Category Archives: microsoft

apple, microsoft, sony

A tale of two stores, and a go with PlayStation Move

2 Comments

I had some free time following the NVIDIA GPU Technology conference and wandered up to the Valley Fair mall in San Jose. I took a quick look at the Apple store, there was really nothing for me to see in terms of new product but it has a kind of "bees round a honeypot" appeal.

image

Next I went along to the Sony Style store, another strong brand you might think:

image

Clearly this is a social story as well as a technical story but it is significant.

The Sony store was actually more interesting to me since the PlayStation 3 Move was on display and I had not had an opportunity to try it before. A helpful assistant gave me a demo; we were going to play 2-player table tennis but there was a technical issue with one of the controllers so I ended up playing solo. In conjunction with the huge screen in the Sony store it was a very passable imitation of the real thing. Although it is well done it does not feel like a revolution in the way the Wii did when it first appeared – you may recall that the pre-release Wii was code-named "Revolution".

Adding Move to your PS3 setup is somewhat expensive – you will probably want two controllers as well as the Eye camera – and there are not yet many games which support it, but I reckon it will be a lot of fun. Playing Table Tennis one of the best aspects was the ability to rush forward for a forehand slam.

The Sony guy admitted to being curious about the Microsoft Xbox Kinect which is coming out in a couple of months, and does away with the controller completely. He said Microsoft is opening a store in San Francisco and plans to go up to take a look in due course.

A question: which of the above two pictures will the new Microsoft store most resemble?

microsoft, professional, Web

Crisis for ASP.Net – how serious is the Padding Oracle attack?

6 Comments

Security vulnerabilities are reported constantly, but some have more impact than others. The one that came into prominence last weekend (though it had actually been revealed several months ago) strikes me as potentially high impact. Colourfully named the Padding Oracle attack, it was explained and demonstrated at the ekoparty security conference. In particular, the researchers showed how it can be used to compromise ASP.NET applications:

The most significant new discovery is an universal Padding Oracle affecting every ASP.NET web application. In short, you can decrypt cookies, view states, form authentication tickets, membership password, user data, and anything else encrypted using the framework’s API! … The impact of the attack depends on the applications installed on the server, from information disclosure to total system compromise.

This is alarming simply because of the huge number of ASP.NET applications out there. It is not only a popular framework for custom applications, but is also used by Microsoft for its own applications. If you have a SharePoint site, for example, or use Outlook Web Access, then you are running an ASP.NET application.

The report was taken seriously by Microsoft, keeping VP Scott Guthrie and his team up all night, eventually coming up with a security advisory and a workaround posted to his blog. It does not make comfortable reading, confirming that pretty much every ASP.NET installation is vulnerable. A further post confirms that SharePoint sites are affected.

It does not help that the precise way the attack works is hard to understand. It is a cryptographic attack that lets the attacker decrypt data encrypted by the server. One of the consequences, thanks to what looks like another weakness in ASP.NET, is that the attacker can then download any file on the web server, including web.config, a file which may contain security-critical data such as database connection strings with passwords, or even the credentials of a user in Active Directory. The researchers demonstrate in a YouTube video how to crack a site running the DotNetNuke content management application, gaining full administrative rights to the application and eventually a login to the server itself.

Guthrie acknowledges that the problem can only be fixed by patching ASP.NET itself. Microsoft is working on this; in the meantime his suggested workaround is to configure ASP.NET to return the same error page regardless of what the underlying error really is. The reason for this is that the vulnerability involves inspecting the error returned by ASP.NET when you submit a corrupt cookie or viewstate data.

The most conscientious ASP.NET administrators will have followed Guthrie’s recommendations, and will be hoping that they are sufficient; it is not completely clear to me whether it is. One of the things that makes me think “hmmm” is that a more sophisticated workaround, involving random time delays before an error is returned, is proposed for later versions of ASP.NET that support it. What does that suggest about the efficacy of the simpler workaround, which is a static error page?

The speed with which the ASP.NET team came up with the workaround is impressive; but it is a workaround and not a fix. It leaves me wondering what proportion of ASP.NET sites exposed to the public internet will have implemented the workaround or do so before attacks are widespread?

A characteristic of the attack is that the web server receives thousands of requests which trigger cryptographic errors. Rather than attempting to fix up ASP.NET and every instance of web.config on a server, a more robust approach might be to monitor the requests and block IP numbers that are triggering repeated errors of this kind.

More generally, what should you do if you run a security-critical web application and a flaw of this magnitude is reported? Applying recommended workarounds is one possibility, but frankly I wonder if they should simply be taken offline until more is known about how to protect against it.

One thing about which I have no idea is the extent to which hackers are already trying this attack against likely targets such as ecommerce and banking sites. Of course in principle virtually any site is an attractive target, because of the value of compromised web servers for serving spam and malware.

If you run Windows servers and have not yet investigated, I recommend that you follow the links, read the discussions on Scott Guthrie’s blog, and at least implement the suggested actions.

adobe, flash, microsoft, silverlight, software development

RunRev renames product to LiveCode, supports iPad and iPhone but not Windows Phone 7

3 Comments

Runtime Revolution has renamed its software development IDE and runtime to LiveCode, which it says is a “modern descendent of natural-language technologies such as Apple’s HyperCard.” The emphasis is on easy and rapid development using visual development supplemented with script.

It is now a cross-platform development platform that targets Windows, Mac and Linux. Android is promised soon, there is a pre-release for Windows Mobile, and a new pre-release targets Apple’s iOS for iPad and iPhone.

LiveCode primarily creates standalone applications, but there is also a plug-in for hosting applets in the browser, though this option will not be available for iOS.

Now that Apple has lifted its restrictions on cross-platform development for iOS, it is Microsoft’s Windows Phone 7 that looks more of a closed device. The problem here is that Microsoft does not permit native code on Windows Phone 7, a restriction which also prohibits alternative runtimes such as LiveCode. You have to code applications in Silverlight or XNA. However, Adobe is getting a special pass for Flash, though it will not be ready in time for the first release of Windows Phone 7.

If Windows Phone 7 is popular, I imagine other companies will be asking for special passes. The ubiquity of Flash is one factor holding back Silverlight adoption, so in some ways it is surprising that Microsoft gives it favoured treatment, though it makes a nice selling point versus Apple’s iPhone.

database, microsoft, open source, oracle

Why Oracle is immoveable in the Enterprise

At Oracle OpenWorld yesterday I spoke to an attendee from a global enterprise. His company is a big IBM customer and would like to standardise on DB2. To some extent it does, but there is still around 30% Oracle and significant usage of Microsoft SQL Server. Why three database platforms when they would prefer to settle on one? Applications, which in many cases are only certified for a specific database manager.

I was at MySQL Sunday earlier in the day, and asked whether he had any interest in Oracle’s open source database product. As you would expect, he said it was enough trouble maintaining three different systems; the last thing he wanted was a fourth.

intel, internet, media, microsoft, multimedia, open source, Web, windows

If Microsoft is serious about Silverlight, it needs to do Linux

9 Comments

Today was a significant event for the UK broadcasting industry: the announcement of YouView, formerly called Project Canvas, which is backed by partners including the BBC, ITV, Channel 4, Channel 5, and BT. It will provide broadcasts over IP, received by a set top box, include a catch-up service, and be capable of interactive features that hook into internet services.

Interesting stuff, though it may end up battling with Google TV. But what are the implications for media streaming services and media players? One is that they will have to run on Linux, which is the official operating system for Project Canvas. Google TV, for that matter, will run Android.

If you look at the YouView specifications, you’ll find that although the operating system is specified, the application player area is more open:

Application Player executables and libraries will be provided by 3rd party software vendors.

What is an application player?

Runtime environment for the execution of applications. Examples are Flash player, MHEG engine, W3C browser

I’d suggest that Adobe will do well out of YouView. Microsoft, on the other hand, will not be able to play in this space unless it delivers Silverlight for Linux, Android, and other open platforms.

Microsoft has a curious history of cross-platform Silverlight announcements. Early on it announced that Moonlight was the official Linux player, though in practice support for Moonlight has been half-hearted. Then when Intel announced the Atom Developer Program  (now AppUp) in September 2009, Microsoft stated that it would provide its own build of Silverlight for Linux, or rather, than Intel would build it with Microsoft’s code. Microsoft’s Brian Goldfarb told me that Microsoft and Intel would work together on bringing Silverlight to devices, while Moonlight would be the choice for desktop Linux.

Since then, the silence has been deafening. I’ve enquired about progress with both Intel and Microsoft, but vague rumours aside, no news. Silverlight is still listed as a future runtime for AppUp:

Microsoft® Silverlight™(future)

Silverlight is a cross-browser, cross-platform and cross-device browser plug-in that helps companies design, develop and deliver applications and experiences on the Web.

In the meantime, Adobe has gone ahead with its AIR runtime, and even if Silverlight eventually appears, has established an early presence on Intel’s netbook platform.

There have been recent rumours about internal battles between the Windows and Developer divisions at Microsoft, and I cannot help wondering if this is another symptom, with the Windows folk fighting against cross-platform Silverlight on the grounds that it could damage the Windows lock-in, while the Developer team tries to make Silverlight the ubiquitous runtime that it needs to be in order to succeed.

From my perspective, the answer is simple. Suppressing Silverlight will do nothing to safeguard Windows, whereas making it truly cross-platform could drive adoption of Microsoft’s server and cloud platform. When Silverlight was launched, just doing Windows and Mac was almost enough, but today the world looks different. If Microsoft is serious about WPF Everywhere, Linux and Android (which is Linux based) support is a necessity.

internet, microsoft, software

Microsoft Internet Explorer 9 beta is out

2 Comments

Head over to http://www.beautyoftheweb.com/ and you can download the beta of Internet Explorer 9, which is now up and running on my Windows 7 64-bit machine and looking good so far.

So what’s new? In terms of the rendering engine, this is like the last Platform Preview, but a little bit further along. During the briefing, we looked at at the experimental (and impressive) site put together by EMC, which shows 3D rotation of a motor vehicle along with other effects, put together entirely in HTML 5. At the time I only had the fourth platform preview installed, and the site did not work. Amusingly, I was advised to use Google Chrome, which worked fine. Now that I’ve installed the beta, the same site works in IE9, rather more smoothly than in Chrome.

What’s really new though is the user interface. The two things that jump out are the adoption of a single box for search and URL entry – many users do not understand the difference anyway – and the ability to drag tabs to the taskbar to pin them there like application shortcuts. Once pinned, they support Windows 7 Jump Lists, even when the site is not active:

image

If you squint at this screenshot, you’ll notice that the Discovery site, which is tweaked to use this feature, has a good-looking icon as well as a Jump List, whereas the icons adjacent to it look bad. That’s because you need to create a new large favicon to support this feature, as well as optionally adding metadata to create the Jump List. None of this is any use, of course, if you use Vista; and if you use XP you cannot even install IE9.

There’s also a download manager at last.

There’s no doubt that IE9 is miles better than IE8. Is it better than rivals like Chrome, from which a casual observer might think it has drawn inspiration? Too soon to say; but using the official native browser does have advantages, like integration with Windows Update as well integration with the OS.

That said, I’m not personally a big fan of the single box approach, and I’ll miss the permanent menus. If you press the Alt key the old File, Edit View etc magically appear, but I can’t see any way to make it persist.

.net, adobe, flash, iphone, java, microsoft, mobile, software development, visual studio, web authoring

Latest job stats on technology adoption – Flash, Silverlight, iPhone, Android, C#, Java

13 Comments

It is all very well expressing opinions on which technologies are hot and which are struggling, but what is happening in the real world? It is hard to get an accurate picture – surveys tend to have sampling biases of one kind or another, and vendors rarely release sales figures. I’ve never been happy with the TIOBE approach, counting mentions on the Internet; it is a measure of what is discussed, not what is used.

Another approach is to look at job vacancies. This is not ideal either; the number of vacancies might not be proportionate to the numbers in work, keyword searches are arbitrary and can include false positives and omit relevant ads that happen not to mention the keywords. Still, it is a real-world metric and worth inspecting along with the others. The following table shows figures as of today at indeed.com (for the US) and itjobswatch (for the UK), both of which make it easy to get stats.

Update – for the UK I’ve added both permanent and contract jobs from itjobswatch. I’ve also added C, C++, Python and F#, (which hardly registers). For C I searched Indeed.com for “C programming”.

  Indeed.com (US) itjobswatch (UK permanent) itjobswatch (UK contract)
Java 97,890 17,844 6,919
Flash 52,616 2,288 723
C++ 48,816 8,440 2470
C# 46,708 18,345 5.674
Visual Basic 35,412 3,332 1,061
C 27,195 7,225 3,137
ASP.NET 25,613 10,353 2,628
Python 17,256 1,970 520
Ruby 9,757 968 157
iPhone 7,067 783 335
Silverlight 5,026 2,162 524
Android 4,755 585 164
WPF 4,441 3,088 857
Adobe Flex 2,920 1,143 579
Azure 892 76 5
F# 36 66 1

A few quick comments. First, don’t take the figures too seriously – it’s a quick snapshot of a couple of job sites and there could be all sorts of reasons why the figures are skewed.

Second, there are some surprising differences between the two sites in some cases, particularly for Flash – this may be because indeed.com covers design jobs but itjobswatch not really. The difference for Ruby surprises me, but it is a common word and may be over-stated at Indeed.com.

Third, I noticed that of 892 Azure jobs at Indeed.com, 442 of the vacancies are in Redmond.

Fourth, I struggled to search for Flex at Indeed.com. A search for Flex on its own pulls in plenty of jobs that have nothing to do with Adobe, while narrowing with a second word understates the figure.

The language stats probably mean more than the technology stats. There are plenty of ads that mention C# but don’t regard it as necessary to state “ASP.NET” or “WPF” – but that C# code must be running somewhere.

Conclusions? Well, Java is not dead. Silverlight is not unseating Flash, though it is on the map. iPhone and Android have come from nowhere to become significant platforms, especially in the USA. Beyond that I’m not sure, though I’ll aim to repeat the exercise in six months and see how it changes.

If you have better stats, let me know or comment below.

.net, adobe, microsoft, professional, silverlight, software development, web authoring

Microsoft’s Scott Guthrie: We have 200+ engineers working on Silverlight and WPF

6 Comments

Microsoft is countering rumours that WPF (Windows Presentation Foundation) or Silverlight, a cross-platform browser plug-in based on the same XAML markup language and .NET programming combination as WPF, are under any sort of threat from HTML 5.0.

We have 200+ engineers right now working on upcoming releases of SL and WPF – which is a heck of a lot.

says Corporate VP .NET Developer Platform Scott Guthrie in a Twitter post. Other comments include this one:

We are investing heavily in Silverlight and WPF

and this one:

We just shipped Silverlight for Windows Phone 7 last week, and WPF Ribbon about 30 days ago: http://bit.ly/aB6e6X

In addition, Microsoft has been showing off IIS Media Services 4.0 at the International Broadcasting Conference, which uses Silverlight as the multimedia client:

Key new features include sub-two-second low-latency streaming, transmuxing between H.264 file formats and integrated transcoding through Microsoft Expression Encoder 4. Microsoft will also show technology demonstrations of Silverlight Enhanced Movies, surround sound in Silverlight and live 3-D 1080p Internet broadcasting using IIS Smooth Streaming and Silverlight technologies.

No problem then? Well, Silverlight is great work from Microsoft, powerful, flexible, and surprisingly small and lightweight for what it can do. Combined with ASP.NET or Windows Azure it forms part of an excellent cloud-to-client .NET platform. Rumours of internal wrangling aside, the biggest issue is that Microsoft seems reluctant to grasp its cross-platform potential, leaving it as a Windows and desktop Mac solution just at the time when iPhone, iPad and Android devices are exploding in popularity. 

I will be interested to see if Microsoft announces Silverlight for Android this autumn, and if it does, how long it will take to deliver. The company could also give more visibility to its work on Silverlight for Symbian – maybe this will come more into the spotlight following the appointment of Stephen Elop, formerly of Microsoft, as Nokia CEO.

Apple is another matter. A neat solution I’ve seen proposed a few times is to create a Silverlight-to-JavaScript compiler along the lines of GWT (Google Web Toolkit) which converts Java to JavaScript. Of course it would also need to convert XAML layout to SVG. Incidentally, this could also be an interesting option for Adobe Flash applications.

As for WPF, I would be surprised if Microsoft is giving it anything like the attention being devoted to Silverlight, unless the Windows team has decided to embrace it within the OS itself. That said, WPF is already a mature framework. WPF will not go away, but I can readily believe that its future progress will be slow.

internet, microsoft

Microsoft Vine formally withered

Remember Microsoft Vine? It was a well-meaning but puzzling product intended to assist communication in emergencies, but with additional potential for social communication. To nobody’s surprise, Microsoft has emailed beta testers to inform that that the project is to be discontinued:

The decision to discontinue future development of Microsoft Vine was not easily made. Multiple options were thoroughly explored and evaluated with rigor and in the end it was determined that Microsoft Vine is not sustainable as a standalone offering.

image

If there is a need for something like Vine in disasters and emergencies, it could only work as a cross-industry, cross-platform initiative. On the other hand, if Microsoft had in mind new ways to exchange local information, maybe enhancing Live Messenger would have been a better idea. One of the snags with Vine is that for it to be useful in an emergency, users would have to be signed up beforehand, but many of us are too busy on Facebook, Twitter or Messenger to think about it.

.net, microsoft, silverlight, software development, visual studio

More on Microsoft’s difficult choices: WPF, Silverlight, HTML 5

8 Comments

Earlier today I posted a story speculating about the future direction of Microsoft’s development platform, which has proved controversial and to some extent has been misunderstood. Although it is speculative, the issues are important since developers want to target platforms with a strong future. Here’s another take on why Microsoft, whichever way it decides to go, faces some difficult choices.

First, let me be clear: I don’t see Microsoft abandoning Windows Presentation Foundation let alone Silverlight. Microsoft has an good track record when it comes to continuing support for its technologies, better than competing platforms. Visual Basic 6 applications mostly still run today on Windows 7, perhaps with a few issues caused by User Account Control for which there are workarounds. Whatever you target, there is an excellent chance Microsoft will continue to support it long into the future. The main exception I can think of is Windows Mobile, which is incompatible with the new Windows Phone 7 series, but given the challenges Microsoft faces in mobile you can understand the decision.

Nor is there any chance of Microsoft reviving old frameworks. There will not be a return to Windows Forms. WPF is a better GUI framework in every way, other than performance on older systems – though note that Windows Forms applications still run fine today, and I imagine will run fine on Windows 8 and probably 9 as well.

The real question is not about support, but future investment. Microsoft has finite resources. It is in overdrive right now on Internet Explorer, on Silverlight, on Windows Phone 7, and on Azure, for example. There will be other products and technologies that receive less attention, because someone has decided they are not strategic.

It also seems to me that Microsoft’s server and cloud story is less conflicted. From the developer’s perspective it is thoroughly .NET based, and you can be confident that technologies like C#, IIS, ASP.NET, SQL Server, Exchange and SharePoint will be around for the foreseeable future.

With that out of the way, a few further comments.

Windows Presentation Foundation

The history of WPF goes back to the early days of Windows Vista, then called Longhorn. WPF was one of the the “three pillars”, Avalon, where the others were Indigo (WCF) and WinFS. Avalon was the future of the Windows GUI API, based on .NET code and XAML layout.

If Longhorn has proceeded as planned, WPF would be the loose equivalent of Cocoa on Apple’s OS X, the standard way to code Windows GUI applications. Unfortunately, in 2004, Microsoft discovered that Longhorn was heading for disaster. The project was reset, delaying release and resulting in Vista being both late and rushed. The reset project included Avalon as a supported framework, but made it incidental to the workings of Windows itself. The Windows team, in other words, lost faith in Avalon and reverted to native code with a dash of DirectX.

Windows 7 is more of the same. WPF is there but it is not at the heart of the OS. Developers are encouraged to use it for their own apps, but the Windows team is focused on native code.

When Visual Studio 2010 was released, with a shell built in WPF, Microsoft made some noise about how it showed its commitment to the framework. It was also noted that the Visual Studio team had worked with the WPF team to fix some issues. However, there is little sign of WPF changing its role as a layer in Windows primarily to support custom applications, rather than being used for the shell of Windows itself.

The question now: how much should Microsoft invest in future WPF development? It is not essential for Windows itself. Nor it is compelling for developers wanting to take advantage of the cloud model and support diverse clients. Frankly it does not look strategic unless it becomes the Windows shell API; and you could understand Microsoft having a “once bitten twice shy” attitude to that possibility.

I find it plausible that Microsoft would throttle back on WPF development.

Silverlight

Silverlight by contrast is strategic. Silverlight is a framework that runs in the browser, out of browser, and on Windows Phone 7. It is lightweight and cloud-oriented, and it runs .NET code, ticking lots of boxes for developers moving on from Windows desktop applications. It is also designer-friendly, with rich graphics and multimedia support. There are still a few gaps – printing is crude, for example – but it makes more sense for Microsoft to invest in Silverlight than WPF. It is significant that the new LightSwitch tool for rapid development of database apps targets Silverlight, not WPF, and not ASP.NET (except on the server). Silverlight is also the application platform for Windows Phone 7.

Then again, Silverlight is WPF. It was originally WPF/Everywhere, and uses the same XAML language for layout.

I will be surprised if Microsoft back-pedals on Silverlight. Nevertheless, I can also understand this being a matter of debate. Despite Microsoft’s efforts to distinguish them, there is considerable overlap between what Silverlight does, and what HTML 5 in IE9 does, especially when in the browser. There is also the Apple problem: HTML applications will run on iPhone and iPad, but Silverlight will not. What if Microsoft focused on the new IE engine instead of Silverlight, supporting it properly in Visual Studio, and providing ways for developers to create out-of-browser apps that run with full trust and have access to local system APIs? This would be along the same lines as the Palm WebOS and Google’s Chrome OS.

Put another way, does it make sense for Microsoft to invest equally in HTML 5 and Silverlight, when possibly IE 9 could be the basis of a unifying technology, a subset of which would work on any modern browser on any client?

It seems to me that Microsoft will have to invest in tooling for HTML 5 clients in some forthcoming edition of Visual Studio, and that this will be a selling point for its cloud platform, while possibly undermining the role of Silverlight.

There is also a continuing case for Silverlight, both because of the inherent advantages of a plug-in – consistency of client platform as well as features that HTML 5 lacks – and because it supports .NET. The .NET languages (Mono aside) tie developers to Visual Studio and to Microsoft’s platform. Visual Studio combined with .NET is a formidable tool for both client and server and a key advantage for the platform.

Watch this space.