Microsoft TechNet Blogs

Nothing like a 15 paragraphs corporate blog to explain why a technology is bad and unfit for production to promote said technology. Microsoft used to do the same with linux and now we have this http://blogs.technet.com/b/windowsserver/archive/2015/05/06/microsoft-…

You do need an external connector license for the servers that aren't running "web workloads" (serving pages), e.g., a database or mid-tier application server. See question 5 at http://blogs.technet.com/b/volume-licensing/archive/2014/03/10/licensi… That blog post is also a great demonstration of the hilariously complicated MS licensing regime. Hilarious if you don't have to deal with it, that is.

Another email incident at Microsoft worth reading [1]. [1] http://blogs.technet.com/b/exchange/archive/2004/04/08/109626.aspx

Remote Powershell exists, but you don't have a great deal of control over the Powershell interface (like you would with an SSH daemon), if you want to "opt-in" users one by one for remote Powershell, well, you cannot. Also setting it up to work over the internet securely is, a touch complicated: http://blogs.technet.com/b/askpfeplat/archive/2012/09/17/want-remote-p… It is a cool party trick that it can work via a web-browser and IIS. But if that's what it takes to make Powershell remoting secure without a VPN then it isn't workable.

I'll take a stab at it (no relation to Microsoft). As described in the following link, App-V does streaming of client app code from a server, appears very client-oriented. The technology behind it might not be, though: http://blogs.technet.com/b/gladiatormsft/archive/2013/11/05/app-v-on-n… (describes the registry key with exceptions to the underlying namespacing of handles, I think?) This appears to be called Named Kernel Object Virtualization (a.k.a. the VObjects Subsystem) from the title of the post. But again, client-side oriented. I expect Docker integration to be server-side oriented code for this. Oh and if anyone's saying Microsoft's late to the party, there have been similar attempts on Windows platforms since at least 2006 using such techniques: https://www.usenix.org/legacy/events/vee06/full_papers/p24-yu.pdf

Crypto systems generally don't fail gracefully, by even slightly changing the algorithm, or choosing special init values the results are not really applicable to an unmodified version. There are however known issues with real SHA1 which is why it's not recommended for future development. http://blogs.technet.com/b/srd/archive/2013/11/12/security-advisory-28…

Mark Russinovich is the author of the Sysinternals tools, which have long been essential utilities for troubleshooting Microsoft environments. His blog has some pretty good reads for anyone that wants an in-depth view of Microsoft products: http://blogs.technet.com/b/markrussinovich/

Mark Russinovich's "the case of the unexplained" [0] blog posts used to be one of my favourite read on the entire web. [0] http://blogs.technet.com/b/markrussinovich/archive/2012/07/02/3506849.…

"First, our tests showed that EMET default configuration can block the exploits seen in the wild." http://blogs.technet.com/b/srd/archive/2014/03/24/security-advisory-29…

Wait, can you explain what you mean? From my reading (especially from the source blog post[1]), they're releasing server designs and open sourcing some management software. If you were going to be running Windows Server (or someone convinces you to run it), cheaper commodity hardware is great, but it seems like you'll still be paying for Windows Server licenses. [1] http://blogs.technet.com/b/microsoft_blog/archive/2014/01/27/microsoft…

http://technet.microsoft.com/en-us/security/advisory/2880823 http://blogs.technet.com/b/srd/archive/2013/11/12/security-advisory-28…

For what it's worth, Microsoft has already changed the font of their logo recently: http://blogs.technet.com/b/microsoft_blog/archive/2012/08/23/microsoft…

I love dragging this out: http://blogs.technet.com/b/exchange/archive/2004/04/08/109626.aspx tl;dr - Bedlam DL3, a famous "Me too" reply-all incident at Microsoft in 2004, on the order of 15 million total messages.

DLL hell solved indeed. How many versions do you keep? For what it's worth, the DLLs in System32 are projected out of WinSxS with hardlinks, so they should not take up extra space. You still have the multiple version thing, however that can be somewhat mitigated by making service packs permanent[1]. [1] http://blogs.technet.com/b/joscon/archive/2011/02/15/how-to-reclaim-sp…

And spend days trying to explain to people how to not screw invites up on their Blackberries and then have fits that their meeting vanished. People don't understand that they have to manage their calendars and that meeting requests are a convenience feature. They think there's a central calendar and everything gets updated automatically. Have fun when the CEO misses an important call or meeting from his calendar. This stuff is like crack, it makes people think it's easy and magical, but it's a support nightmare. http://blogs.technet.com/b/outlooking/archive/2010/03/29/some-best-pra…

The techcrunch article is full of pointless commentary, I recommend just reading the original article: http://blogs.technet.com/b/microsoft_blog/archive/2010/06/25/microsoft…

A great blog post echoing the same sentiments (that no longer appears to be there): If you have ever dealt with me directly as a customer, attended one of my presentations, or even simply stomached one of my diatribes in a casual, technical conversation, you have no doubt heard about one of my pet peeves (no, not “Tips –n- Tricks” – we’ll visit that another time) but the term “best practices.” I loathe that term. I know we are guilty of it at Microsoft – so are just about every single technology-based organizations. In our ever-evolving industry, to put something down in print as THE ABSOLUTE BEST PRACTICES goes against the very nature of the word “practice.” It can seem arrogant. It implies way too much finality. It also can mean serious disruption when a practice changes. I work in a consulting practice. As products, regulations, politics, and trends change, so do our recommended practices. This is why I purposely try to use “under the current recommended practice” or simply just “current recommended practices.” Source: http://blogs.technet.com/b/gladiatormsft/archive/2014/08/25/app-v-5-in…

You and I are on the same page. What concerns me is that really the best work on securing core internals of the OS from long standing problems, such as strengthing LSASS and SAM against pass-the-hash with virtualized, isolated processing shielding and HW age I will be forced to it already. All the talk of Corona scares me, and not even CIS and the big players have guidance since MS has the new attitude of "just trust us already." Their announcing, even with Enterprise SKU, you cannot disable Windows Store, worries me. In my personal life, Windows is something I hardly ever use. But work and Windows 10, being shoved down into the deskop market, is scary. The Cred Guard stuff and improvements are wonderful, but their increasingly we're the cloud and you're the peon attitude also terrifies me. http://blogs.technet.com/b/ash/archive/2016/03/02/windows-10-device-gu…

"C++ instead of bare bones unsafe C" is C++ really much safer than C? "an OOP ABI (COM)" you really think this sort of thing is super great and there's nothing like it on "UNIX clones"? I have heard interesting things about windows async i/o syscalls, but as you'll see in another sub-thread, IIS still has a major component in the kernel, because the overall syscall overhead of windows is apparently somewhat high. This wouldn't be the first time I've heard of super-fancy windows subsystem designs which in practice were sabotaged by just generally over-complicated implementations. I recall a blog post by Mark Russinovich around the time Vista came out about the new, quite advanced file copying algorithms: http://blogs.technet.com/b/markrussinovich/archive/2008/02/04/2826167.… - but that file copying performance was often significantly reduced when playing an mp3 file due to the "multimedia class scheduler" - http://superuser.com/questions/18600/107mb-s-network-file-copying-slow… - either because i/o and execution priorities didn't actually work, or the engineer assigned to do this didn't know what he was doing and neither did anyone he worked with. Who knows? This sort of thing is all over microsoft's stuff. Theoretically super advanced, in practice just over-complicated. It's closed source and hugely complicated, so we'll never really know why it doesn't work as well as it should.

Google's comment: "We’re committed to providing users and creators with a great and consistent YouTube experience across devices, and we’ve been working with Microsoft to build a fully featured YouTube for Windows Phone app, based on HTML5. Unfortunately, Microsoft has not made the browser upgrades necessary to enable a fully-featured YouTube experience, and has instead re-released a YouTube app that violates our Terms of Service. It has been disabled. We value our broad developer community and therefore ask everyone to adhere to the same guidelines."[1] Microsoft's responds by saying cooperation with Google has stalled because Google insists the app be built using HTML5, a technical restriction other mobile platforms are not held to.[2] -- [1]http://www.zdnet.com/why-is-google-blocking-the-new-youtube-app-for-wi… [2] http://blogs.technet.com/b/microsoft_on_the_issues/archive/2013/08/15/…

Latest in a long saga. From a post from Microsoft in 2011: First, in 2006 Google acquired YouTube—and since then it has put in place a growing number of technical measures to restrict competing search engines from properly accessing it for their search results. Without proper access to YouTube, Bing and other search engines cannot stand with Google on an equal footing in returning search results with links to YouTube videos and that, of course, drives more users away from competitors and to Google. Second, in 2010 and again more recently, Google blocked Microsoft’s new Windows Phones from operating properly with YouTube. Google has enabled its own Android phones to access YouTube so that users can search for video categories, find favorites, see ratings, and so forth in the rich user interfaces offered by those phones. It’s done the same thing for the iPhones offered by Apple, which doesn’t offer a competing search service. Unfortunately, Google has refused to allow Microsoft’s new Windows Phones to access this YouTube metadata in the same way that Android phones and iPhones do. As a result, Microsoft’s YouTube “app” on Windows Phones is basically just a browser displaying YouTube’s mobile Web site, without the rich functionality offered on competing phones. Microsoft is ready to release a high quality YouTube app for Windows Phone. We just need permission to access YouTube in the way that other phones already do, permission Google has refused to…

From Microsoft's antitrust complaint from last year. http://blogs.technet.com/b/microsoft_on_the_issues/archive/2011/03/30/… First, in 2006 Google acquired YouTube—and since then it has put in place a growing number of technical measures to restrict competing search engines from properly accessing it for their search results. Without proper access to YouTube, Bing and other search engines cannot stand with Google on an equal footing in returning search results with links to YouTube videos and that, of course, drives more users away from competitors and to Google. Second, in 2010 and again more recently, Google blocked Microsoft’s new Windows Phones from operating properly with YouTube. Google has enabled its own Android phones to access YouTube so that users can search for video categories, find favorites, see ratings, and so forth in the rich user interfaces offered by those phones. It’s done the same thing for the iPhones offered by Apple, which doesn’t offer a competing search service. Unfortunately, Google has refused to allow Microsoft’s new Windows Phones to access this YouTube metadata in the same way that Android phones and iPhones do. As a result, Microsoft’s YouTube “app” on Windows Phones is basically just a browser displaying YouTube’s mobile Web site, without the rich functionality offered on competing phones. Microsoft is ready to release a high quality YouTube app for Windows Phone. We just need…

from http://blogs.technet.com/b/volume-licensing/archive/2014/03/10/licensi… : The front end servers used to host your website would generally be considered as running “web workloads” and CALs or External Connectors will not be required to access these servers. Once the customer adds a widget to their shopping cart, creates an account and enters their credit card and shipping information to complete the sale – they are now authenticated via your back end commerce servers/application (non-web workload). Since users are accessing the backend commerce servers which web workloads are not running – CALs or External Connectors will be required for users to access these back end servers.

Let's not forget all the craziness that is the "client access license": http://blogs.technet.com/b/volume-licensing/archive/2014/03/10/licensi…

Here's an example from Argentina in 2007: http://blogs.technet.com/b/dst2007/archive/2007/12/29/argentina-122907… Less than a week's notice of the change, and it was between Christmas and New Year. Ouch.

OneGet and the Appstore might be taking steps in the right direction. Still no unified (apt-get upgrade and dist-upgrade) - but currently doing an in-place upgrade win7->win10 and I actually expect settings to be retained and programs to continue working. For (especially) FOSS software, you might want to look at http://scoop.sh/ OneGet appears to be more of a wip: http://blogs.technet.com/b/packagemanagement/archive/2015/05/05/10-thi… https://github.com/OneGet/oneget/wiki/cmdlets But still useful.

I was interested so read the article. Enabling the "SafeDllSearchMode" flag doesn't help as it is not the current directory from which the DLL is loaded, but the startup directory from which the installer is run (eg. the Downloads folder). The directory from which the application is loaded is still the first directory from which DLLs are loaded with "SafeDllSearchMode" on. Moving current directory down in the search order doesn't help. edit: The Microsoft Security Research center also had a paper on this [1] and there it lists that "SafeDllSearchMode" also employs a "known DLLs" technique when this flag has been set. Now the question is if Microsoft has added this DLL as a known DLL or not. I don't see it in my registry, but it might be defined elsewhere (or I might overlook it) [1] http://blogs.technet.com/b/srd/archive/2014/05/13/load-library-safely.…

Good work! Microsoft was/is working on something similar[1] I tried the app on a chair and an object on table. It's far from what kinect can do. I am optimistic about it though. [1] http://blogs.technet.com/b/inside_microsoft_research/archive/2015/08/2…

Awesome chart! While you are updating it, you may also want to reflect that Microsoft changed "Lync" to be called "Skype for Business" in April 2015 - https://technet.microsoft.com/en-us/library/dn913785.aspx http://blogs.technet.com/b/scottstu/archive/2015/04/13/controlling-the… As far as I know "Skype for Business" is still using Lync's protocols, so your line would still be accurate.

I wonder if that's the norm rather than a Japanese peculiarity. it's a bit like that in Germany too - mostly small and middle sized companies are dominating, and people don't like to upgrade that much over there. The end of support for Windows XP last year used to be a major shocker, so the issue got some media coverage and reports were generally speaking of the danger to smaller firms [1]. Still nowadays only 17% of all installations are running XP (down from 26-30% last year). [2] [1] http://www.deutschlandfunk.de/windows-xp-eingestellter-support-gefaehr… [2] http://blogs.technet.com/b/microsoft_presse/archive/2015/04/08/windows…