Posts by Brett Brennan

Patch Tuesday, then?

I suppose that the "fix" will be made available on Patch Tuesday next then? After all, this is far less of a problem than the MS Office vuln from Patch Tuesday prior...

Smells like "Open" spirit to me

\" Martin then outlined three principles he feels the creators of the manifesto needed to adopt.

He suggested that interoperability policies and required standards for cloud computing should be defined though public collaboration and scrutiny.

The process should be "vendor-dominated" with support from multiple providers, customers and other interested parties, said Martin.

He added that relevant standards would take time to "develop and coalesce as the cloud computing industry matures." "\

Hmmm, this sounds suspiciously like the arguments that led up to the adoption of OOXML by ISO last year: "public collaboration" via MS partner companies; "vendor dominated" via the same group of providers and customers; "develop and coalesce" long after the standards have been perverted and market dominance is once again assured.

The ONLY way MS will be able to get traction on this plea is to renounce ISO 29500 and adopt ODF once and for all. THEN they can start beating their chest about "closed standards".

Finally something worth while from Redmond

While not a big MS fanboi myself, this is (arguably) one of the first proactive things MS has done in a long time. Worthwhile or not (I don't know: I do no Windows work) it's a solid step in the right direction.

Good Bill! Nice Bill! Don't bite the hand with the nummy in it Bill!

"No one's going to pay $500 more for a logo"

Really?

How many iPhones are in use?

How many Macbook computers are in use?

How many Jaguars, Cadillacs, Lincolns, etc. are in use?

OK, maybe it's not the whole market, but it is the most PROFITABLE part.

Something Steve Jobs knows very well.

And Steve Balmer hasn't a clue...

Four notes on terrestrial radio

Terrestrial radio is pretty near death in the First World. Here in the American Colonies, we tried to switch over to digital ("HD radio") to invigorate the business and failed miserably.

So, four thoughts to temper the tempers.

(1) Most kidz today use their iPod for their personal "radio" mix. Artists are found via word of mouth or YouTube, and less via promo by the licensed broadcasters. Radio Disney may be the exception here, but their target is the over-pampered 5-11 demographic anyway.

(2) Here in the Colonies you can *literally* drive from coast to coast listening to the same programming. There are several U.S. wide network feeds like JACK, Radio Disney and The Wolf that are truly seamless from station to station. Again, because the revenue to support a radio station is GONE, the only way to run a station at all is by mass-producing a format and distributing it cheaply. Even so, it is doubtful that these networked stations will last out the decade - revenue is drying up faster every day. In fact, it's so bad that you can buy a secondary market station (non-top 10 markets) for as low as US$20k. That's assuming the market is big enough to support a station other than one of the networks.

(3) Ethnic radio is the *ONLY* growing segment of the broadcast market. A "survey" I do each time I reach a new city is to use the rental car's "scan" to listen to all the stations in the area for about half an hour. The "usual" mix on AM is roughly 30% Spanish language, 20% religious, 25% talk radio (mostly networked or local sports), 10% "other" Ethnic (ie, Hindi, Russian, Pakistani, Vietnamese) and the remainder "legacy" stations that are operated by a couple of people more as a hobby than as a business and/or news stations. FM is about 30% "networked" feeds, 20% talk radio, 20% religious, 10% Spanish language, 10% National Public Radio and the rest (ie, about 1 station) either Jazz, Classical or some other "local option" format. The growth is in the number of "other" ethnic stations on AM: at least one new language each time I return to a region. Even religious stations (the previous growth market) seem to be drifting away.

(4) Satellite radio is where many Americans are turning for broadcast sound if they don't have an iPod. Sports, wide music choices, alternative entertainment (comedy, drama, etc.) and "real" news (including BBC, CBC as well as the big US television news stations audio) make the US$10/month subscription fee appealing. Also, most autos come with either XM or Sirius as a pre-installed option (at least GM, Ford and Chrysler), making it easier to get into the subscription. Yes, I know XM-Sirius is in financial trouble, but of all the radio broadcasters it's got the best chance of surviving - because it offers customers a better choice than any of the terrestrial networks.

If you want to get more information on the state of radio in the U.S. I recommend Radio Business Report (www.rbr.com) (subscription) for a very detailed daily analysis of the radio and television broadcast industry.

Most people won't notice or care

The average PC user (and by PC I mean Windows, Mac, Linux, Unix, etc.) really WILL NOT notice or even care - unless SOMEONE makes a big deal about "fast" and they start checking.

In the "real world", I've found IE(5-6-7) to be similar in "speed" to FireFox or Opera. "Real world" is sitting at your desk in a large corporation bringing up internal web pages on your 1MHz Dell or Compaq cheapbox while running Word, PowerPoint and Excel along with all the other apps you need to get work done. Or at home, connected to the Internet via a 1.5Mbps DSL link, with all your Facebook, chat, Twitter, camera, music and video software pounding away.

Simple case in point: surfing the internet at my inlaws I was connected via a SLOW WiFi link while my sister-in-law was cable-connected. I have an OLD 1.4GHz laptop, she has a brand new MacBook Pro with a 2.4GHz dual-core processor. My pages loaded instantly, hers were taking MINUTES to load. However, she had 25 apps open, including music, Office, chat, mail, etc. and I had only the browser and email.

When I asked her why the Mac was so slow, her response was "It's not slow. This is the way it ALWAYS runs!" Oh, and all 25 apps are automatically started every time she powers up.

I rest my case.

So it's not "an integral part of the OS"...

This might end up being a really BIG bullet to the MS foot. Microsoft has been claiming for years that the browser is "an integral part of the OS" and therefore cannot be removed/replaced with another browser.

So their boffins go out and build a browser that is NOT part of the base OS - and lo and behold, it's more secure.

What a conundrum! You can have a secure browser, but not as part of the OS. Or you can include the browser core in the OS "build" and leave the whole system open to unlimited free hacking.

And it demonstrates that MS COULD build a browser that isn't integral to Windows.

Yeah, I know, I'm skipping over all the technical stuff, but isn't this really the message this sends to the press?

"We knew we could make a safe browser, but it shows that we've been intentionally making an insecure product for years, we've know about it, and if we admit it and start shipping a secure product we're going to be up to our gonads in lawsuits because we claimed we couldn't do this."

Left foot, right foot, BANG! BANG! BANG!

(pirate, because, well, it is.)

@all...

Thanks for the clarification. Being a Linux person I was {blissfully} unaware of the inclusion of Office H&S in LiveCare. However, several friends and family members (the part of my family tree that doesn't branch and similar friends) are still rooted in "needing" MS "products"...and I know my phone will start ringing if/when Office starts failing. Just like it did when TV stations started switching off yesterday...

IMPORTANT SAFETY TIP: never, NEVER let anyone know that you're smarter than they are.

(zips coat, jumps into MG and blows a cloud of Castrol and a year's worth of carbon credits disappearing into the sunset...)

How hard is it?

Linux distros generally include SEVERAL browsers: Konqueror, FireFox, Opera, Epiphany, etc. It would be ludicrously easy for Microsoft to simply include in the install package most or all of the browsers with over 1% market share - including IE - and, as part of the install, ask the user to pick one. To be fair, the display order should be randomized so that the first choice isn't ALWAYS IE, but what the hell, at least offer a choice.

Microsoft could also just as easily use a proprietary update application to provide downloads: Linux distros do this (my SuSE uses YAST to manage updates and add-ins). The update part is NOT the issue of integration. The real bottom line is that the browser is NOT included JUST to manage updates, or JUST to provide a convenient "hook" for displaying HTML.

No, the ONLY reason Microsoft includes and is FIGHTING to keep IE in the mix is to prevent competitors - like Mozilla or Opera - from being able to offer a product that COULD unseat their web SERVER market. IIS is still the predominant web server in major corporations, and as long as IIS provides non-standard HTML that only IE can render properly (or blocks the attempts of other web browsers to access or render pages - which happens regularly to me at several corporate sites when I attempt to log in to PAY MY BILLS!!) then MS has done its job.

Yes, I know that corporate IT can decide to use different technology - like Apache and Linux - instead of Windows. And, eventually, they might.

But...remember all those unpatched server that Conficker infected over the past month? All those old copies of Windows that have NOT been patched for YEARS? The reason is that companies are even cheaper than Freetards: those servers are probably still running Win2K and won't be updated - ever. And a BUNCH of those systems are running IIS, which won't be replaced - ever. And THAT's why MS is fighting all this browser-mania. If even 30% of the browsers out there quit working against the old MS systems still operating in most companies, then those companies will HAVE to upgrade them. And there's a high probability that they WON'T be replaced with Server 2008 or Windows 7 Enterprise...but with Linux running in a VM on a blade. And once MS loses the corporate server world...well, can they REALLY survive selling Zunes and Xboxes?

Ya know, come to think about it, this might be the BEST thing that happened to Microsoft! Think of it: Microsoft suddenly is getting its crap products tossed like week-old fish from businesses left and right. Maybe it'd kick their ass hard enough to make them start creating really GREAT products again - like back in the Windows 3 days, when their products really were breakthrough.

Or not.

(steps off of soap box, gets into MG and leaves)

Off on the wrong foot already

Microsoft can't afford another Vista debacle. No matter how good, secure, pretty, easy-to-use etc. Windows 7 ends up, the fact that EVERYBODY is looking for a mis-step in the release is really more important to address than the actual features.

In the case of this UAC "issue", all Microsoft's management needed to do was say "yes, well, you have a possible good point. We'll look into it and give a technical explanation of how we'll address it by the release date."

Microsoft has to realize by now (and the contrite response at the end of this report show that they DO GET IT) that one more release that has the problems Vista was perceived to have is going to cost them dearly - specifically on the corporate desktop and server. Companies have put up with having large IT staffs who mostly deal with Windows patches, security issues and user screw-ups. The issue for large corporations is that this is becoming the primary cost center for their IT department. Even outsourcing this job to India or China doesn't make it go away, and it doesn't really lower the cost of having systems "go down" for bug fixes and updates - which a problem or patch WILL do regularly in the real world.

IT department managers are already beginning to realize that their maintenance costs keep going UP not down, and each problem is more expensive than the last. Conficker opened a lot of eyes over the past couple of weeks: the cost of fixing this relatively simple attack has hit home, not because of the attack itself, but discovering that there are about 10-20% of corporate systems that could NOT be patched immediately because of expensive, custom "legacy" applications that need to be moved onto newer OS releases, at a huge rewrite cost. The IT directors are getting hammered for having the infection in their system, and they're getting hammered for needing to take down "core" applications to fix it. And their budgets are going up in smoke just patching the holes in the dike. Then they notice that their {*nix/mainframe/Apple} systems aren't getting hit the same way, that they have 1/5 the staff managing these platforms and the cost isn't bulging up every time a script kiddie discovers a new toy to play with.

Microsoft absolutely MUST be able to take the message to the world that their product is engineered safe and efficient, and that when the inevitable problem DOES occur that they can fix it quickly without impacting all the old legacy applications running the businesses that buy their product. And it ain't going to require opening another support center ANYWHERE just to have the asses and elbows to rush around 1000 systems and slap patches.

Redmond's got about six months to get this message done and done right. If Windows 7 has ANY issues even CLOSE to Vista, it'll be "hasta la vista" to Microsoft in the corporate environment within 18 months, and probably in the consumer market just as quickly.

We'll see how they react.

Why not one base package...

...and sell "upgrade" packages to add the features needed for the other functions? That way EVERYBODY gets the Home Basic/Starter edition, and OEMs and other folks can add away to their heart's (and wallet's) content.

Oh, wait. That's too much like a Linux "distro". Wouldn't want THAT to blemish Window's clear, easy to follow functionality ladder. Like Vista Home: you're offered the opportunity to "upgrade" your "experience" via the internet - IF your ISP doesn't cut off the 5GB download half-way through...

Nothing to see here, folks. Move along.

The Yank Scum part...

...was the best. If I'm not mistaken, Andrew is not a Colonial at all...so this should be

YOU BLAIR LOVING CRICHTON READING MUDERING EVIL LIMEY SCUM!!!

There! Done my part for the editorial desk! Now to buy tickets to my place on Eluthera just a couple of miles from the Pink Sand and down some frosties made with real rum...

Great idea for your parents...

I was at the Sprint store the other day, explaining to the staff (they always love it when I come in - I answer all the questions that their tech support can't) how femtocell technology works with the new little broadband-cellular bridge. It's a nice concept, and has immediate application for those folks that can't use their cell phone at home. Like my parents who live in an RF hole up in north Texas.

Mr. Ray is right, however: without a solid roll-out in commercial areas - like at the Mall, major office buildings and apartment complexes, most of which are RF holes, this is at best a PR gimmick. Unless you have enough radio background to understand when to use this technology, it's an expensive toy that is probably not needed - nay, is counter-productive.

Worse yet, here in the American Colonies only about half of the public Wi-Fi is "open". Most of the places you'd have your iPhone or Wi-Fi Blackberry connecting to 802.11 still charge a pretty penny for connections (mostly hotels, airports and convention centers), making the "seamless" switch impossible. And, of course, at home you stand a better chance of connecting to a neighbor's Wi-Fi than your own - especially if you keep high security on your bridge and they don't. Furthermore, at most high-density living locations (blocks of flats with hundreds of thousands of residents) there is so much channel interference that Wi-Fi is rendered almost useless. (My parents have an off-channel (1) connection for one machine: the rest are hard-wired to the router anyway.)

With luck we'll see some intelligent deployment of femtocell technology over the coming year...but I doubt it...

{sigh!} Back to using the Minox then...

Disco the speaker, wear the Bluetooth headset...done.

I apologize for the stupidity of our Colonial Government for even letting this see the light of day. On the other hand, England's total attack on photogs seems to be an even more mean-spirited (and violent) attempt to get to the "root cause" of the issue...

Makes one proud to be human, eh?

The damage may already be done

One of the primary reasons that corporations don't install updates or patches is that "business critical" applications - specifically high-dollar custom applications that are core to the business operations - often stop functioning when a new patch is introduced. Until Conficker arrived, the business had two choices: leave the systems unpatched and hope that their firewalls protected the systems, or purchase/develop a rewrite of the application(s) that were impacted by the patch/updates.

Post-Conficker, the only option is to rewrite the applications so that zero-day patching can be maintained.

And here's the bad news: the impact of this necessity for most major businesses (in the Fortune 100, ALL that I have visited have multiple applications that fit this profile) is a development effort that is possibly bigger than Y2K. Certainly the effort is now more pressing: zero-day patches that take down key applications are certainly more time sensitive than the 2 year run-up to Y2K.

So, the "damage" may well and truly already be done. The business impact on those companies that will rewrite their code is potentially huge. And the impact to those that do NOT rewrite their applications is certainly going to be devastating.

Probably tied to the cost of capital

You've got to admit that Tesla is pretty ballsy - launching a new car in the midst of a depression. And while this pricing "upgrade" may seem like cruel and unusual punishment for their early customers, it most likely reflects the reality of needing to post an early cash flow success in order to be able to go to credit markets for on-going financing. After all, if the banks aren't prepared to lend to GM, Ford or Chrysler (or Toyota, Nissan and Honda for that matter) why should they consider Tesla to be a good risk?

The brilliance in Tesla's move is that it has kept the price "revenue neutral" for its customers. Yes, they "lose" the US$7500 tax credit, but the net-net is pretty much a zero impact. And, as Steve notes in the first post, being able to build and inventory parts is as much a part of the game as selling the car.

Let's hope that Musk keeps his snoot out of the Marching Powder...unlike some other car entrepreneurs we can name...

What about Scaled Composite's stuff?

The boffins at Mohave have been using a throttled solid propulsion system all along. I wonder if the MIL SPEC folks are just avoiding this concept because it would make them look bad - they didn't think of it first, eh?

It could be a good thing...

You know, adding a simple "ON-OFF" to the feature and a short menu of topics (like "restaurants", "gas stations", "malls", "car features", etc.) would turn this from a useful but intrusive feature into a "must have". My cell phone comes with a navigation feature that lets me find "things" based on location: I find this to be the second most useful application on the phone (after voice calls, ahead of SMS).

This could be a win-win for Toyota: the revenue stream from providing product placement for advertisers could be enhanced by improved targeting (you get to charge a whole lot more for adverts that actually generate a sale than the usual AM radio kind of "spam") and you convert an (annoyed) customer into a sales force with the "Hey, Bubba, watch this!" effect.

Someday someone will figure out this simple formula to use location-based services effectively. Until then we'll have to put up with sorting one more set of voice mails each morning before we have had our coffee...

Didn't Tom Clancey already cover this?

In "Rainbow Six", I believe.

In my poor opinion, this would actually be pretty straight-forward. Assume that you're getting an emergency call BEFORE you shut everything down: you will then have a good geoloc for the incident already. Tapping into the cellular switches gives you a quick picture of what devices are close to the towers covering the terrorist site: you can then proceed to cut inbound service to those areas and simultaneously start back-tracking the calls that were underway and the ownership records for the devices detected. New calls out can be quickly sorted as to destination (hmm, that guy is calling an unlisted number in the hills of Afghanistan...suspicious?).

Even easier: shut down inbound to all PAYG devices immediately, as those are most likely to be used by terrorists (as well as poor schmucks without credit, but you can't have it all...). The devices with recorded ownership can then be sorted and any attempted calls from them to "unusual" numbers (like three or four people suddenly start calling Afghanistan that have never called further than the Bronx) can be quickly located and handled.

High-voltage charging in the USA

Lest we forget, nearly all stand-alone homes (the majority of places with a vehicle garage) come standard with 240V mains connections. Typically these are already in use to power appliances like electric stoves, water heaters, heating and air conditioning. It is fairly trivial to have a 240V line run to the garage (if it isn't already there to power an electric clothes dryer) to provide a charging station for an electric auto.

A 1-liter engine? Crikey, this is sounding more like my MG every day! Speaking of which, I wonder if Cherry Motors will offer a 'leccy version of the MG-TF when they start production at their Oklahoma factory? After all, 62 miles is about the cruising range of an MG - before one of the Lucas parts breaks down and requires a field rebuild in order to return home...

Barkeep, hand me my coat and a warm pint out of the Lucas reefer there, won't ya now...

ExFil - Tom Clancy already did this...

In "Debt of Honor", the SpecFor was dropped off by helicopter, but left Japan as a Brazilian soccer team. By bus. Hell, we could cover them as Canadians, eh?

When cars come with a EULA...

I've been expecting this to occur before long: every major consumer product starts requiring acceptance of a EULA before you can start using it.

After all, cars contain "intellectual property" that you technically "license" the use of when purchasing the "package" it comes in.

So put your future cap on. Envision the day that your car MUST connect to the Internet every day to insure that the "Genuine Ford Experience" software is up to date, or it won't start.

The EULA states that opening the bonnet (ie, "reverse engineering") is a violation of the license, and will cause the vehicle to immediately freeze, requiring the purchase of a new "license" (vehicle).

I could go on. However, bear in mind: these EXACT ideas ARE being mooted about in Detroit, Stuttgart, Tokyo, et.al. ; more precisely, the EXTENT to which these licenses can be mandated and enforced is being rigorously explored by auto makers world-wide. Not just "voids the warranty", but "seizure of licensed property and imposition of infringement fines" are under legal discussion.

The precedent is already there: failure to use a licensed HDMI cable to connect your DVD to your TV is a DMCA and patent violation (read the fine print) - the bulk of the cost for an HDMI cable is the license fee paid to the patent holders.

So be very, VERY careful about what you wish for. You could have it in spades all too quickly.

(As a bootnote: it is a widely studied grad school case study that Apple lost domination to Microsoft in the 1990s precisely BECAUSE of these same restrictions. And review the history of Windows vs. OS/2 for a case study of what happens when you DON'T enforce IP licensing...)

The Bottom Line

This applies equally to the MBTA, the California tollway providers, the Dutch transportation authority, the Oyster Card folks, et.al.:

The blame can ONLY be placed on the companies and governments that OPERATE these transport systems that are using the flawed security measures. The failure of these companies and government agencies to constantly review the security of their systems AND PLAN FOR UPGRADES TO DEAL WITH THESE THREATS AS THEY OCCUR is an egregious management error that MUST be addressed by their stockholders/governments.

Companies like NXP semi are really NOT to blame, especially if they can show that they were actively attempting to upsell their clients to newer technology when the old systems became vulnerable. On the other hand, if they were assuring their customers that the Mifare Classic was still secure, then they ALSO need to be part of the guilty crowd.

I fully expect the outcome of all this publicity to be criminal suits filed by government law enforcement agencies against the managers of the failed agencies and their vendors - for completely failing to do their jobs. And another round of fare hikes and taxes to pay for complete overhauls of the transport systems that are affected.

Finally, an example. If a bank were to build a vault with a screen door and pronounce it "secure" because no one had broken into it yet, the management would be behind bars in a heartbeat - or at least fired and fined. The actions of these agencies and companies is the equivalent of the screen door on a bank vault.

@Mark Hahn

Of course you're correct: a bit of skull-sweat with our think-caps on and this can be done.

The problem is that most data centre managers these days are looking for a "turn-key" solution from a single source, as it's less work for them and easier to focus blame. IBM has 70+ years making money from being a "blame magnet" for management teams ("It's not my fault, IBM said to do it!") by delivering these type of "turn-key" solutions.

Remember, your average corporate Director or Vice-President level executive has about the same technical savvy as Paris Hilton - not too different than the BOfH's manager. Submitting a request to the Budget Committee to "...triple Data Centre capacity without buying a new building - $15M..." makes them a Hero both for saving on real-estate AND keeping the request to a single line-item.

All in all, however, IBM does a pretty decent job of delivering what they promise. You can certainly do much worse than buying an IBM installation.

Paris, because she can get a job as Director of Data Centre Operations at most companies...