Microsoft TechNet Blogs

From Microsoft in May 2019 (https://blogs.technet.microsoft.com/secguide/2019/05/23/security-basel… talking about how their new policy is not to recommend regular password changes: > When humans are forced to change their passwords, too often they’ll make a small and predictable alteration to their existing passwords, and/or forget their new passwords.

scripts are just text files that can do a great deal when executed by the scripting language runtime Microsoft have done a lot in Windows 10 to counter PowerShell malware https://blogs.technet.microsoft.com/poshchap/2015/10/16/security-focus… https://www.microsoft.com/security/blog/2017/12/04/windows-defender-at… It’s not foolproof but it copes with many common attacks. It’s surprising Apple hasn’t taken this approach.

US legislation and precedents are not binding in other legal jurisdictions throughout Asia and Europe. There are international agreements (such as TRIPS[0]) that aim to provide a degree of intellectual property law consistency across the world but if Oracle prevails in this case it does not follow that APIs would be automatically copyrightable in all TRIPS signatory nations. However a visit or letter from a large litigious opponent is likely to strike fear into the hearts of most regardless of the legal merits of the case. For example this has been effective for Microsoft in licensing patents they cover aspects of the Android operating system[1]. 0. https://en.wikipedia.org/wiki/TRIPS_Agreement 1. https://blogs.technet.microsoft.com/microsoft_on_the_issues/2011/10/23…

Thanks for the follow up. For your second point, my experience has been that you can fix booting when writing a Windows VM partition to a real drive but it involves some BCD black magic and doesn’t always work. Windows 10 in particular has given me issues when trying to do that but it’s fairly straightforward in Windows 7. This guide is written from the perspective of going the opposite direction (real HD to VHD) but it’s basically the same procedure: https://blogs.technet.microsoft.com/jonjor/2011/10/04/vm-does-not-boot…

Yesterday my teammate published a blog post on getting started with fuzzing para-virtualized devices in Hyper-V as well: https://blogs.technet.microsoft.com/srd/2019/01/28/fuzzing-para-virtua… Alex's blog post compliments it very well and both are great reads to get a better understanding for how Hyper-V works.

This reminds be of the classic Microsoft Bedlam DL3 story: https://blogs.technet.microsoft.com/exchange/2004/04/08/me-too/

Windows ships with native curl(.exe) now [1]. (Though PowerShell is great, and I think it counts, personally.) [1] https://blogs.technet.microsoft.com/virtualization/2017/12/19/tar-and-…

Only time will tell. I would rather focus on what they do, not what they say. e.g: - Microsoft <3 Linux (what they say) https://blogs.technet.microsoft.com/windowsserver/2015/05/06/microsoft… - Microsoft makes 2 billion USD collecting patent money from Android manufacturers (what they do) Then... CEOs cannot do whatever they want. They respond to the board.

The Dockerfile in the repo appears to be licensed under the MIT license. But for Microsoft Machine Learning Server itself, it appears the following is true for licensing: > It’s now easier than ever to procure and use Microsoft Machine Learning Server on all platforms. Licensing has been simplified to the following, effective October 1st 2017: > Microsoft Machine Learning Server is built into SQL Server 2017 at no additional charge. > Microsoft Machine Learning Server stand-alone for Linux or Windows is licensed core-for-core as SQL Server 2017. from https://blogs.technet.microsoft.com/machinelearning/2017/09/25/introdu…

This is where you talk about track record. Previous story somewhat tangentially related because Microsoft. https://blogs.technet.microsoft.com/microsoft_on_the_issues/2014/03/28… > Although our terms of service, like those of others in our industry, allowed us to access lawfully the account in this case, the circumstances raised legitimate questions about the privacy interests of our customers. > While our own search was clearly within our legal rights, I love C# and I love visual studio but I think vsts needs to at least meet gitlab with a free and open source community edition for me to consider it again. Hey, stop laughing. Stranger things have happened...

Microsoft has recommended turning off SMB1 support in the past: https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1… - though perhaps not prominently enough. However, you might be able turn off SMB1 support is if you still have machines with Windows XP or 2003. This is a similar situation to SSLv3 when POODLE was discovered, in that the difficulty of getting rid of old protocols, is that of getting rid of the last ones (Though I realise WCry exploits an implementation bug).

https://blogs.technet.microsoft.com is down, https://technet.microsoft.com remains up.

Interesting developments with the latest SQL server version announced: https://blogs.technet.microsoft.com/dataplatforminsider/2017/04/19/sql… Was thinking about migrating to Postgres but SQL server on linux with graph processing is a great combination.

Wow the comment thread on the original MSFT blog post (direct link: https://blogs.technet.microsoft.com/enterprisemobility/2017/04/18/no-p… is just painful. It's mostly a collection of people who use Windows on their phone crying out about the lack of support for Windows. Microsoft won't support their own platform (phone) with this. If that's the case then why would any other developer write apps for Windows? Also, I thought the big push was for Universal Windows Platform (UWP) apps that ran on mobile, desktop/tablet, and Xbox. I can understand that you may not want to write a custom app for a platform with tiny market share but "big" Windows still has a lot of share. This is a great example of how to erode trust.

Powershell is frankly fairly amazing. Recently I found myself needing to open the Windows datastore.edb file, and before I discovered some interops I learned that in fact you can grab a C# member definition, then use it as a signature and load that type as a Powershell object [1] Hell, I even found a C# code snippet and was able to add into a Powershell string, then add this as a C# type definition, and Powershell compiled it to an assembly and then loaded it as an instance of a Powershell object.[2] 1. http://www.leeholmes.com/blog/2009/01/19/powershell-pinvoke-walkthroug… 2. I found how to do this here: https://blogs.technet.microsoft.com/stefan_gossner/2010/05/07/using-cs…

Fiddler is great. Hadn't heard of NetRipper. Will take a look, thanks. Also worth considering is Microsoft Message Analyzer, which used to be Network Monitor (NetMon). https://blogs.technet.microsoft.com/MessageAnalyzer/ Edit: I should add that this isn't an endorsement, just another option. I only included MMA as a side-note in my recent book. I focussed on Wireshark and Fiddler to keep things simple.

Because of the way email works, if you got it working, but screwed up (which is what would probably happen), you'd end up with a recreation of The Great Worm (Well, to be more accurate, you'd actually get a recreation of Bedlam-DL3: https://blogs.technet.microsoft.com/exchange/2004/04/08/me-too/. But it would have the same effect). Do you want to see what happens when millions of poorly configured email servers round the net scream out in agony?

I added the following to my hosts file for today: #8:07 AM 10/21/2016 199.16.156.70 twitter.com 104.244.43.231 abs.twimg.com 104.244.43.231 pbs.twimg.com 192.30.253.113 github.com 151.101.24.133 assets-cdn.github.com after giving up on modifying DNS timeouts. https://blogs.technet.microsoft.com/stdqry/2011/12/14/dns-clients-and-…

So they did lie when they said "Microsoft Loves Linux". https://blogs.technet.microsoft.com/windowsserver/2015/05/06/microsoft… Meet the new boss, same as the old boss.

Microsoft already announced the SQL Server on Linux licensing: https://blogs.technet.microsoft.com/dataplatforminsider/2016/03/15/dat… "A customer who buys a SQL Server license (per-server or per-core) will be able to use it on Windows Server or Linux. This is just part of how we are enabling greater customer choice and meeting customers where they are." Same editions, same prices.

The article confuses address space and memory reservations as you note. It again makes the confusion when it suggests the virtual size column in Process Explorer is a reflection of the address space[1]. It also suggests that working set, private bytes, and committed memory are the same thing[2]. The article does not even live up to its click-baity title: Task Manager's default memory column of "private working set" is a decent measure of how much memory a process is uniquely using and task manager has the ability to add all the other measures of memory usage that the article mentions. For a better explanation of virtual memory in Windows, I recommend Mark Russinovich's article[3]. His tool VMMap[4] is useful for visualizing the memory usage of an individual process. [1]: The reserved memory is really large for 64-bit processes that use Control Flow Gaurd: http://www.alex-ionescu.com/?p=246 [2]: Task Manager and Process Explorer add to the confusion by calling the same memory different things (Process Explorer's "private bytes" number is the same as Task Manager's "commit size" number on Windows 10 1809). [3]: https://blogs.technet.microsoft.com/markrussinovich/2008/11/17/pushing… [4]: https://docs.microsoft.com/en-us/sysinternals/downloads/vmmap

ForEach is an unusual statement. Depending on the context in which it's used, sometimes it's an alias of ForEach-Object, but sometimes it is not. The following article has more details on this, but one thing that I'd like to highlight now is that one way that ForEach and ForEach-Object can differ from each other is in memory use, as ForEach will load all objects that it's iterating over into memory first before starting the loop, whereas ForEach-Object will not. As suggested before, more details can be found here: https://blogs.technet.microsoft.com/heyscriptingguy/2014/07/08/getting… Going back to the naming conventions, the conventional way to write ForEach is in PascalCase. The variations slip into code as it's also an alias, and aliases tend to be in all lower case, and also because naming convention guidelines are just suggestions, not something that is strongly enforced (Foreach does seem to be commonly used, even if it's not necessarily in the standard styles). Generally speaking, PowerShell coding style is similar to .NET coding style. You can read a discussion about it here: https://github.com/PoshCode/PowerShellPracticeAndStyle/issues/36 By the way, I respect your right to use whatever language you like best, I'm just clarifying that whilst PowerShell may not have it's "PEP-8" or gofmt, there are still conventions that PowerShell coders follow.

Here, yes, I agree that the foreach statements would be better, possibly even significantly, but in a general case the difference is usually not worth bothering with. While ForEach-Object is like an order of magnitude slower, we're talking like 100 ms vs 10 ms to iterate through 10,000 items. (https://blogs.technet.microsoft.com/heyscriptingguy/2014/07/08/getting… In other words, you have to have a good number of objects to make foreach meaningfully faster that when you do, you often find that either a) lose time to powershell.exe allocating more system memory to store the collection, or b) the loop itself is two or three orders of magnitude slower already so it's ultimately a trivial optimization. Also, the foreach statement waits to allocate the entire set to memory ($y in your example) while ForEach-Object begins processing as soon as the first object comes through the pipeline. If you're using the output of a command for $y that returns output with some lag, you might find that ForEach-Object actually turns out to be faster because the first objects start being processed immediately. If you're returning data over a network or dealing with particularly large objects, ForEach-Object can be better. Finally, the foreach statement itself doesn't work with pipelines either as input or output, so it's not appropriate for a lot of scenarios.

Reminds me of how Windows Vista's "Multimedia Class Scheduler Service" would put a low cap on network throughput if any sound was playing: http://www.zdnet.com/article/follow-up-playing-music-severely-degrades… Mark Russinovich justified it by explaining that the network interrupt routine was just too expensive to be able to guarantee no glitches in media playback, so it was limited to 10 packets per millisecond when any media was playing: https://blogs.technet.microsoft.com/markrussinovich/2007/08/26/vista-m… but obviously this is a pretty crappy one-size-fits-all prioritization scheme for something marketed as a most-sophisticated best-ever OS at the time: https://blogs.technet.microsoft.com/markrussinovich/2008/02/04/inside-… Many people had perfectly consistent mp3 playback when copying files over the network 10 times as fast in other OSes (including Win XP!) Often a company will have a "sophisticated best-ever algorithm" and then put in a hacky lazy work-around for some problem, and obviously don't tell anyone about it. Sometimes the simpler less-sophisticated solution just works better in practice.

I think a lot of the hate on powershell is that it chooses to do things very similar to existing languages, but just different enough to confuse practitioners of anything else. Posh also suffers in its somewhat easy to invoke any .NET library, so people start comparing it to a more tooled programming language or something with more sane libraries, and the "ISE" is nowhere close to an IDE (why isnt powershell a first class citizen in visual studio! yes I know there are tools, they are not great.) Nonetheless, after a few years of working in sql server I have adopted more and more posh in my life because its simply the fastest way to get things done if you are doing windows server management. I usually find myself on one of these two places if I am looking for something: Mike Fal (SQL Server focus, he is great) http://www.mikefal.net/ Hey Scripting Guy! https://blogs.technet.microsoft.com/heyscriptingguy/ edit: forgot to mention that MSFT helped to cause problems by massive changing how the language did things over time(usually for the better), so ps1 vs ps4 is crazy different, another reason to be annoyed because which version comes with which product is a fun skew to deal with (thanks sqlps having ps2.0!)

Another data point on Anaconda from microsoft's Azure ML team - we've been using Anaconda for the past few years and have been very happy with it. One key feature we like is that we can deploy a nearly identical suite of pkgs on Windows, Linux and MacOS w/o having to worry about mismatched versions, installation/update issues, etc. Case in point - the Azure ML Jupyter notebooks run on a farm of Linux/docker machines: https://blogs.technet.microsoft.com/machinelearning/2016/02/10/python-… Once a model is built, it can be deployed for production/scale to the Azure ML backend which runs entirely on a farm of Windows machines. Both environments have matching Anaconda distros running underneath which makes running on two different OS's practically a non-issue. In fact 95% of our users probably have no idea their notebooks & production site run two OS's (in large part thanks to Python, Linux, Docker, Anaconda, ... and lots of other great open source software).

Even tech companies such as Microsoft (https://blogs.technet.microsoft.com/exchange/2004/04/08/me-too/ or https://www.businessinsider.nl/microsoft-employee-github-reply-all-ema… aren’t immune to that. The generic term for this kind of thing is “email storm” or “reply apocalypse” (https://en.wikipedia.org/wiki/Email_storm)

I understand that @randomascii is responsive, perhaps he could help with analysis. I see an email address on his site's About page. Also, I got curious about the perf collection process, and stumbled on https://blogs.technet.microsoft.com/yongrhee/2017/10/11/using-xperf-to… - unsure if this will be useful. Also found https://randomascii.wordpress.com/2015/09/24/etw-central/, for completeness

https://blogs.technet.microsoft.com/jhoward/2005/01/27/contoso-com-why… "at the event we needed 2 companies, so someone in the product team came up with Contoso and Fabrikham, and in the BizApps events, all the integration scenarios where around these 2 companies doing business with each other. i have no idea where the names come from – i guess its like with setting up your own off-the-shelf Limited company, someone comes up with mixes of word & names. Fabrikham is a horrible name! Contoso is better, bu only just"

This is one area where they could learn something from Microsoft. Microsoft use UserVoice for product feedback. Outdated list of UserVoice product sites: https://blogs.technet.microsoft.com/o365guy/2018/01/02/submit-product-… UserVoice allows voting on what issues impact people most and allows the company to provide feedback to those issues/ideas. This isn't to say that a company must do all upvoted ideas, Microsoft certainly don't, but it is a useful outlet for both parties. Microsoft aren't the only major company using UserVoice: https://www.uservoice.com/customers/ and there are competing services offering similar benefits. The concept is maybe more important than that specific product. Apple seems to lack basic communications channels in both directions. This is a problem regardless of company policy.