windows 8: Your Feedback Wanted

I know a whole heap of you are actually playing with the Windows 8 client. I know 'cuz I've already heard from about a dozen of you.

I'm a greedy journalist. When I do an article I want the whole story, and a dozen just ain't enough. I'm looking to do a feature based on the real-world of lots of real-world users.

If interested, drop me a note and I'll send you off a batch of questions. I'm interested in overall impressions -- not glitches based on the fact that it is still in test stage.

Shoot me a note at [email protected] and I'll be in touch.

Posted by Doug Barney on 03/28/2012 at 1:19 PM9 comments


Doug's Mailbag: Pay Per Core

Readers react to the news that the next SQL Server will charge per core:

Microsoft is actually late to the game with this. It was inevitable that SQL would be priced per core. Software vendors who charge only by processor are losing millions due to the proliferation of servers with so many fewer processors and so much more computing potential with all of their cores. If they didn't price per core, then the overall price would still have to go up to keep the revenue stream at its previous levels. I'm not defending the practice, I'm just saying...
-Mark

OK, so doing the math, my 2008 R2 Enterprise server that cost me (about) $30K for 2 CPUs will now cost me $168,000 for 2012 because each CPU has 12 cores. Microsoft can't really be serious, can it? There is NO WAY I can talk my management into that. Thanks, Microsoft, for killing my career.
-Anonymous

Mainframes have always, to my knowledge, been priced in a similarly ridiculous model, yet everyone always paid it. VMware more recently tried to follow the same bandwagon with the vSphere 5 release, which, without relenting, was at least lowered. Why would anyone expect Microsoft NOT to follow that trend, especially when it does nothing but increase profits? Is it right? Of course not, but then again, software has always been priced to take a piece of the value it provides, not to cover the cost of production and reasonable markup. That is why as you try to cut costs without cutting profits, vendors usually try to take a cut of those profits.
-Tom

Share your thoughts with the editors of this newsletter! Write to [email protected]. Letters printed in this newsletter may be edited for length and clarity, and will be credited by first name only (we do NOT print last names or e-mail addresses).

Posted by Doug Barney on 03/28/2012 at 1:19 PM2 comments


Redmond Report Readers Hand Gartner Its Hat!

You just gotta love Redmond Report readers. On Friday I told you all about a report by Gartner that the PC (including laptops and netbooks) would be largely irrelevant in two years. It would be a minor player in a world where all our data is in personal clouds (I'm sure CIOs would love this loss of control) and accessed on tablets, phones and (to some degree) PCs.

When you stop laughing you started typing (on your PCs) and really gave it to the purported eggheads from Stamford (check out some of your responses in today's Doug's Mailbag section).

One developer pointed out that you can never have too much power of bandwidth -- and mobile devices have too little of each. Another pointed out that when you add all the accessories needed to make an iPad almost match a PC, it is as bulky as a PC!

Another pointed out a famous Gartner prediction that Windows would never stand up to OS/2. Oops.

Thanks to all who held the most influential, but often careless, analyst firm's feet to the fire.

Gartner has a long row to hoe before it regains many of your trust.

Of course, even more comments are welcome at [email protected].

Posted by Doug Barney on 03/26/2012 at 1:19 PM8 comments


SQL Server 2012 Charging Per Core

When SQL Server 2012 ships (in 2012, presumably) price will be based not on how many processors your server has, but how many cores you have. Simple logic tells me that a multicore processor has more cores than processors, so unless the price for each core is ultra cheap, I could end up paying more. And that is exactly what Directions on Microsoft thinks is going to happen.

Here's what Redmondmag.com newshound Kurt Mackie had to say:

"The licensing and pricing models vary based on the edition purchased. SQL Server 2012 has three editions or 'product SKUs.' The Enterprise edition is licensed on a cores basis only. The Business Intelligence edition is licensed on a server plus Client Access License (CAL) basis only. Lastly, the Standard edition is available either on a cores basis or it can be purchased according to the server plus CAL model.

"According to Directions on Microsoft, the Enterprise edition licensing for SQL Server 2012 is priced at $6,874 per core. Business Intelligence edition licensing is priced at $8,592 per server plus $209 CALs per each user or device. The costs for Standard edition licensing are $1,793 per core, or $898 per server plus $209 CALs per each user or device."

This raises a lot of concern with me. Exploiting cores is not an exact science. A piece of software does not address all the processing power of all the cores the same it way it addresses the processing power of single processor. Inevitably, there is lots of lost cycles -- cycles you end up paying for.

And often you get a great deal on a hot server only to have those economies stolen away by software costs. The bad alternative is to buy a lesser-powered server to save on software. You can't win.

Am I missing something here? You tell me where I am wrong or right at [email protected].

Posted by Doug Barney on 03/26/2012 at 1:19 PM4 comments


Doug's Mailbag: Gartner Grumbling

Readers share their thoughts on Gartner's prediction that PCs will be dead in two years:

In some ways the analyst would be correct if Microsoft really pushed thin client to the maximum and your Windows session appeared in the cloud. But that isn't happening anytime soon. So we are left with the iPad Ponzi scheme that is adding millions of smart TVs to households all over the world.

In the end we will gravitate to some form of smart thin client because it's so much easier for people to manage.
-Garry

Ask Mr. Kleynhans what type of device he was using when he wrote his statement.
-James

It's so irritating. Consider how long it's taken to 'get rid of' Windows.

You could OUTLAW PCs and they'd still be around in great proliferation in two years. Just like the incandescent bulb...

And all other numbers aside, I can't afford to buy the devices to support the cloud in two years -- let alone want to.

I hate the notebook/netbook keyboard, there's no tactile feedback on an iPad, I can't plug a RJ45 network jack into my iPhone. It doesn't sound like those devices are ready for prime time.

LONG LIVE THE DESKTOP! <heh>
-Vic

PC irrelevant, eh? OK, then my evening was just interrupted. I'm reading this thread on my iPad while sitting at my i7 desktop ripping audio from old vinyl. If the PC just became irrelevant then I won't be able to convert any more VHS tapes to DVD or continue developing several software projects I'm working on anymore. Cut the crap Gartner... The PC isn't going anywhere.
-Bruce

Share your thoughts with the editors of this newsletter! Write to [email protected]. Letters printed in this newsletter may be edited for length and clarity, and will be credited by first name only (we do NOT print last names or e-mail addresses).

Posted by Doug Barney on 03/26/2012 at 1:19 PM5 comments


Doug's Mailbag: Metro Hate

Here are some strongly opinionated thoughts on Microsoft's new Windows 8 interface:

I really want to like the metro interface but I see a lot of problems with it on the desktop. For a start, everything seems to have a big 10-foot interface -- OK, maybe not that bad, but not great for big monitors on a PC (fine for a tablet).

And this insistence on full-screen for everything... There's so many times where I need to have two or more windows up (I know there's the possibility of two, but it seems clunky). For example, just now I had a browser window open with a mathematical formula, a calculator open to calculate with that formula and a notepad to write the results. How will I do that on metro? Constantly flicking between them?
-Pete

I'm a retired computer consultant and have been using Windows since v. 3.1. But I stopped upgrading after XP and will switch completely to Linux after MS stops fixing XP bugs. These constant interface upgrades have all struck me as a complete waste of my time. Why MS didn't simply add new hooks in XP for new features is beyond me.
-Richard

Might as well bring back Microsoft Bob. The metro interface is for pure idiots
-TM   

Share your thoughts with the editors of this newsletter! Write to [email protected]. Letters printed in this newsletter may be edited for length and clarity, and will be credited by first name only (we do NOT print last names or e-mail addresses).

Posted by Doug Barney on 03/23/2012 at 1:19 PM2 comments


Verizon Says Most Attacks Are Our Fault

My headline may be overly dramatic, but Verizon did recently say that 97 percent of all attacks it studied could have been avoided if only we had done simple things to prevent them.

To a large degree, the company is right. Many attacks use social engineering or phishing, and we should have all long ago learned to not fall for these -- no matter how tempting it is to make millions of dollars from a total stranger.

And most malware isn't malicious until it is somehow downloaded, which means we must click on something we should never click on.

Again, we should all know better by now.

One of the most interesting findings is that most hackers are actually either activists trying to make a point (whatever happened to waving picket signs or getting yourself arrested?) or losers trying to prove their skills (of course, when you can just download and then spread malicious code, how much skill do you really need?).

How many attacks do you think could be prevented, and what are the simplest and most effective ways to block them? Send your best advice to [email protected].

Posted by Doug Barney on 03/23/2012 at 1:19 PM3 comments


Gartner Goes Out on a Cloud Limb

How does an analyst firm get attention? By making bold predictions and hoping we won't check back to see if they come true.

Gartner is the king of this game. It's made more predictions than Carnac the Magnificent! I remember when the company estimated that the cost of just managing a PC would take around $10,000 -- and this was back when $10,000 was real money!

Now the company claims that in two short years the PC will be essentially irrelevant.

What are these analysts doing, channeling Scott McNealy and Larry Ellison, circa 1990?

It said the personal cloud would make the PC about as necessary as fins on a donkey. All your apps and data would reside in the ether for you to retrieve through a phone, tablet and even that outdated  PC.

Here's the problem: You can set up pivot tables on a cell phone, and you can't write a 20-page proposal on a 10-inch tablet with a touch key pad. And all the hard core apps for hard core productivity run on either a PC or a Mac. Tablets, phones and even netbooks don't replace anything -- they just give you an extra option.

And what enterprise in their right mind would let data be stored in personal clouds and accessed by a willy nilly assortment of devices? One that doesn't mind going out our business, I reckon.

The PC is becoming less important, but news of its death has always been greatly exaggerated.

Should we do more to hold analysts' feet to the fire when their nonsensical predictions fall flat? Say what you will at [email protected].

Posted by Doug Barney on 03/23/2012 at 1:19 PM14 comments


Doug's Mailbag: A Windows 8 Future

Readers share some thoughts on what kind of devices will take over the traditional PC:

It would seem that there will be people who leave PCs (be they desktop or laptop) for tablets due to the simplicity of tablets. However, there will be people who stick with PCs, BUT IF AND ONLY IF Microsoft and its partners give them a reason to. 

One of the things that iPad and Android tablets are currently lacking is an open device driver environment that allows for plugging in third-party hardware devices (USB TV Tuners are but one example). Microsoft's (and its partners) challenge is to make sure they keep a steady stream of these types of devices that enable the PC to interact with hardware (via USB, Bluetooth, etc...) to do those things that tablets can't or won't do yet.

With respect to my next PC, I would expect it to be a mid-level laptop with a touch screen. Hopefully this gives me the best of all worlds where I can do touch if I want. It should also have an embedded GPS (so I can also use it in place of the tablet for Navigation/Location functionality), and still have a Physical keyboard and trackpad (mouse if I want it) to do the things that work better on a laptop.  Finally, I think Microsoft and manufacturers need to be able to supply the above for about $550 or so (not as cheap as a less-functional netbook, but not as expensive as an 'ultrabook' either). 

Combining the two (extra hardware device connectivity that tablets can't match as well as touch capability) should hopefully make the new PC a device that get's it all done, much as PCs have been doing since their early days. 

I will be waiting and watching to see if Microsoft and its partners can deliver. 

-Jeff

Alas, it is sad that when we get old, we get 'stuck in the quagmire of yesterday.' The demise of the desktop PC is already written. The eulogy will be warm, eloquent and full of historical relevance, but just that... a tribute. Not to stop there, the laptop, as we old ITs know it, is equally lifeless. Reading between the lines, Apple (leading the way, as usual) has already moved on; creating an operating system for its desktops that makes it look like an iPad (synonymous with tablet). Even Win 8 is tablet-ready with major touch screen capabilities. As for me, I await the implant. Then I will only have to think about it!
-Anonymous

Share your thoughts with the editors of this newsletter! Write to [email protected]. Letters printed in this newsletter may be edited for length and clarity, and will be credited by first name only (we do NOT print last names or e-mail addresses).

Posted by Doug Barney on 03/21/2012 at 1:19 PM3 comments


Possible Microsoft Partner Leak of RDP Exploit Code

Microsoft released a fix for Windows last week that took care of a Remote Desktop Protocol issue.

Two days later a proof-of-concept (POC) code hits online that could allow hackers to exploit this flaw for those who didn't yet apply the patch.  While hackers coming together quickly to release an attack vector doesn't seem out of the ordinary, what was hidden in the POC was: data from an executable code created by Microsoft and sent to its partners for antivirus update purposes.

Sounds like someone forwarded a Microsoft e-mail that they shouldn't have. That's what the original security researcher that discovered the flaw thinks. And so does Microsoft, who is following the clues to the source.

""Microsoft is actively investigating the disclosure of these details and will take the necessary actions to protect customers and ensure that confidential information we share is protected pursuant to our contracts and program requirements," said the company in a blog post.

The problem is that with the multiple partners and security software vendors who have had their hands on Microsoft's executable code, I honestly think that finding the source of the leak will be harder than completely curing Windows of all future remote code execution flaws.

I do have a feeling that security software company Symantec is crossing its fingers that the info didn't come from someone on its side. That company has already had its fill of bad PR concerning leaked code this year.  And it's only March. 
--By Chris Paoli

Posted by Chris Paoli on 03/21/2012 at 1:19 PM0 comments


Windows 8 Landing in October?

The question mark in the blog headline means that this news should be taken with a grain of salt. But, based on Microsoft's typical development cycle for a new OS, citing Bloomberg's mystery source on when we might see Windows 8 isn't that big of a gamble.

It's not even a gamble that we're jumping to the conclusion that Windows 8 will be out by Halloween based on the news from the shadowy figure that devices supporting the OS will be out by October.

That's because it all makes sense, and if Microsoft wants to make it in time for the kids to find wrapped copies of Windows 8 under the Christmas tree (worst present ever), it needs to have an October -- and at the latest, and early November -- launch window.

In fact, Gartner analyst Michel Gartenberg says that if Microsoft misses this window, then don't expect to see Windows 8 this year: "If they miss the September-October time frame, they're going to be stuck without being able to ship anything in 2012," Gartenberg told Bloomberg. "The last thing Microsoft wants to have is a situation where there are no compelling Windows tablets at a time when the new iPad looks like it's going to be a good seller for the holidays."

And that head-to-head battle between Microsoft and Apple is the real goal of getting Windows 8 out this year. Unlike previous versions, the new OS's radically different interface will either sink or swim with consumers -- it's not going to be losing or gaining much ground in the enterprise, a market it has a stranglehold over (and if Vista couldn't sink its dominance, Windows 8 won't either).

An actual Microsoft tablet device that consumers want to use is the goal, and Microsoft can't concede another holiday season to Apple. So while the boxed version of the OS won't be high on many gift-giving list, expect devices sporting the new OS to be there. 
--By Chris Paoli

Posted by Chris Paoli on 03/21/2012 at 1:19 PM2 comments


Subscribe on YouTube