home links tools blog about
home

February 05, 2008

Spot On

Mario Romano nails it:

Let's be clear about it: Google is not a social institution for the defense of civil rights - it is just another corporation, not unlike Microsoft and others.

Seriously. Anyone else sick of the obscene hypocrisy coming out of Google?

Me? I'm hoping that MS manages to pull of their 'buyout' of Yahoo. No, not to get back at Google, and no, not because it would make MS that much more powerful or blah blah blah. My motivation is much more ... sinister.

You see, what with MS being on the warpath with that nasty little thing called a Zune, my hope is that if they can persuade Yahoo to let them take over, that they'll keep Yahoo Unlimited up and running - instead of trying to hand-off those customers to Rhapsody. YU is really built around WMA, and things like 'the Zune'... so hopefully MS can 1) take over yahoo 2) be persuaded to keep it alive.

Which brings me to my real point, which is about why Yahoo is likely hurting so much anyhow. Because they apparently don't know how to make $$. Take me for instance, I'm hooked on Yahoo Unlimited. I'm seriously depressed about the possibility of life without it (I mean, I've got over 25k rated songs/albums/artists with that service - and oodles of playlists). But what's Yahoo up to? Oh, they're apparently going to shunt it over to Rhapsody, where I'll have to pay more for it.

Dear Yahoo: If YU is too expensive to run as is, and if I'm going to have to pay Rhapsody MORE to keep a music subscription, then just LET ME PAY YOU MORE. I don't mind (that much) paying more. I do mind, on the other hand, paying ANYTHING to something associated with Real Networks - to the point where I simply won't.

Posted on February 05, 2008 | | Comments (1) | TrackBack (0)

January 01, 2008

ASP.NET's MVC and the Threat of XSS

There's a great discussion going on over at Rob Conery's blog - where he's asking for feedback on how to handle encoding options to prevent XSS when using the new ASP.NET MVC. In my mind this is a BIG deal because of just how well traditional ASP.NET (that's weird to say) has handled the task of squelching XSS in the past. It's also a big deal because I really want the MVC to remain as absolutely 'clean' as possible - as in free from 'magic' and other "we're helping you" type of stuff that addresses 90% of use-cases but shoots experienced web developers in the foot on 'edge cases' surrounding standards support and the likes.

So, since Rob is asking for feedback, I thought I'd provide in the form of a blog post (where I can more easily whip-up my thoughts without having to fight inside of a textbox).

What shapes my thoughts/rationale:
Most people interested in using the MVC are going to be more advanced ASP.NET users (and real-life web developers) that are looking for two key things:
a) Greater control over emitted markup (while still being able to leverage the .NET Framework) and
b) Greater separation of data, presentation, and logic. In other words: less intermingling, and less coupling between those realms. Or, stated differently, less 'magic'.

It's also a no-brainer that MVCs are HIGHLY reliant upon convention (at least initially) - which means that co-opting security practices into the convention should be the best way to attack this issue.

My Preferences for handling XSS Encoding:
1) Leave the responsibility for encoding entirely up to developers. But make it part of the convention. And provide some decent syntax support that makes it logical and easy. In my mind this would allow the greatest degrees of control and separation - yet still make it possible to achieve good security. (Me, I want ALL THREE options (control, separation, and security) - one or two of the three just isn't good enough.)
2) A slightly less perfect approach would be to Encode everything on the way out - as long as there's a way for developers to turn that off (without too much hassle) in the few cases where they'll actually want to do so. That would be tolerable in my mind as it would let MS feel like they had done their best to protect dumber web developers from shooting themselves in the foot, but wouldn't make the rest of us pay too steep of a price. (I still maintain that any time you try to make something more fool-proof you sadly just end up creating better idiots.)
3) The worst option, in my mind, would be to encode on the way in. That quickly shoots clean separation out of the water, and assumes that you'll only ever be using your input data in another web application - which represents HORRIBLE coupling. I think everyone can see that - even if the argument could be made that you're potentially opening yourself up to a 2nd-Order attack by persisting XSS or SQL Injected code.

That said, I'm certainly LOVING the MVC. It's honestly one of the best things to happen to ASP.NET ever. (I get clean separation, complete markup control, and all the benefits of sitting on top of the ASP.NET and .NET framework - all in one tidy little package.) I also think that the learning curve it presents is significantly less than the jump from say Classic ASP to ASP.NET, but I also think that it will result in developers writing CONSIDERABLY less code to get well-functioning apps up and running. More importantly, I finally feel like Microsoft has addressed real-life web-developer needs with a flexible framework - instead of focusing so intently on creating tools for applications developers to make web applications. In other words, I 'feel' like the focus here is more on web sites than on intranet applications - which is VERY exciting to me as I spend most of my dev energy working on sites instead of clunky/massive/enterprise-y intranet applications. (Though, that said, intranet developers should rejoice as well - as the MVC should make their lives easier too if they're looking for standards-compliant markup and cleaner separation as well as a less-monolithic approach to application testing and maintenance.)

Posted on January 01, 2008 | | Comments (0) | TrackBack (0)

December 06, 2007

Identity Theft Roundup

Here's a lengthy article on the difficulty associated with trying to keep your SSN to yourself. I've sadly found that trying to prevent companies from 'requiring' it just takes too damn long - despite the fact that I know they legally can't 'demand' it.

And on the same note, here's a looksie at what can happen when your SSN and other financial info just gets CONFUSED with someone else's. There are also some more spooky statistics on what can happen when you become the victim of identity theft.

I had a run-in with this recently where a bill collector kept leaving automated messages on my home phone. I knew there was no way I had outstanding bills (I have excellent credit). Well, unless, of course, someone had hijacked my identity and opened a few accounts without me knowing. I finally called the company back, and the first thing they wanted was my SSN. I refused - no way I'm handing out my SSN to a 'company' that hits me with an automated message telling the to call and make sure that my credit rating isn't negatively impacted (it could have just been the phone-equivalent of a phishing scam).

2 or 3 hops later (from one operator to another - since I wouldn't give out my SSN) and I finally got someone who was smart enough to ask me what phone number had been called. They then asked if I was so and so - a name I recognized from having googled my phone number a few years ago - prior to google updating their records. I told them I was not the so and so in question and the company apologized profusely for treating me like a deadbeat... but like so many other things, this whole 'interaction' left me with a small taste of what it must be like to try and sort out your life after becoming a victim of identity theft.

Posted on December 06, 2007 | | Comments (3) | TrackBack (0)

December 05, 2007

Sams Publishing can Bite Me

I'm working through what looks to be a decent book from Sams Publishing: Microsoft SQL Server 2005 Analysis Services.

Only there's a sample database that they use throughout the book and in order to download it, it appears that I have to sign up for Safari - that obnoxious 'digital bookshelf' service that goes for $439/year.

Dear Idiots at Sams Publishing,

If I had wanted a digital copy of your book, I would have purchased it for $6 at Amazon when I bought this book. But since I've purchased the book, I'd like access to the sample code since you were too cheap to include a bleepin' CD.

You suck.

And no, I don't give a crap about the free 45-day trial membership of Safari that I get which lets me download the sample code (I assume) since
a) the instructions in the book no longer match the site,
b) Safari tells me I only get 10 days before they start charging my frickin' credit card and
c) I just don't want to sign up to some stupid service - I just want the sample code for my book.

Again, you suck. A lot.

--Mike

UPDATE: I should point out that the book itself points to a link and tells you to enter a coupon code - which will give you 45 days of free access to your book. Before writing up this nasty post, I went to the url listed in the book - but it just kept redirecting me to the safari site - where I was on my own and ran into the experiences listed above. That's what made me cranky. I'm _not_ hip on having to sign up for anything to get code for my book - but I'll tolerate it if it's less painful than writing up a nasty blog post ;) In my case, however, I just couldn't get access to the book - without divulging my Credit Card # and doing a full 'trial' sign-up.

ALMOST THERE UPDATE: After sending an email to Safari Publishing and Sams I got a response. Rather than just going to SamsPublishing.com which redirects to informit.com, they sent me to the following link: https://ssl.safaribooksonline.com/safarienabled - where I'm able to enter the code/coupon from the front of my book and add a few pieces of info (my name, email addy, and a password). But that still ended up being a pain - and after scouring the 'bookshelf' I still couldn't see any obvious links for downloads. So I gave up for a few minutes.

SOLUTION UPDATE: Happily, however, since I had spammed a handful of people/accounts listed on the informit.com site (with a link to this post, of course), I got another response from a publicist who provided me with a link and offered to send my 'feedback' to the appropriate folks in order to ensure future customer satisfaction. Happily the link that the publicist sent was EXACTLY what I was looking for:
http://www.informit.com/store/product.aspx?isbn=0672327821&rl=1
Note the Download Tab. Note too that there's no need to sign up, sign-in, or give-away one of my children. I guess I should have checked the 'store' functionality on the site early on - but I was too caught up in going to the URL that the book sent me to.
Oh well, problem solved - and I've got my sample code.

Posted on December 05, 2007 | | Comments (2) | TrackBack (0)

November 16, 2007

Dell Jumps the Shark

Hey Dell, here's an idea: empower your employees to actually give a crap about customers, start shipping your products ON TIME, and stop wasting money on recruiting celebrities:

Dell Enlists Celebrities to Beg for Customers

A few months ago I purchased a 20" 2007WFP monitor, a keyboard for an older laptop, and another keyboard for one of my other boxes. The laptop keyboard was from their refurb site, and so was the other keyboard (though it was brand new). The monitor shipped fine and on time. My keyboards just seemed to 'hang' in limbo. Then I got a cryptic email from (let's say) Laura at Dell. The email said that there had been a problem with my order, and I needed to call Dell's customer service.

100% sounded like a scam. Didn't even have dell logos or 'letter-head' in the email - just a 2 sentence email. But my stuff hadn't shipped, so even though this looked like a phishing email I decided to call. The people on the other end of the phone wanted to know my Social Security Number - without that they couldn't help me.

No way was I going to just dial a number I got in an email, and then fork over my SSN. (It's the perfect recipe for a phishing scam - just spam everyone with an email that there's a 'problem' with their order from Dell, and get anyone with a current Dell order to bite... )

What GALLS me is that this was REALLY, 100%, Dell. Not a phishing scam - just Dell's amazing customer service trying to 'help' me.

They had let the $300 monitor go through fine, but were forcing me through some sort of fraud protection on the $43 and $13 keyboards - to ensure that I was really me, and had really ordered the stuff in question. Gee guys, glad you've got my back on the $60 stuff...  

When I demanded to speak with a manager after being asked for my SSN (and refusing to give it) I was told that I could speak with a manager after giving them my SSN, and was actually hung up upon by 2 of their reps. I finally managed to squeeze another number I could call out of one of the reps - which was the actual Dell service #... and after 40 minutes of computerized menus and about 3 phone transfers I finally was able to get the story on how fraud prevention had intercepted the order....

But by this time the refurbed laptop keyboard was out of stock. Dell still wanted my $ at this point - did I want to apply that $$ to another purchase?

I told them to stuff their keyboards where the sun doesn't shine, and canceled the order.

But hey, Burt Reynolds, Ice-T, and other celebs think that Dell's a pretty cool gig. Maybe I should reconsider....

Posted on November 16, 2007 | | Comments (0) | TrackBack (0)

November 09, 2007

Dear IE 6 Users

Dear IE6 Users,

What the hell is wrong with you? Upgrade to IE 7 or FF already.

Sheesh.

Uh Gee Mike, what prompted the outburst?
55% of visitors to this site, for example, are using IE. 42% of those IE visitors are actually still using IE 6. My guess is that a lot of those users are many of my 'Google' visitors - i.e. random hits due to searches on Google.

In other words: I hate having to maintain CSS/HTML in IE6. If the % of my visitors using IE 6 dropped below 5% I'd just ignore them...

Posted on November 09, 2007 | | Comments (1) | TrackBack (0)

November 06, 2007

VMware Web Management and IIS7 on Windows Server 2008

As I pointed out in a previous post, I wasn't able to find any love on teh intarwebs about how to get the VMware Web Management Interface to work on Windows Longhorn Server/IIS7.

Then I remembered: One of the cool things about IIS7 on Windows Server 2008 is that it provides you with the ability to 'emulate' IIS6's metabase and scripting interfaces.

So, I just made sure to install those components using the

Having installed VMware Server already on Win2k8, I knew that it crashed and burned (unsurprisingly) while trying to create the web site that would be used to allow HTTP management (over ports 8222 and 8333) of VMs and such.

So I added the IIS 6 Management compatability components:

iis6compat

And then proceeded with the install normally.

And, that did it. By giving VMware Server a suitable set of scripting interfaces to manage IIS and create a new site, everything worked flawlessly. (Of course, I had to go into the firewall and open up traffic on 8222, and 8333 for HTTP and HTTPs (as well as for port 902 for authorization/normal VMware traffic).)

Running VMware Server on Windows Server 2008 RC0 - x64
Sadly, I couldn't get VMware server to run on the x64 version of RC0.

During the x32 installation, I got a prompt telling me that some unsigned drivers were detected - should I let them through? I let them on.

With the installation on x64 Windows Server 2008, there was no such warning/prompt. And I simply couldn't log into VMware's Web Interface or via the normal console - as I kept being told that the server "actively refused" the connection. Checking out all of the VMware services on my box, I could see that the Auth Service wasn't running. Starting it just resulted in errors. Happily in the Security Log I could see audit failures at roughly the same time:

Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

That's a spiffy error, and it also listed the file in question: vmx86.sys - the same file/component that the VMware Authentication service depended upon.

I tried supressing those warnings/issues by using bcdedit /SET nointegritychecks ON, but there was no love (even after a reboot).

So.. that's when I decided to bail and just switch to Windows Server 2008 Enterprise (to take advantage of my 8GB of RAM). Maybe by the time Longhorn RTMs there will be a good work-around, or someone else will figure out how to pull it off, but I wasted about 2 hours on it and decided that enough was enough...

Posted on November 06, 2007 | | Comments (0) | TrackBack (0)

November 05, 2007

Google-hosed?

We all know what a googlewhack is, and that they're increasingly hard to find.

But what happens when you turn to Google for an answer to a problem that you're working on (say... trying to get VMware's Web Management Interface to work in IIS7), and the third entry in the list of results is a link to your own site/blog?

Only, you know you don't have the answers - otherwise you wouldn't be looking on Google. Sadly, at that point, I think you're hosed. And you know it. Hence, googlehosed. Maybe the 'rule' for being googlehosed should be that you know you're google-hosed when you see one of your own entries/posts on the first page of results - especially if it's BEFORE you start scrolling?

Sadly, however, this happens to me more often than I would like. I just never expected it for something as simple as getting the VMware web admin portal working in IIS7...  

Posted on November 05, 2007 | | Comments (1) | TrackBack (0)

October 12, 2007

An Open Letter to teh Internets

Dear Internets (or more specifically: people making teh internets),

Please stop adding idiotic 'Beta' turdlets to your logos and sites. It might have been cool once. Now it's just lame. Especially when it stays there for years. Or when you're managing people's money (sign up to see the Beta turdlet on the logo - and to feel extra special about the security of your financial info on a 'beta' site).

Honestly, it's time to grow up. Take responsibility for your shoddy work and any bugs you may have. Just fix them if they exist, and move on. Stop pretending that any bugs that people might run into are a result of how incredibly hip your site is.

And besides, wasn't this whole web 2.0 'revolution' about getting away from monolithic development? Wasn't it a new expression and 'consciousness' of agility?

Nothing screams monolithic like a friggin' Beta moniker/turdlet.

So knock it off. You're making me cranky.

Love,

--Mikeey

Posted on October 12, 2007 | | Comments (0) | TrackBack (0)

October 02, 2007

Video Fears FUD

There's a great 'news' article that I've been seeing during news 'snacking' during the day. It's a spiffy little article that warns that "Online Videos May Be Conduits for Viruses".

Only it doesn't really list actual vulnerabilities - just that those naughty hackers would sure love to find a way to bundle their evil with people's insatiable appetite for YouTube videos.

Wow Captain Obvious, you don't say?!

Here are a couple of other 'news' stories that I'd like to see Captain Obvious (the Associated Press) and his side-kick Fud-Factor Boy work on:

- "College Students May Eyeball Armored Trucks and Wish They Could Get Hands on Some of That Money Without Going To Jail or Committing a Crime"
- "10 Mile-Wide Meteor May Hit Earth This October"  (hey, it COULD happen)
- "Journalists May Have to Get Real Jobs During Coming Depression"

Posted on October 02, 2007 | | Comments (0) | TrackBack (0)

« Previous | Next »