In order to completely understand this flaw you must understand something of the Achilles heal of Internet Explorer – ActiveX. ActiveX is a powerful application programming interface or API in Windows. ActiveX controls can perform a vast number of tasks in the operating system and in Microsoft Office. Many of these ActiveX controls as they are called were never designed to be run from a web browser. By default, Internet Explorer however can run ANY ActiveX control that is installed in your system.

The ability to run any ActiveX control in your system is a serious security issue which came from a time when Microsoft was not nearly as concerned about security as they are today. A good analogy of this is the evolution of the firewall. In the early days of the Internet you would deploy a firewall to block certain ports but keep all other ports open. Today it is completely the opposite. You block ALL incoming ports to the internet and only open one if there is a compelling reason to do so. Likewise Microsoft erred in opening all ActiveX controls to be used by Internet Explorer. What they should have done was block all controls and allowed only ones that made sense. Changing to this model now however would kill application compatibility for large numbers of users. This is especially the case in large businesses where custom ActiveX controls are commonly used.

As a result of this, Internet Explorer is constantly being “updated” by disabling certain ActiveX controls where vulnerabilities are found. This update is called a Killbit. The flaw is not patched. The ActiveX control is simply disabled in IE by the implementation of the killbit. As you might expect there are a vast number of known ActiveX flaws that have been disabled (over 175 to date) and where code is available on the internet for their exploitation.

In July Microsoft became aware of code currently running on the internet which had the capability of bypassing the Killbits. This code would allow Internet Explorer to then run ANY ActiveX control and allow the code to exploit the underlying flaw, even ones whose killbits had previously been set. This was and is a HUGE problem. Microsoft patched this problem with the killbits as quickly as possible and rolled out the patch which is the subject of this article (Microsoft Security Advisory 973882). If you have not installed this patch. Install it now. It is important.

Anyone who has Vista now will be able to put the disk into the computer and upgrade the operating system. This so called “In Place Upgrade” is entirely possible, will almost certainly work, and will likely give you a less-than-optimal experience with the new operating system. As most system admins will tell you it is best to do a “Clean Install”. To do a clean install, first backup you data and save your settings with the settings backup utility on the DVD. Then install the OS by booting off the DVD and formatting the drive. This ensures that there are no hooks from the old OS still in the system that may slow down the new OS or worse make it less stable. This clean install method, however, does require you to reinstall all of your applications. Then of course you must restore your data and settings. This is the preferred method of “upgrading” but ideally it should be done by a qualified technician as there can be issues with drivers which may require downloading from the PC manufacturer or the maker of the component that is having an issue. If you wish assistance with such an upgrade of any type you can contact Earl Consulting Services and we will be pleased to help you. If you don’t wish to have a technician, just be prepared to be patient as it may take some time to acquire the appropriate drivers. Generally speaking Vista drivers will work just fine with Windows 7 as the driver model has not changed so if your computer runs Vista properly it should run Windows 7 without difficulties. The same cannot be said however for Windows XP.

To upgrade Windows XP you MUST do a clean install. You cannot do an in place upgrade. Windows XP is so very old that Windows 7 incompatible with it from a driver standpoint and requires a clean install. Also if your hardware is very old (remember Windows XP came out in 2001), there may not even be Vista drivers for that hardware and it may not be capable of running Windows 7. Also if your system is running XP but is relatively slow, you may want to consider not upgrading as Windows 7 will be ever so slightly slower than XP on equivalent hardware. Such users should consider buying a new computer and having that computer come preinstalled with Windows 7 and not purchasing this limited time upgrade offer. If your computer is incapable of running Windows 7 and you purchased this upgrade, it would be a waste of money.

This limited time upgrade offer from Microsoft is a great deal. Be sure to make an informed choice based upon your current operating system and what your are willing to go through to make your system optimized for your needs before you buy.

First a little background.  What is DNS?  DNS is the Domain Naming System which is essentially a phone book for web sites.  Your browser has no idea how to find a URL like http://www.microsoft.com without it.  What the browser does is it looks up www.microsoft.com in DNS and DNS responds with the address 208.67.219.132.  Ahh!  Now that is something that the browser can use.  It then contacts the web server at 208.67.219.132 and downloads the web page.

The problem comes in when your ISP gives you DNS servers that have not been upgraded in 10 years, are overloaded, and sometimes painfully slow.  Don’t get me wrong, they work, but you can do better.  Additionally these servers are truly yesterday’s technology.  They have no filters for malicious content.  They also have no provision for parental controls.  Think of a DNS server that knows when you are going to a phishing site, refuses to provide an ip address for that URL and instead displays a page that informs you that you were about to go to a malicious web site and that action was blocked.  Imagine also a way to optionally protect your children from adult content in the same fashion.  Once URL’s of this content cannot be looked up and transformed into ip addresses, the content essentially ceases to exist and is no longer a threat.

Gee this sounds great!  How do I do this?  The answer is to go to www.opendns.com and sign up.  It is free. The OpenDNS name servers are 208.67.222.222 and 208.67.220.220.  If you are at a residence, change the DNS servers on your computer in the TCP/IP properties or if you have a router, change the DNS server settings in the router.  OpenDNS.com has detailed instruction on how to do this for most all routers in use today.  If your are at a company and have a server infrastructure, you will need to set up a forwarder on your local DNS server.  Check with your network engineer or contact Earl Consulting Services for assistance.

Once the DNS servers are set up you can configure your account by adding your network to the interface and defining the filters. You can see the filters detailed here:

By default the service blocks phishing attacks but can be customized to your needs.

OpenDNS.com provides an outstanding service by improving your network performance and optionally improving your network security.  It is free.  This is, in my opinion, a no-brainer for all residences and businesses.

The problem with network documentation is that it is incredibly boring. Engineers moan when thinking about doing documentation all day.

Luckily I have discovered and have began work with an excellent utility that provides very detailed, nicely formatted documentation automatically. This utility is called SYDI. Unfortunately, it will not do everything. Passwords must be added in additional documentation but the documents can detail the configuration of the computer it is run on.

SYDI can be run in two main modes. One mode is run locally on a single machine. This mode creates a Microsoft Word detailing, in excruciating intricacy, the configuration of the machine. Typically this document ranges from 30 to 50 pages long. I run this mode on servers for maximum detail. The other mode is run over the network and details network configuration, software inventory and such in a Microsoft Excel spreadsheet. I typically run this mode on all the workstations in a network.  These output files can be used as is or changed to suit your needs and easily updated by rerunning the utility.

Setting up and running the software on a single machine is simply a matter of running a script and defining where you want the output file created. Running the utility across a network is a different matter. It requires making specific changes to an .XML file and changing a myriad of command line options as appropriate for your environment. Once this is done however, updating your base documentation is a simple matter.

This utility does not remove all the tedious work in creating your network documentation but makes it more palatable for your engineer and maybe even a little bit of fun.  Have your network engineer try SYDI today or contact Earl Consulting Services for assistance.

Safari claims to be faster than other browsers. This claim has dubious value. Modern browsers are very fast. IE, Firefox, Chrome and Safari are all extremely fast. Claiming that a browser is 10% faster, even if true, is immaterial to the browsing experience. It just doesn’t matter. In fact every browser seems to claim a speed advantage in some aspect of the browsing experience.

Why would I want another standards based browser. From the standpoint of this consumer I have an excellent browser. Firefox. This is a standards based browser that allows for a truly enormous number of addons. 7265 at last count for every conceivable application. Firefox is light, fast and highly extensible. Safari is light, fast, and … that’s it. Firefox is the only browser that has embraced an echo system around itself. Mozilla (makers of Firefox) have helped to foster a community of developers that create applications that add on to the browser and extend it’s functionality in a myriad of different ways. No other browser does this and again I have to ask … why?

Safari in fact is the exact opposite of Firefox where it comes to add ons. Apple’s focus always seems to be that they know exactly what the optimal experience should be. They know best. On the iPhone for example, you can only have one browser and one email client. There is no choice. They allow applications so long as they do not compete with the Apple experience. Steve Jobs cult of personality reigns supreme.

Safari and Chrome (Google’s foray into the browser market) need to understand that they should support a community of developers to create add ons to increase value and to add to the echo system of their respective browsers. Just like the iPhone created added value by supporting applications. Browsers must do the same. Now it would seem all smart phones must have an app store as a cost of doing business. Firefox is the only browser that thinks the same way about browsers.

Internet Explorer is an excellent browser for compatibility. There are many sites that were built from the ground up to be compatible with Internet Explorer. They are compatible with NOTHING else. To use these sites correctly, you must use Internet Explorer. These sites are the exception to the rule however and a standards based browser does just fine for most browsing. Nonetheless Internet Explorer will be the most compatible browser for the foreseeable future. Beyond that does IE have the value to compete. As it stands right now, probably not. IE8 has added a wealth of new security features that make it interesting but nothing approaching Firefox add ons like NoScript. IE will always be available by default in Windows and as a result will command a huge market advantage. The masses will simply use what is on the machine.

Clearly Safari 4 represents an upgrade in browsing experience on the Mac where Safari is the only browser that comes with the operating system. On the Mac upgrading is a no brainer. Again the masses will simply use what is on the machine. On the PC however it needs to be said that Apple products like iTunes and Safari are just horrible. They seem slow, inefficient, and the result of a half hearted effort by apple to bring their applications to the PC. If there was another program that was as full featured in managing my iPods on the PC I would be thrilled to dump iTunes. Safari is not much better.

On the merits of the browser itself, Firefox is the clear choice and it would seem that some of the competition is using gimmicky eye candy in a lame attempt to compete. Until they understand that the browser is less a gimmicky user interface and more of a platform and echo system the browser market will only have one clear winner. Firefox.

For many of you, I realize that you have just tuned out. Windows 7? What is this? Another flop like Vista? Answer: No. It is not. But it is important in this conversation to discuss Windows Vista, as Windows 7 is an evolution of Vista.

Windows Vista was an operating system that was almost six years in the making. Windows XP came out in 2001 and Windows Vista arrived late 2006. That is an enormous amount of time in the computer industry and, as a result, Vista had some enormous innovations. Many aspects of Vista’s security, driver model and interface were huge departures from earlier operating systems. In all of those changes, Microsoft seriously fumbled in two important areas.

One: performance. I know no other way to say it. Vista is a bloated hog of an operating system. It is slow. Sometimes enormously slow on hardware that runs XP well. Vista requires fast processors and lots of RAM to make up for poor, inefficient programming. This one reason is why I have NOT deployed Windows Vista to any of my clients. Clients will get much more bang for the buck by sticking with Windows XP. To be fair many of Vista’s more obvious shortcomings have been dealt with. For instance, a nasty network file copy issue was fixed long ago and rolled into Vista Service Pack 1. Now that Vista is on Service Pack 2 the operating system is mature and stable. I have always recommended Vista for home users as home users can benefit from the increased security so long as they have newer, Vista compatible programs and fast hardware that can run Vista well.

Two: driver incompatibility. This was a real sticking point for a long time. Vista’s driver model is completely different from XP so XP drivers have no chance of working on Vista. Couple this with the fact that hardware manufacturers had little or no incentive to update their drivers to very old hardware to run on Vista. Hardware manufacturers have slowly developed more drivers over time so the situation has steadily improved but still remains a problem. So long as you do not have a computer or peripherals that are more than 4 or 5 years old, you should be able to run Vista well. Older than that… You’re on your own. Also, with Windows 7 coming out, I have started to notice that XP support for drivers is starting to lag. Manufacturers are seeing Vista as the mainstream OS and looking at XP as a legacy OS. Now that 7 is coming out, drivers have to be developed for Windows 7 and no manufacturer wants to support three mainstream OS’s.

Ok now that I have established that Vista sucks, let’s talk about Windows 7.

Performance: One of the main goals in the development of Windows 7 was the desire to run Windows 7 on netbooks. What is a netbook you may ask. Netbooks are one of the hottest selling categories of computers these days. They are in essence a very small notebook that uses very little power. They predominently run on the new Intel Atom processor which allows them to have excellent battery life along with decent performance rouphly equivalent to an old Pentium IV. The graphic displays on the units are ususally around 10″ but very good high resolution displays for the size. Advances in inexpensive display technology really allowed this category to take off. Anyway these underpowered notebooks have been shipped with Windows XP and cost around $300.00. Vista has no chance of running on this hardware. Microsoft wants a piece of this market so improving the performance of Vista was one of the key things Microsoft needed to accomplish. Based upon the latest Release Candidate of Windows 7, I can tell you that they succeeded brilliantly. Windows 7 runs very will on just 1 GB of RAM and I have run it on a Pentium IV machine and it runs great. I am sure that it is a little slower than XP but if it is, it is not by much. 7 is a joy to run from a performance standpoint. It is FAST and runs in a much smaller memory footprint than Vista.

Driver Compatibility: As I have already stated, slowly the Vista driver situation has improved. Now for new and most older hardware, you can find drivers for Vista. The Vista driver model remains unchanged in Windows 7. Microsoft says that if your hardware works with Vista it will work with Windows 7. This is a bold statement that so far I have no reason to doubt as I have read no evidence to the contrary so far and everything I have run has gone smoothly.

Windows 7 offers greater security, greater stability, impressive networking features, as well as a highly publicized XP Mode that allows you to run older applications that are incompatible with Vista or 7 in a true XP environment. It provides these features in an OS that is fast, very stable and avoids all the pitfalls of Vista. Microsoft is being very careful to polish this operating system as well as it can to ensure users have the best experience possible.

Personally, I cannot be more impressed with Windows 7 so far. In my view this Windows version is shaping up to be the BEST WINDOWS EVER. No joke.

The latest leak was Office 2010 Technical Preview which was released on the torrents May 16th. A Technical Preview edition is an alpha version of software released typically to registered developers to allow these users to work with and understand the underlying API’s of the product. It is not intended typically for regular users as there can be large numbers of bugs and even areas of the product that do not work properly.

This version of Office 2010 however appears to work very well. I have experienced no stability issues and have used it for more than an entire day of intensive work. Outlook appears fully functional with Microsoft’s Activesync technology synchronizing with Exchange Server. The most obvious change to Outlook is the new Ribbon Bar which was quite intuitive to operate. I had no problems finding the most typical functions I would normally find in Outlook 2007. Word functions well with few differences I can see to Word 2007. I did have not had occasion to work with Excel, Powerpoint or Access yet but upon opening the products I can detect no extreme differences.

I will post additional updates as I work with the products more.

I ran into an issue installing XP Mode however. Currently I have Windows 7 running in a virtual machine in VMWare Workstation on my computer. Unfortunately, the virtualization optimizations that exist on the main processor of my workstation do not show up within the virtual machine Windows 7 is running under and, since XP Mode requires these optimizations to be present, the installation failed. In order to test this product I will have to install Windows 7 on a computer and not a virtual machine.

This has ramifications to clients who may be interested in moving their desktop computers into a virtual environment. In this configuration, XP Mode would not be available and thus all applications would have to be compatible with Windows 7 natively.