|
Spaces home Gary RussoPhotosProfileFriendsMore ![]() | ![]() |
|
Gary RussoSoftware Development for the Digital Lifestyle
April 09 Microsoft's Motherhood/Apple Pie 'Altruism'
Technorati Tags: MTS08
During a recent Microsoft Tech Summit that I attended last month, Microsoft's John Fernandes gave an interesting talk on Microsoft’s Local Software Economy (LSE) Initiative. It’s a Motherhood/Apple Pie marketing and funding initiative with the goal to build healthy software economies in developing countries. During the talk, there was an interesting debate that at first glance may be perceived as a typical colonial/imperialist exploitation. Yes, Microsoft needs a profit center but establishing self-sustaining software businesses in economically disadvantaged countries is the apple pie. I think most people in the room considered it a beautiful story, if successful. The hope is that these countries become much wealthier. John Fernandes is clearly a man with a mission. He's committed to use Microsoft resources to help developing countries build infrastructure, education programs, and entrepreneurial support for vibrant software ecosystems. Ultimately, the businesses created will be self sustaining profit centers where eventually Microsoft prospers by selling more OS licenses. As he noted, "Motherhood and Apple Pie is a good thing" for both parties. Some interesting notes: There may be more info on Microsoft Startup Zone. BTW, here's a post about LSE from last year's MTS07 event. Of course, Microsoft is not the only company with Motherhood/Apple Pie 'altruism'. IBM's similar initiative is called PartnerWorld. In this case, IBM benefits from infrastructure and consulting service sales. March 29 Microsoft Brainwash Summit 2008?Technorati Tags: MTS08 Microsoft invited 43 members of the Open Source / Anything But Microsoft (ABM) development community for a 2 ½ day conversation. Dario Laverde and I were invited since we run the New York City Java SIG. Much thanks to Microsoft’s Peter Laudati for the invite. We had an extremely diverse group of free spirited talented developers and engineers with strong opinions towards Microsoft. The group represented most of the popular ABM tech (e.g., Ruby, PHP, Linux, Flex/Flash/ColdFusion, MySQL, Apache, Samba, Perl, Java, etc.). The standing joke was to label the event as Microsoft's Brainwash Barcamp. To be fair, Microsoft deserves much credit for holding the event. For me, it was a great privilege to get the opportunity to share my thoughts on how both parties can work better together. Obviously, the key issue is Microsoft’s inability to connect with the open source community. I'll post more about it next week. Regarding Java, even though it's now an open spec, there are remaining legal issues that Microsoft and Sun need to resolve. I spoke to Sam Ramji a bit about it last night. He is trying to spearhead an effort to make Windows the best OS for Java. He noted that he visited Sun in Santa Clara last week and the meeting didn't go very well. However, he appears to be optimistic. In any case, the NYC Java SIG will do its part to facilitate an ongoing dialog between the Java Community and Microsoft since both parties ultimately benefit. March 27 Microsoft Technology Summit 2008Technorati Tags: MTS08 I’m attending a special event on Microsoft’s Redmond campus this week. It’s called the Microsoft Technology Summit 2008. I'll try my best to blog about it this week. So far the event has been a great learning experience for the attendees as well as Microsoft. There are only ~50 attendees. The majority of the attendees are non-Microsoft technologists (e.g., PHP, Ruby, Java, Flash/Flex, Perl, OpenID, etc.). The clash of skill sets/technologies is leading to interesting/engaging conversation with Microsoft. I'll have much more to say later this week. October 16 Regular Blogging will Resume ShortlyMy regular blogging will resume soon. I had to take some time away to tend to some other activities. I am looking forward to getting back to it. The software and entire tech industry is experiencing an unprecedented period of invention and change. I'll attempt to recognize the significance before its in the rear view mirror. Some topics/technologies likely to be covered are: - Cloud Computing - Rich Async Clients - Natural Interface - Multi-touch - Intentional Programming - LINQ/.Net 3.5 - Silverlight - Social Networks - iPhone/iPod Touch - Mac Book Pro/Apple TV - OS X Leopard - Zune 2 - Virtualization - VMWare, XEN, Hypervisor, Microsoft Viridian - Haptics/Feedback Touchscreens - Real-time Enterprises - XBox360/Halo 3 - Win Media Center/Extender/IPTV - 64 bit Vista On a somewhat related note, one of the fun aspects of living in NYC, is that there's always something exciting going on. Whenever possible and as goofy as it looks, I usually try to capture it with my cell phone camera. Here's some recent photos from my cell phone camera. August 01 Dell's new Touchscreen Tablet PC and Multitouch?I'm anxiously waiting for the soon to be released Dell Touchscreen Tablet PC. Dell's teaser announcement of the Latitude XT Tablet PC is here. The two key features are Intel's ultra-low power dual core Santa Rosa [Centrino Pro] CPU and the Touchscreen. IMO, Touchscreen on Tablet PC's are long overdue. Going forward, all new Tablet PC's will have touchscreens. You can buy a Lenovo Thinkpad X60 and HP Pavillion tx1000z Tablet PC with the touchscreen option today. The bad news / good news about today's Touchscreen Tablet PC's is that they do not provide the cool iphone-like hand gesture multitouch capability. The good news is that for today's office applications, the pen stylus with an occasional single finger touch works better than the hand gesture multitouch. Regardless of which interface works better, a hand gesture multitouch capability on the larger screen Tablet PC would be super cool. My question is "how can I modify the touchscreen device driver to provide hand gesture multitouch?" As always, there is hidden complexity. Some rough requirements are: - finger point tracking: ability to track the 10 finger points: N points where 1 < N < 10. - finger vectoring: determine speed and direction when two fingers are joined together and then moved apart. - finger locator: cross the fingers and determine where they crossed which one went which direction. Some further research lead me to this very cool multitouch C++ library. => http://www.whitenoiseaudio.com/touchlib/ Thanks to Google Code, you can browse the source code here: => http://touchlib.googlecode.com/svn/trunk/ I hope to find some time to experiment with this further. In any case, if done properly, a hand gesture multitouch tablet PC can bring Surface Computing to the masses. Some possible apps may be: - More Natural Newspaper Style Readers similar to the New York Times (XAML) Reader - Cover flow-like media browsing - Multi-user Multitouch Drawing tools and games - 3D Virtual Map Browsing - Video/Audio Editing - Data Visualization Apps (e.g., Excel, Tableau, etc.) - Student Notebook Apps - E-Learning Apps with Realtime Exams It'll be fun to see how this evolves. In the mean time... When's that dang Dell Tablet Shipping?... June 30 Can Database Development be Agile?I've been a big advocate for Microsoft's new Visual Studio Team System product line. The initial launch was in 2005 and was marketed as a Dev Tools suite for Architects, Developers, Project Managers, Testers and "everyone else". Unfortunately the "everyone else" did not include DB Developers. The good news is that the newest member of the VSTS Suite is called Visual Studio 2005 Team Edition for Database Professionals. It was launched in December 2006. The bad news is that it only works with SQL Server 2005. It looks like support for ORacle is coming but don't hold your breath. In any case, this tool provides the ability to incorporate a daily Database build into the regular daily build. Finally the DB team and the App dev teams can collaborate and not "hate" each other. Now when we say the "truth" is in version control it also includes the Database. More info is here. May 31 Will there be a Zune 1st?There are a few rumors of a new "Zune Coming Zoon in June". It may happen tomorrow but I have my doubts. Some passionate Zunesters say that it will be launched on Friday, June 1st or should I say Zune 1st. The buzz is about the following: - Flash Zune - Purchase and download tracks over Wi-Fi - Zune 2.0 We all know that a Flash Zune product is in the works. The only unknown is the launch date. The more interesting news is Zune 2.0 and getting the ability to purchase and download tracks over Wi-Fi. It’ll be interesting to see usage metrics on the new Wi-Fi feature a few months after launch. It's a key differentiator. The rumored Zune 2.0 features are: - 80 GB - 16:9 wide 640 by 480 pixel with 256k color screen - Purchase and download tracks over WiFi - no more 3 by 3 WiFi track sharing restriction The key Zune 1.0 features: - 30 GB - 4:3 wide 320 by 240 pixel with 65k color screen - 3 by 3 WiFi track sharing You can see more Zune 1st info here. In the mean time, take a look at Amazon's top selling hard drive based MP3 player sales info here. April 30 Will Java 7 Erase Erasure?
You can read more about it here. The one feature that surprises me most is Reified Generics. The Erasure versus Reification issue has been a hot topic in the industry. Java implemented Generics using Erasure which means that the generic type info is not available at runtime. Reified generics is the alternate approach where the generic type info is available at runtime. It's interesting because reification is the long standing Microsoft .Net approach. Whereas erasure is the Sun Java approach. Neal Gafter writes about it here. Bruce Eckels has a 4 part article on the topic here. The big complaint with Java Generics is that it's too complex. This Java Generics FAQ is 425 pages! Java 7 is still evolving but it'll be interesting to see if it eventually adopts the Microsoft way and erase erasure. March 31 Sleeping with the Deepfishes"Sleeping with the Deepfishes" is my metaphoric reference to the Luca Brasi character in the movie "The Godfather". Luca Brasi was a fiercely loyal personal hitman for Godfather, Don Vito Corleone. He was eventually killed by a competing crime family. The message of his murder was eventually delivered to the Corleone family as a fish wrapped in Brasi’s own bulletproof vest. The dead fish message is supposed to be a Sicilian mafia tradition indicating that "Luca Brasi sleeps with the fishes". What’s my point? Microsoft’s Live Labs group released a pre-beta version of a mobile web browser called Deepfish this past week. I’ve been using it for the past few days and it’s a better way to surf the web on a tiny screen. Microsoft Live Labs is an internal think tank/incubation team for next gen web technologies. I consider it the "Luca Brasi of Microsoft". I always felt that low cost wireless networking will be the catalyst for the next tech surge. We are starting to see it now with Apple’s coming iPhone, Deepfish, mobile GPS, Zen Zui, etc. Most tech companies realize that the digital future is in the ‘cloud’. Microsoft’s Live Labs group has been working hard on the ‘cloud’. It has been getting much criticism lately for being too little too late. The Mix07 Conference will be held from April 30 to May 2nd in Las Vegas. It is Microsoft’s chance to save face. The tech press has high expectations for them to deliver some compelling cloud products. IMO, the expectation is too high. Ray Ozzie is expected to have a blockbuster keynote but I have my doubts. I’ve seen his keynotes before and they are real snoozers. Many in the industry think that the Live Labs group will eventually be killed off and "sleep with the fishes" by Microsoft management if they don’t deliver soon. Let’s see what happens on April 30th. February 28 Vista ReadyBoostI bought this 4 GB USB drive recently to boost the speed of my Lenovo T60 laptop. The T60 is my office PC. It's loaded with Vista Business Edtion. Despite the UI, Vista's backend services are the most innovative. The SuperFetch and ReadyBoost features are key differentiators that set it apart from other operating systems. Ever since I plugged in the USB drive, I've been experiencing less disk thrashing and better overall system performance. There's a good ReadyBoost FAQ here. January 31 Dr. Jim GrayI have always been inspired by Dr. Jim Gray's publications and talks. I first learned about his famous book called "Transaction Processing: Concepts and Techniques" at a DB Expo in San Francisco in 1995. I never took the time to read it but its everything you ever needed to know about database transactions packed into 1,100 small fonted pages. At the time, I worked with some IBM CICS developers from Hursley, England that worshipped the book. My first chance to see him speak was at a Microsoft PDC in 1997. He gave a talk on Scalable Computing. Ever since, I've been a groupee. He deserves much credit for Microsoft's scalability efforts. It's built on the idea that a large amount of little parts are much better than a few big parts. So if 100 Terabytes of disk space is needed then it's better to use 10,000 : 10 GB disk drives than 100 : 1,000 GB (1TB) disk drives. If you do the math, the cost is lower, performance is higher and is more reliable. His famous 5 Minute Rule: "In Psychology, the answer is always 5±2. In Physics, the answer is always transcendental. In Digital computing, the answer is always a multiple of 5 -- for example, how many fingers and toes do you have? In all fields, the problem is to find the question. One interesting question is: When does it make economic sense to make a piece of data resident in main memory and when does it make sense to have it resident in secondary memory (disc) where it must be moved to main memory prior to reading or writing? 5 Minute Rule: Pages referenced every five minutes should be memory resident." The sads news is that on Sunday (1/28), Dr. Jim Gray was reported missing at sea. If interested, there are great video interviews of Dr. Jim Gray here and here. December 31 Tech Trends to Watch in 20072006 has been an exciting year. Some key developments have been the Vista business launch, Java SE 6, Internet TV as per YouTube, white hot MP3 Player market, AJAX’d web apps, sleak new Smartphones, and cool new game consoles. Rather than dwell on the past, here's my list of Fifteen Tech Trends to Watch in 2007. 1. Low Cost High Speed Ubiquitous Wireless Connectivity I just purchased Cingular’s 8525 Smartphone and went with the the $40 per month unlimited data plan. Its a great phone but the $40 buck per month data plan is a lifestyle changer. I'm addicted to being wired 24/7 now. The 8525 has a Tri-band UMTS / HSDPA radio and a Quad-band GSM®/GPRS/EDGE worldphone radio. Without getting into the 3G alphabet soup the following table may help explain the different mobile and wireless technologies.
The cool part of the 8525 is that it may eventally get the ability to switch between 3G and Wifi services on the fly. So if you're on the phone using UMTS and you walk into a Starbucks with Wifi, the phone will switch to the lower cost higher capacity VOIP via WiFi connection. This new type of adaptive network capability will be a catalyst for a flood of new types of SW apps. We just need to get Cingular's monthly cost to come down to $15 bucks to fend off the ghastly digital divide. 2. Declarative Programming The declarative programming wave has been building ever since the advent of rules engines and XSLT. Declarative programming is the alternative to old school imperative programming. Microsoft's new .Net 3.0 has a new declarative presentation layer called WPF/E that uses their new XAML spec. Java has embraced declarative programming in many ways. The new Java EJB 3.0 depends heavily on the new declarative annotations features in JDK 1.5. Another new approach to take note of is intentional programming. I consider it a derivative of the Model Driven Architecture (MDA) effort from a few years ago. The famous Charles Simonyi is pioneering the effort. 3. Apple "iPhone" - there is much speculation about Apple’s rumored iPhone. As overly reported, Cisco launched a VOIP phone called iPhone recently so Apple can’t use the name iPhone or iFone. Apple will use other names like iMobile, iCell or MacPhone but my guess is that the name of the Apple phone will be “iPod Phone”. In 3 years, all iPods will have 3G Cell Phone and WiFi but in the mean time, the iPod Phone will be the hot item. 4. One Billion PCs Sold 5. Multi-point UI 6. Zune Flash Player - Despite the Zune bashing in the press, I am impressed with the Zune sales forecast. The expectation is to sell 1 million units by end of June. That's not bad for a product being on the market for just 7 months. That comes to 143,000 units per month. According to Amazon's best seller list, and comparing it to the other 30 GB hard drive-based MP3 Players, Zune is in 4th, 7th and 8th place. In any case, I expect to hear announcements of a Zune Flash player that will compete with iPod's Nano within the next 6 months. 7. Low Cost GPS Services 8. Federated Identity - Microsoft Cardspace (formerly InfoCard) and Identity 2.0 will start to bring user-centric federated identity to the masses. 9. Object Mapping - Microsoft’s new language integrated query (LINQ) may spark new interest in the OR mapping space. 10. Terabyte Disk Drives – 2007 should be the year of the Terabyte disk drive. Having one terabyte on one spindle will be a significant single point of failure risk. This will highlight the importance of having adequate RAID and backup services. The largest hard drive available to date is a 750GB barracuda drive from Seagate. 11. Microsoft's new Home Server - will be used to control everything in the home (e.g., lights, thermostats, entertainment, phone, windows, washing machine, kitchen appliances, garage door, car, etc.). 12. Team Foundation Server (TFS) will gain some traction this year. 13. Virtualization – Virtual OS’s will be important this year too. OS X 10.5 (leopard), Vista Server and Solaris 10 have added virtualization to the OS. 14. Automotive PCs 15. Some Adoption of 64-bit desktop apps - I expect to see interest in 64-bit versions of the resource intensive apps (e.g., video compressors, video editors, CAD, CAM, CAE, Mathematica, etc.). Both AMD and Intel have compelling 64-bit processors now. A 64-bit MacBook Pro and this Dell Inspiron 1501 may start the 64-bit desktop revolution. November 30 Image Morphing Windows AppI resurrected source code from a Windows App that I wrote back in 1993. The app uses a source image, an 8X8 source mesh, a destination image and an 8X8 destination mesh to generate a series of morphing images. I will try to post a revised version of the program soon. It is written mostly in C. The image morph algorithm, called "meshwarp", was taken from a 1993 Dr. Dobbs Journal article. The meshwarp code was written by George Wolberg and you can read more about it here. The attached image shows the mesh editor functionality that I wrote before MFC was the defacto standard. Here's a snippet of George Wolberg's meshwarp code. /* ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ * meshWarp: * * Warp I1 with correspondence points given in meshes M1 and M2. * Result goes in I2. * * See "Digital Image Warping" by George Wolberg (IEEE Computer Society * Press, 1990) for details. * Based on Douglas Smythe's algorithm (in "A Two-Pass Mesh Warping Algorithm * for Object Transformation and Image Interpolation", ILM Technical Memo * #1030, 1990). */ void meshWarp( imageP I1, imageP M1, imageP M2, imageP I2 ) { int I_w, I_h, M_w, M_h; int x, y, u, v, n; float *x1, *y1, *x2, *y2; float *xrow, *yrow, *xcol, *ycol, *coll, *indx, *map; uchar *src, *dst; imageP Mx, My, I3; I_w = I1->width; I_h = I1->height; M_w = M1->width; M_h = M1->height; /* allocate enough memory for a scanline along the longest dimension */ n = MAX(I_w, I_h); indx = (float *) WINmalloc(n * sizeof(float)); xrow = (float *) WINmalloc(n * sizeof(float)); yrow = (float *) WINmalloc(n * sizeof(float)); map = (float *) WINmalloc((n*2) * sizeof(float)); /* create table of x-intercepts for source mesh's vertical splines */ Mx = allocImage(M_w, I_h, MESH); for(y=0; y < I_h; y++) indx[y] = y; for(u=0; u < M_w; u++) { /* visit each vertical spline */ /* store column as row for spline fct */ xcol = (float *) M1->ch[0] + u; ycol = (float *) M1->ch[1] + u; coll = (float *) Mx->ch[0] + u; /* scan convert vertical splines */ for(v=0; v < M_h; v++, xcol+=M_w) xrow[v] = *xcol; for(v=0; v < M_h; v++, ycol+=M_w) yrow[v] = *ycol; catmullRom(yrow, xrow, M_h, indx, map, I_h); /* store resampled row back into column */ for(y=0; y < I_h; y++, coll+=M_w) *coll = map[y]; } /* create table of x-intercepts for dst mesh's vertical splines */ for(u=0; u < M_w; u++) { /* visit each vertical spline */ /* store column as row for spline fct */ xcol = (float *) M2->ch[0] + u; ycol = (float *) M2->ch[1] + u; coll = (float *) Mx->ch[1] + u; /* scan convert vertical splines */ for(v=0; v < M_h; v++, xcol+=M_w) xrow[v] = *xcol; for(v=0; v < M_h; v++, ycol+=M_w) yrow[v] = *ycol; catmullRom(yrow, xrow, M_h, indx, map, I_h); /* store resampled row back into column */ for(y=0; y < I_h; y++, coll+=M_w) *coll = map[y]; } /* first pass: warp x using tables in Mx */ SendGenStatus( "1st Pass: Interpolating and Resampling..." ); I3 = allocImage(I_w+1, I_h+1, BW); // +1 for testing purposes x1 = (float *) Mx->ch[0]; x2 = (float *) Mx->ch[1]; src = (uchar *) I1->ch[0]; dst = (uchar *) I3->ch[0]; for(x=0; x < I_w; x++) indx[x] = x; for(y=0; y < I_h; y++) { /* fit spline to x-intercepts; resample over all cols */ catmullRom(x1, x2, M_w, indx, map, I_w); /* resample source row based on map */ resample(src, I_w, 1, map, dst); /* advance pointers to next row */ src += I_w; dst += I_w; x1 += M_w; x2 += M_w; } freeImage(Mx); /* create table of y-intercepts for intermediate mesh's hor splines */ SendGenStatus("Interpolating horizontal splines of intermediate mesh..."); My = allocImage(I_w, M_h, MESH); x1 = (float *) M2->ch[0]; y1 = (float *) M1->ch[1]; y2 = (float *) My->ch[0]; for(x=0; x < I_w; x++) indx[x] = x; for(v=0; v < M_h; v++) { /* visit each horizontal spline */ /* scan convert horizontal splines */ catmullRom(x1, y1, M_w, indx, y2, I_w); /* advance pointers to next row */ x1 += M_w; y1 += M_w; y2 += I_w; } /* create table of y-intercepts for dst mesh's horizontal splines */ SendGenStatus("Interpolating horizontal splines of destination mesh..."); x1 = (float *) M2->ch[0]; y1 = (float *) M2->ch[1]; y2 = (float *) My->ch[1]; for(v=0; v < M_h; v++) { /* visit each horizontal spline */ /* scan convert horizontal splines */ catmullRom(x1, y1, M_w, indx, y2, I_w); /* advance pointers to next row */ x1 += M_w; y1 += M_w; y2 += I_w; } /* second pass: warp y */ SendGenStatus( "2nd Pass: Interpolating and Resampling..." ); src = (uchar *) I3->ch[0]; dst = (uchar *) I2->ch[0]; for(y=0; y < I_h; y++) indx[y] = y; for(x=0; x < I_w; x++) { /* store column as row for spline fct */ xcol = (float *) My->ch[0] + x; ycol = (float *) My->ch[1] + x; for(v=0; v < M_h; v++, xcol+=I_w) xrow[v] = *xcol; for(v=0; v < M_h; v++, ycol+=I_w) yrow[v] = *ycol; /* fit spline to y-intercepts; resample over all rows */ catmullRom(xrow, yrow, M_h, indx, map, I_h); /* resample source column based on map */ resample(src, I_h, I_w, map, dst); /* advance pointers to next column */ src++; dst++; } freeImage(My); freeImage(I3); WINfree((char *) indx); WINfree((char *) xrow); WINfree((char *) yrow); WINfree((char *) map); } November 01 Future PC User Interfaces will be Multi-TouchAs shown in the movie Minority Report, Multi-Touch UI is the future (see photos). The keyboard/mouse paradigm will be around for a while but a future of free form 3D multi-point input is coming. When it happens it will be the first step towards conversational interactions. Please see Jeff Han's interface-free multi-sensor device presentation here. Some more info is here. As Jeff Han notes, the interesting aspects of the technology is the 'state of the art' mesh and data visualization algorithms used to pull it off. I'll try to resurrect some Michael Abrash image Morph mesh code that I implemented back in 1993 in a future post. At the time, I was using a PC with an Intel 80386SX CPU. The 386SX CPU had no math coprocessor which meant that the execution time of the image morph mesh calculations was much longer than expected. I remember that the time needed to generate 20 images was approximately 2 hours. September 28 Java 5 Concurrency in Practice - Brian GoetzI attended a Java SIG Meeting that was held at Google's NYC office recently. BTW, all Java SIG presentation slide decks are archived here. The meeting was a presentation on Java 5 Concurrency given by Brian Goetz. (See photos) As you may know, multi-core CPUs have escalated the need to develop multi-threaded apps. Brian introduced some refreshingly new concepts such as CountDownLatch, Exchanger, Executors and Future Interface. I'll have to blog more about it later. In any case, both Java and Microsoft have interesting concurrency framework stories to tell. Microsoft and Sun are developing Concurrency Libraries that will ultimately minimize the complexity of multithreaded programming. Microsoft's library is called Joins and it will eventually get baked into .Net. More info here. The Java Concurrency Library is the JUC package (java.util.concurrent). More info here. IMO, in depth knowledge of the new concurrency libraries will be required by most software professionals over the next few years. An embarrassing concurrency bug reared its head during a Microsoft Demo recently. You can read all about it here. August 15 Vista RC1 MilestoneVista is expected to be the first software product to ever sell one billion licenses. Obviously, the need for Microsoft to deliver a quality product is paramount. Bill Gates recently implied that there is a 20% chance of a delay. IMO, a 3-month slippage should be expected. In any case, it's interesting to note that Microsoft has consistently delivered monthly beta 2 builds. The next big milestone is Release Candidate 1 (RC1). Rumours are flying that RC1 will become available to Beta 2 testers on Tuesday, August 15. The latest update is that Microsoft expects to ship RC1 on or after September 7. The build number will be around 5520. Here's my revised take on the Vista delivery roadmap.
July 21 Coming ZuneThe Zune story is gathering steam. Microsoft's Xbox development team has been working on a Portable Music/Video Player for the past few months. The team is managed by Robbie Bach, J Allard and Peter Moore. They know the drill. The product is called Zune. It is scheduled to launch during this Holiday season. BTW, I love the name. The viral marketing site went live today: http://comingzune.com/. The music is a song called "Us" by Regina Spektor. Regina Spektor earned her wings in a club called the Sidewalk Cafe in Manhattan's East Village. The East Village happens to be my favorite neighborhood in New York City. Here's a bird's eye view of the Sidewalk Cafe. All roads eventually lead to the East Village. The Rolling Stones did a video in the East Village back in 1981. It was shot on St. Mark's Place in front of the same building that Led Zeppelin used for their Physical Graffitti album cover. June 30 DEFCON 14DEFCON 14 is quickly approaching. This year it will be held on the first weekend in August - Friday, August 4th to Sunday, August 6th. For those who don't know about DEFCON, it is a 72 hour caffeine-induced hackfest held in Las Vegas every year. It is the place to be for Black Hat, White Hat and Grey Hat hackers. Dmitry Sklyarov was arrested at DEFCON 9. Dmitry was arrested on July 17, 2001 in Las Vegas at the behest of Adobe Systems. He wrote a program for his employer that cracked Adobe's eBook DRM software. He then gave a DEFCON presentation about it and was arrested shortly thereafter. You can read about his hard luck story here. The underground hacker community fascinates me. It is not just the usual cast of characters, Kevin Mitnick and Dark Tangent but also hacking associations such as, Cult of the Dead Cow and L0pht (pronounced "loft"). I have never attended a DEFCON but hope to catch it one of these years. The security industry is interesting. It is definitely keeping the hackers on their toes. The cycle of evolving security techniques and strategies being implemented by developers and system administrators to thwart the malicious black hatters is endless. One of the most difficult web application vulnerabilities to guard against is called session hijacking. It is a classic web hacking technique that exploits the statelessness of the HTTP (and HTTPS) protocol. The attack occurs when a hacker impersonates a user and then hijacks the session ID. The two ways to hijack a session are: • Session ID Guessing and • Steal Session ID Cookies 1. Session ID Guessing This is a simple brute force technique that involves collecting a sample of session IDs and "guessing" a valid session ID that is assigned to someone else. It is similar to password guessing programs. However, in this case, Session ID guesses are made and submitted continuously until a success occurs or the session ends. Fortunately, most new web apps are not susceptible to Session ID Guessing because the Session IDs are implemented using highly random 120-bit numbers. 2. Steal Session ID Cookies The other common technique is to steal the Session ID Cookie. This is more difficult to defend against because there are many creative ways to steal it. A Session ID Cookie is an HTTP cookie that contains a Session ID. An HTTP cookie is a packet of information sent by a web server to a web browser and then sent back by the browser each time it accesses that web server. The cookie is stored in memory and eventually persisted to a file located in the browser’s file cache. The cookie data exchange is the most common way a web server tracks previous requests. Most servers store the unique Session ID in the cookie. The unique Session ID corresponds to data on the web server. Whenever the user sends a request with cookie containing the Session ID, the server: • Parses the cookie • Extracts the Session ID • Associates Session ID to some data • Uses data to re-inflate the Session Object For most hackers, executing a successful session hijack attack with a stolen Session ID Cookie is trivial. It is trivial because the Session ID Cookie is simply an encoded Session ID with no other information. A good defensive measure is to encode additional information (e.g., requestor IP address, user-agent header and maybe a secret key from the server) to validate the user. I will discuss more tactics / coding strategies in a later blog entry. In any case, please note that the key item to protect to thwart a Session Hijack is the Session ID. To be continued... May 25 SharePoint Conference 2006 WrapupHere's my final thoughts from last week's inaugural SharePoint Conference. Aside from the marketing fluff, I found the event to be extremely informative. It was fun to hear about SharePoint’s new directions. You can read more about it here. In any case, my three take-aways are: 1. Gunning for Google 2. SharePoint Designer versus Expression 3. David Letterman Style Feature List Item 1 - Gunning for Google: It is clear that Microsoft's Enterprise Search engineers are gunning for Google. The word of the day was "Search Relevance". David Mowatt’s search drill down session covered some of the details without revealing any "secret sauce" algorithms. The slide deck of his session is here. It seems inevitable that Microsoft's SharePoint Search solution will steal significant market share from Google within one year of MOSS "go live". For enterprise search, the Google Search Appliance will be tough to beat. This Map Reduce white paper is highly regarded even within Microsoft. Item 2 - SharePoint Designer versus Expression: An interesting story is developing around the new SharePoint Designer (formerly FrontPage) versus the Expression tool set. Expression is all about XAML whereas SharePoint Designer is basically old school asp. The future for SharePoint Developers is XAML web parts via Expression or Visual Studio 2005. I am curious to see how it will evolve. Item 3 - David Letterman Style Feature List: During Bill G's keynote, he gave a Lettermen-style Top 5 SharePoint Feature List. Top 5 things Bill G loves about SharePoint 2007 1. SharePoint for Composite Apps 2. Search and Business Data Catalog 3. Client Integration 4. Excel Services 5. Community (Wikis, Blogs, RSS) This is my Top 8 SharePoint | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||