Tag Archives: sharepoint

cloud computing, professional, sharepoint, web authoring

Perforce is developing a content management system called Chronicle, says we should version everything

1 Comment

I spoke to Christopher Seiwald, founder and CEO of Perforce Software, on the eve of the company’s 2011 user conference which starts today.

image

The Perforce product manages source code, dealing with version history, check-in and check-out, branching, merging and so on. It is excellent software, lightweight, fast and reliable, and there are Perforce clients for a wide range of development tools across multiple platforms. The company has been able to compete successfully against the likes of IBM and Microsoft by offering a tightly focused and vendor-neutral approach, with few dependencies, low management overhead, and fast performance.

Now Perforce is doing a web content management system, but why? “We thought the web content world was a very easy step for us, in terms of what we knew and what our customers are already using the product for.” says Seiwald. “We’re building a web content management system to sit on top of Perforce. It’s going to be open source, so our customers can extend it, and it’s built using PHP, Zend and Perforce. Our APIs are also open.”

If you look under the covers of a CMS system like WordPress, every post and comment is an entry in a database. In Perforce Chronicle, the database is abstracted by Perforce, and of course everything is versioned. “It is all hosted by Perforce, using more of a document model,” says Seiwald. “A database underlies everything, we have a database underneath our system. But the world shifted a long time ago, for certain things, from regularly indexed relational databases to things more like documents where you index everything, you index every word, because you can.”

Although the CMS system will be open source, the Perforce back end “remains our proprietary company jewels,” Seiwald told me. “I’m a big fan of open source. If we could figure out a way of funding our operation in an effective way with open source then we would, but we’re not that clever. The business model just seems to support having a proprietary back end.”

Nevertheless, there will be a free CMS server for small sites. The approach will be similar to that used for the version control system, where up to 2 users can use it for free. Sites with few authors and/or small amounts of content will likely be free. “My attitude has always been, get from people who are willing to pay their money, and if they’re not willing to pay, make sure they can use it anyhow.”

The features of the CMS are not yet available in detail, and Seiwald says the first release will be “as simple as possible. My goal is to get it out of the door so that you can manage a simple web site in Perforce. The guys who are working on the CMS are pushing to put more in; I keep pushing to get it out earlier.” However, since it is open source it should be possible to plug-in additional features.

Perforce Chronicle is part of a wider strategy, to embrace the cloud and to encourage users to version more of their content, perhaps all of it. “People are putting just about everything online somewhere, not just source code, because they think online is better than offline. Data sitting on your local desktop, that just makes people scared. Online, whether corporate online or out in the cloud online, is becoming more appealing.”

I am reminded of Microsoft SharePoint. In January 2009 I wrote a post SharePoint – the good, the bad and the ugly. Since that time SharePoint use has grown, but it still has that mix of great features, over-complex setup and maintenance, and parts that rarely seem to work as they should. I use SharePoint myself, and sometimes SharePoint decides that the document I have open is read-only, for no apparent reason. I have to save my changes locally, and then copy it back to SharePoint overwriting the original.

SharePoint may be awkward, but the problem it solves is huge: reasonably secure access to your content from anywhere, without VPN, and with versioning, programmability, and a bunch of other features. SharePoint is a way of storing content in the corporate cloud. Yesterday Apple released its iWork apps for iPhone, including Pages and Numbers. Using SharePoint web storage, I can open, edit and save documents and spreadsheets in Pages on the iPhone, for example.

Perforce source code management succeeded against ClearCase and PVCS by being simpler, faster and easier. What if Perforce web content management could do the same thing versus SharePoint? Although the Chronicle CMS has a narrower focus, listening to Seiwald it seems that his vision does extend beyond web sites and source code to embrace all corporate content. “You are all going down the road of versioning everything,” says Seiwald. Note that Perforce is getting a new web services API and a Javascript API. Seiwald describes a project his team is working on called “The Commons”:

It will provide the simplest of access to Perforce for the simplest of uses. Need to work on a document? Drag it to your desktop. Need to check it in? Drag it back to Perforce. Done. It not only is an example app for our new web services, but also takes advantages of the trend for simple, online document management – backed by the power of versioning in Perforce.

That is actually not quite enough. Users need to be able to double-click a document to open it, and save it directly from Office, before it is really seamless; and yes, SharePoint has that. Nevertheless, I think this is an interesting direction for Perforce, and done right could find a ready market.

There is a little more on Perforce Chronicle on the company blog, which is where I grabbed the screenshot, but expect more details soon as the conference proceeds.

apple, mobile, sharepoint, windows

Apple iPad, Pages and Microsoft SharePoint – it works

14 Comments

I’ve been trying out an Apple iPad 2 recently, and one of the topics that interests me is the extent to which it can replace a laptop.

That is a nebulous question of course – it depends what you use a laptop for – but one essential from my perspective is the ability to create and edit documents. Therefore I installed Apple’s iWork apps in their iPad guise: Pages, Numbers and Keynote.

Now, one iPad annoyance is that accessing its storage is more awkward than with a laptop. You cannot simply copy files to and fro over a network. You can copy files to the iPad using a network browser app like Stratospherix FileBrowser, but that works by opening recognised file types.

As for Pages, how it stores documents is opaque to the user. They save as you type, and you can manage them in a My Documents view within Pages, but if you want to move them elsewhere you have to use one of five options: email, iWork.com which is cloud storage for iWork apps, send to iTunes for synchronization, copy to iDisk which is cloud storage for MobileMe, or copy to WebDAV.

image

The options for opening a document are similar, but without the email or for some reason iWork.com options.

None of these options appealed greatly, except possibly the last one. I use SharePoint, which supports WebDAV, might this enable me to open and save documents from Pages direct to SharePoint? This is convenient for me, since I have SharePoint as a mapped drive in Windows Explorer, and it works both on the internal network and over the internet.

I typed a document in Pages, then went to My Documents and chose Copy to WebDAV. I chose Word format. Then I entered the URL, username and password for my SharePoint server.

Rather to my surprise, it connected immediately, and performance was good. I then went to my mapped SharePoint drive in Windows Explorer and there it was.

image

It works the other way too. I typed a document in Word 2010 and saved it to SharePoint in the default .docx format. Pages can import .docx, and the document opened smoothly.

image

I appreciate that I am in a small minority of individuals running SharePoint – I do it for test and review – but for business users this is a handy feature. Individuals might want to check out DropDAV, though I’ve not tried the service.

Update: I have tried this successfully with both SharePoint 2010 and SharePoint 2007. If SharePoint is using a port other than 443 for secure access, then you enter the full URL in Pages, for example https://sharepoint.yourdomain.com:444

However I have not yet been able to get this to work with SharePoint in Office 365.

cloud computing, microsoft, sharepoint

Hands on with Office 365 – great service, some hassles

I have been trying Microsoft’s Office 365 which has recently gone into public beta, and is expected to go live later this year.

This cloud service provides Exchange 2010, SharePoint 2010 with Office Web Apps, and Lync Server to provide a complete collaboration service for organisations who prefer not to run these servers themselves – which is understandable give their cost and complexity.

Trying the beta is a little complex when you already have a working email and collaboration infrastructure. I chose to use a virtual machine running Windows 7 Professional. I also pre-installed Office 2010 Professional in an attempt to get the best experience.

Initial sign-up is easy and I was soon online looking at the admin screen. I could also sign into Outlook Web Access and view my SharePoint site.

image

Hassles started when I clicked to setup up desktop applications. This is done by a helper application which configures and updates Outlook, SharePoint and Lync on your desktop PC. At this point I had not configured my own domain; I was simply username@username.onmicrosoft.com.

setup-office-365

The wizard successfully configured SharePoint and Lync, but not Outlook.

image

There was a “Learn more” link; but I was in a maze of twisty passages, all alike, none of which seemed to lead to the information I needed.

Part of the problem – and I have noticed this with BPOS as well – is that the style of the online help is masterful at telling you things you know already, while neglecting to tell you what you need to know. It also has a patronising style that I find infuriating, and a habit of showing you marketing videos at every opportunity.

I did eventually find instructions for configuring Outlook manually for Office 365, but they did not work. I also noticed discrepancies in the instructions. For example, this document says that the Exchange server is ch1prd0201.mailbox.outlook.com and that the proxy server for Outlook over HTTP is pod51004.outlook.com. That did not match with the server given in my online account for IMAP, POP3 and SMTP use, which was a different podnnnnn.outlook.com. I tried all sorts of combinations and none worked.

Eventually I found this comment in another help document:

Currently, the only supported scenario for configuring Outlook to work with Office 365 is a fully migrated environment.

I am not sure if this is true, but it did seem to explain my problems. Of course it would be easy for Microsoft to surface this information in a more obvious place, such as building it into the setup wizard. Anyway, I decided to go for the full Office 365 experience and to set up a domain.

Fortunately I have a domain which I obtained for a bright idea that I have yet to find time for. I added it to Office 365. This is a process which involves first adding a CNAME record to the DNS in order to prove ownership, and then making Office 365 the authoritative nameserver for the domain. I was not impressed by the process, because when Microsoft took over the nameserver role it threw away existing settings. This means that if you have a web site or blog at that domain, for example, it will disappear from the internet after the transfer. Once transferred, you can reinstate custom records.

Still, I had chosen an unused domain so that I did not care about this. I set up a new user with an email address at the new domain, and I amended the default SharePoint web site address to use the domain as well.

image

That all worked fine; but what about Outlook? The bad news was that the setup wizard still failed to configure Outlook, and I still did not know the correct server settings.

I could have contacted support; but I had one last try. I went into the mail applet in control panel and deleted the Outlook profile, so Outlook had no profile at all. Then I ran Outlook, went through the setup wizard, and it all worked, using autodiscover. Out of interest, I then checked the server settings that the wizard had found, which were indeed different in every case from those in the various help documents I had seen.

A few hassles then, and I am not happy with the way this stuff is documented, but nevertheless it all looks good once set up. The latest Exchange and SharePoint does make a capable collaboration platform, the storage limits are generous – up to 25GB per Exchange mailbox – and I think it makes a lot of sense. I expect Microsoft’s online services to win huge amounts of business that is currently going to Small Business Server, and some business from larger organisations too. Migration from existing Microsoft-platform servers should be smooth.

The biggest disappointment so far is that in Lync online the Enterprise Voice feature is disabled. This means no general-purpose voice over IP, though you can call PC to PC. To get this you have to install Lync on-premise:

Organizations that want to leverage the full benefits of Microsoft Unified Communications can purchase and deploy Microsoft Lync Server 2010 on their premises as part of Microsoft Office 365. Lync Server 2010 on-premises delivers full enterprise voice and premises-based, dial-in audio conferencing, enabling customers to reduce costs and increase productivity by replacing or enhancing traditional PBX systems.

though it is confusing since Enterprise Voice is listed as a feature of the high-end E4 edition; I believe this implies an on-premise server alongside Office 365 in the cloud.

Perhaps the biggest question is the unknown: will Office 365 live up to its promised 99.9% scheduled uptime SLA, and how will its reliability compare to that of Google Apps?

Office 365 is priced at $10 per user per month for the basic service (E1), $16 to add Office Web Apps (E2), $24.00 to add licenses for Office Professional, archiving for Exchange (E3) and voicemail, and $27.00 to add Enterprise Voice (E4). The version in beta is E3.

google, microsoft, sharepoint, Web, web authoring

The future of Google Apps: social features, high performance spreadsheets, working offline

2 Comments

Yesterday I spoke to Google’s Global Product Management Director for Google Enterprise (whew!) Matthew Glotzbach, at a press briefing for Google Apps which included the announcement of Google Docs Discussions, as covered here.

image_thumb

One of the issues discussed in the briefing was Cloud Connect, which I reported on here. Cloud Connect automatically copies and synchronises Microsoft Office documents with Google’s cloud storage. There are some performance and usability issues, but the biggest problem is that you cannot edit the documents in the browser; or rather, if you do, Google makes a second copy leading to versioning issues.

Google says this is a file format issue. The online Google Docs applications cannot edit documents in Microsoft Office formats – “the document models are completely different” says Glotzbach – though it can import and export those formats. Could Google develop the ability to edit Office documents online? “It is a technical challenge, something we haven’t built yet,” he added.

It is an interesting point. Microsoft’s Office Web Apps have flaws, but they do let you maintain the same document whether edited in the browser or in the Office desktop applications. It is an example of friction if you try to live partly in Microsoft Office, and partly in Google’s cloud. It may be better to stick with one or the other.

What about offline capability, something I hear a lot as counting against Google Docs. Google had a solution for this based on its Gears add-on, but then withdrew it.

We are actively working on offline. It is extremely important. Gears was a precursor. A lot of the ideas embedded in Gears have become part of HTML5.

says Glotzbach. I asked whether this will extend to the Chrome OS netbook operating system, and he said that it will:

Chrome, as the most modern browser based on HTML 5, has the capabilities built into its core. Chrome OS as a derivative of that has those offline capabilities baked into it, so it is a matter of having applications take advantage of that.

We also talked about the new discussions feature. I observed that it seems to be just one part of a bigger story. What about discussions spanning multiple documents? What about discussions without documents? Is there any way of doing that?

“Yes, email,” he said, chuckling. Clearly Google has taken to heart that email remains the de facto mechanism for most corporate collaboration. “We’ve also got Google groups. Obviously the manifestation of a group for many users is email, that’s how they interact with it, but there is also a destination site or page for that group.”

Might Google develop its own equivalent to Salesforce.com Chatter, for Twitter-like enterprise messaging?

The idea of eventually being able to pull in other streams, the idea of social media inside the enterprise Is a powerful idea. I think Chatter is a good example of that, and others such as Yammer. I think those ideas will likely find their way into businesses. It is not clear to me that social will be a destination within an Enterprise. Rather I see it as, features will emerge in various products that leverage those social capabilities. Discussions is influenced heavily by a lot of those social media ideas, and so you can see that evolving into more integrated social capabilities across the app suite.

What about Google spreadsheets, which seem great for simple tasks and collaboration, but suffer performance and scalability issues when used with large data collections that work fine in Excel?

There’s always work to do. We have today some limitations in terms of spreadsheet size. Those are things we are actively working on. With browser technologies I actually think we have an advantage over desktop applications. If I told you I had a spreadsheet that had 5 million columns and a billion rows, there’s no desktop spreadsheet in the world that can handle that kind of volume, but because we have in essence supercomputers on the back end processing that, what you display is just a window of that large data. So we’re using clever technologies like pre-fetching the rows and columns that are just off the edge of the page, similar to some of the technologies we use with Google Maps.

But it’s an example where we have some artificial limitations that we are working to remove. Imagine doing really sophisticated non-linear calculations in a spreadsheet. We’ve got a supercomputer on the back end that can do that for you in seconds.

cloud computing, google, sharepoint

Hands on with Google Cloud Connect: Microsoft docs in Google’s cloud

6 Comments

Google has released Cloud Connect for Microsoft Office, and I gave it a quick try.

Cloud Connect is a plug-in for Microsoft Office which installs a toolbar into Word, Excel and PowerPoint. There is no way that I can see to hide the toolbar. Every time you work in Office you will see Google’s logo.

image

From the toolbar, you sign into a Google Docs account, for which you must sign up if you have not done so already. The sign-in involves passing a rather bewildering dialog granting permission to Cloud Connect on your computer to access Google Docs and contacts on your behalf.

The Cloud Connect settings synchronise your document with Google Docs every time you save, or whenever the document is updated on Google’s servers.

image

Once a document is synched, the Cloud Connect toolbar shows an URL to the document:

image

You get simultaneous editing if more than one person is working on the document. Google Docs will also keep a revision history.

You can easily share a document by clicking the Share button in the toolbar:

image

I found it interesting that Google stores your document in its original Microsoft format, not as a Google document. If you go to Google Docs in a web browser, they are marked by Microsoft Office icons.

image

If you click on them in Google Docs online, they appear in a read-only viewer.

That said, in the case of Word and Excel documents the online viewer has an option to Edit Online.

image

This is where it gets messy. If you choose Edit online, Google docs converts your Office document to a Google doc, which possible loss of formatting. Worse still, if you make changes these are not synched back to Microsoft Office because you are actually working on a second copy:

image

Note that I now have two versions of the same Excel document, distinguished only by the icon and that the title has been forced to lower case. One is a Google spreadsheet, the other an Excel spreadsheet.

Google says this is like SharePoint, but better.

Google Cloud Connect vastly improves Microsoft Office 2003, 2007 and 2010, so companies can start using web-enabled teamwork tools without upgrading Microsoft Office or implementing SharePoint 2010.

Google makes the point that Office 2010 lacks web-based collaboration unless you have SharePoint, and says its $50 per user Google Apps for Business is more affordable. I am sure that is less than typical SharePoint rollouts – though SharePoint has other features.  The best current comparison would be with Business Productivity Online Standard Suite at $10 per user per month, which is more than Google but still relatively inexpensive. BPOS is out of date though and an even better comparison will be Office 365 including SharePoint 2010 online, though this is still in beta.

Like Google, Microsoft has a free offering, SkyDrive, which also lets you upload and share Office documents.

Microsoft’s Office Web Apps have an advantage over Cloud Connect, in that they allow in-browser editing without conversion to a different format, though the editing features on offer are very limited compared with what you can do in the desktop applications.

Despite a few reservations, I am impressed with Cloud Connect. Google has made setup and usage simple. Your document is always available offline, which is a significant benefit over SharePoint – and one day I intend to post on how poorly Microsoft’s SharePoint Workspace 2010 performs both in features and usability. Sharing a document with others is as easy as with other types of Google documents.

The main issue is the disconnect between Office documents and Google documents, and I can see this causing confusion.

Update: I uninstalled Cloud Connect after a couple of days. Two reasons. First, the chunky toolbar is annoying and takes valuable working space. Second, I had performance issues when working with documents opened from SharePoint. I guess the two do not get on well together.

Microsoft has its own unsurprisingly negative take on the product here. Apparently Cloud Connect uses the Track Changes feature under the covers, hence breaking this feature for any other purpose. If so, I would like to have been warned about this. On the other hand, I still like the usability of Cloud Connect. Microsoft is right to observe that auto-sync could result in inadvertent document sharing; but the simple and prominent sharing dialog is easier to use than SharePoint permissions.

microsoft, sharepoint, windows 7

Fixing slow access to SharePoint mapped drives in Windows 7

12 Comments

I’ve heard recently from a couple of people who found that accessing SharePoint folders via mapped drives in Windows Explorer had suddenly become very slow – even taking several minutes to open a folder. This is in Windows 7, but the same might (or might not) apply to other versions of Windows.

SharePoint folders in Windows Explorer use WebDAV (Web-based Distributed Authoring and Versioning) under the hood, so although it looks like just another shared drive it is actually using HTTP calls to list the files. It is useful if you are out and about, because you can get at documents on your internal network over the internet, using SSL to secure the connection.

The fix that has worked in both cases is a mysterious one. You open Internet Explorer (even if you use a different browser), go to Tools – Internet Options – Connections, click LAN settings, and uncheck Automatically detect settings.

image

I am not sure why this works but presumably with this option checked there is some sort of useless auto-detection going on which times out and then repeats.

No promises; but making this change can dramatically improve performance.

microsoft, professional, sharepoint

How Microsoft SharePoint makes simple things hard

3 Comments

When I was asked how to show file extensions in lists of documents on SharePoint sites I thought it would be a simple change to make. I did a quick Google and found several answers; but some of them involved editing core files that instinctively I thought should be left alone. I took a closer look and worked out the steps.

It turns out that you need SharePoint designer, plus you have to convert a web part to XSLT, and then figure out what to change in the rather complex page that is then generated.

A few observations.

First, I am surprised that Microsoft did not build in some easy way of showing the file extensions in a document library, which seems an obvious thing to want to do. There are hundreds of much more obscure things you can easily show, but not this one.

Second, it is nice that Microsoft has made its SharePoint Designer tool free, but I am not sure that the way it is presented is quite right. It is a techie product but I did not find Help particularly helpful. You know the kind of thing; you are in the Formula Editor, you hit F1, and you get a description of the dialog, when what you want of course is a reference to the formulae.

Third, when I did find the documentation I found it obscure. Here’s the reference for the @LinkFileName formula:

Returns a GUID that represents the icon that is used to create a link to a file in a document library, where the file can be edited by using a menu.

Hmm. I am not sure how many fat SharePoint books you need to read to understand why this particular formula is used as it is in SharePoint, or why String(@LinkFileName) returns the file name with its extension.

Fourth, I discovered that SharePoint deliberately hides the file extension. You can show the extension by removing the function that strips it off, in the formula that determines the contents of that cell.

Now I know why SharePoint is such good business for specialists.

.net, microsoft, professional, sharepoint, windows

Remote access to files in Microsoft Small Business Server 2011

Among the most interesting features in the new Small Business Server 2011 standard edition – I suspect it is in the Essentials version as well – is the ability to access shared folders remotely via a web application.

This is actually a feature borrowed from Windows Home Server, which also exposes shared folders in its remote access web application.

Note this is different from SharePoint, which is also available in SBS. SharePoint stores files in a SQL Server content database and publishes them in document libraries. Shared Folders by contrast are simple file shares. Although they lack the rich features of SharePoint, such as discussions, or check in and check out, they are faster and more convenient when all you want to do is to share files. Another benefit is that on the local network you can access shared folders directly with Windows Explorer. This can also be done with SharePoint, but under the covers it uses WebDAV – web distributed authoring and versioning – which is slower and can be tricky to get working, especially on Windows XP. SharePoint is also less suitable for files of types that it does not recognise, whereas a shared folder will accept anything you care to put into it.

While these may seem subtle distinctions, in practice they are not, and the matter of SharePoint versus shared folders is one that some businesses struggle with.

Now that you can publish shared folders through the Remote Web Access web site, this issue will be less pressing, since remote access without the need for VPN (virtual private network) is often the key reason for moving files into SharePoint.

The Remote Web Access site is not itself a SharePoint site; it is an ASP.NET application that you can find in C:\Program Files\Windows Small Business Server\Bin\WebApp\RemoteAccess. I noticed two ASP.NET user controls, one called filesgadget.ascx and one called richupload.ascx.

If you browse to this site, you can access folders and files in the SBS Shares to which you have access, controlled by NTFS permissions. The file sharing application will pick up any shared folders on the server. When you open a folder, the files are listed in the browser with options to upload, download, delete, rename, copy, cut or paste.

image

If you choose Upload, you can add documents by dragging them into the browser.

image

I also tried the site in Google Chrome. It worked, though not the drag-and-drop file upload. You can still upload files using a standard file chooser.

This looks to me like a great and overdue feature for Small Business Server. The only snag I can foresee is that some users may still find the SharePoint vs Shared Folder choice confusing and wonder why documents in the “Internal web site” are presented differently and with more features than those in shared folders. It may still be difficult to decide which to use; but at least the choice will no longer be driven solely by whether remote access via the browser is required.

microsoft, professional, Web

Crisis for ASP.Net – how serious is the Padding Oracle attack?

6 Comments

Security vulnerabilities are reported constantly, but some have more impact than others. The one that came into prominence last weekend (though it had actually been revealed several months ago) strikes me as potentially high impact. Colourfully named the Padding Oracle attack, it was explained and demonstrated at the ekoparty security conference. In particular, the researchers showed how it can be used to compromise ASP.NET applications:

The most significant new discovery is an universal Padding Oracle affecting every ASP.NET web application. In short, you can decrypt cookies, view states, form authentication tickets, membership password, user data, and anything else encrypted using the framework’s API! … The impact of the attack depends on the applications installed on the server, from information disclosure to total system compromise.

This is alarming simply because of the huge number of ASP.NET applications out there. It is not only a popular framework for custom applications, but is also used by Microsoft for its own applications. If you have a SharePoint site, for example, or use Outlook Web Access, then you are running an ASP.NET application.

The report was taken seriously by Microsoft, keeping VP Scott Guthrie and his team up all night, eventually coming up with a security advisory and a workaround posted to his blog. It does not make comfortable reading, confirming that pretty much every ASP.NET installation is vulnerable. A further post confirms that SharePoint sites are affected.

It does not help that the precise way the attack works is hard to understand. It is a cryptographic attack that lets the attacker decrypt data encrypted by the server. One of the consequences, thanks to what looks like another weakness in ASP.NET, is that the attacker can then download any file on the web server, including web.config, a file which may contain security-critical data such as database connection strings with passwords, or even the credentials of a user in Active Directory. The researchers demonstrate in a YouTube video how to crack a site running the DotNetNuke content management application, gaining full administrative rights to the application and eventually a login to the server itself.

Guthrie acknowledges that the problem can only be fixed by patching ASP.NET itself. Microsoft is working on this; in the meantime his suggested workaround is to configure ASP.NET to return the same error page regardless of what the underlying error really is. The reason for this is that the vulnerability involves inspecting the error returned by ASP.NET when you submit a corrupt cookie or viewstate data.

The most conscientious ASP.NET administrators will have followed Guthrie’s recommendations, and will be hoping that they are sufficient; it is not completely clear to me whether it is. One of the things that makes me think “hmmm” is that a more sophisticated workaround, involving random time delays before an error is returned, is proposed for later versions of ASP.NET that support it. What does that suggest about the efficacy of the simpler workaround, which is a static error page?

The speed with which the ASP.NET team came up with the workaround is impressive; but it is a workaround and not a fix. It leaves me wondering what proportion of ASP.NET sites exposed to the public internet will have implemented the workaround or do so before attacks are widespread?

A characteristic of the attack is that the web server receives thousands of requests which trigger cryptographic errors. Rather than attempting to fix up ASP.NET and every instance of web.config on a server, a more robust approach might be to monitor the requests and block IP numbers that are triggering repeated errors of this kind.

More generally, what should you do if you run a security-critical web application and a flaw of this magnitude is reported? Applying recommended workarounds is one possibility, but frankly I wonder if they should simply be taken offline until more is known about how to protect against it.

One thing about which I have no idea is the extent to which hackers are already trying this attack against likely targets such as ecommerce and banking sites. Of course in principle virtually any site is an attractive target, because of the value of compromised web servers for serving spam and malware.

If you run Windows servers and have not yet investigated, I recommend that you follow the links, read the discussions on Scott Guthrie’s blog, and at least implement the suggested actions.

microsoft, sharepoint

Microsoft cash cows alive and well, lame ducks still lame

Here is my quick summary of Microsoft’s just-announced quarterly results:

Quarter ending June 30th 2010 vs quarter ending June 30th 2009, $millions

Segment Revenue Change Profit Change
Client (Windows + Live) 4548 +1379 3063 +1134
Server and Tools inc. Azure 4012 +84 1546 +340
Online 565 +64 -696 -111
Business (Office) 5250 +683 3284 +578
Entertainment and devices 1600 +343 -172 -31

What’s notable about these figures? Well, the big-picture Microsoft question is how it is coping with industry transitions, in particular the transition from on-premise servers and desktop software to cloud services and mobile device clients. Of course you can debate the extent and speed of that transition, but I believe it to be real.

The story here is that Microsoft’s traditional products are still amazingly profitable, and that the effort invested in making Windows 7 a decent upgrade from Windows XP or Vista is paying off. Further, Microsoft Office sales actually exceed Windows sales. It does not really surprise me; despite the existence of capable cheaper or free alternatives, I rarely see business PCs that do not have Office installed; and Microsoft is busy locking in Enterprise customers with hooks between Office client and SharePoint server.

On the other hand, Microsoft’s progress in cloud and device looks amazingly bad. The figures are not all that easy to read, since Azure, Microsoft’s cloud platform, is part of the Server and Tools business; and BPOS, the cloud-based Exchange and SharePoint offering, probably sits there too. The “Online” business in the figures covers Bing and MSN, and earns its money primarily from advertising. This part of the business managed to turn in a loss greater than its revenue, which is remarkable considering how successful Google is with that same business model.

Entertainment and Devices is also hard to read. If you read the press release, it turns out that the reason revenue increased was not thanks to the success of Xbox or an unlikely rebound for Zune or Windows Mobile. Xbox actually declined, and so did Windows mobile, and the increase was thanks to increased sales of Windows Embedded:

Non-gaming revenue increased $35 million or 1% primarily reflecting increased sales of Windows Embedded device platforms, offset in part by decreased Zune and Windows Mobile revenue.

Windows Embedded is an interesting story. I don’t know how its figures break down, but I research things such as digital signage and point of service systems from time to time, and there is a lot happening in that space which deserves more attention from the technical press, especially as it directly touches our lives.

Despite the Embedded success, Entertainment and devices also turned in a substantial loss, though nothing like the horrors of Online.

Conclusions? One is not to write off Microsoft; it’s still a highly profitable giant. But the other is that the company desperately needs a big success outside Windows and Office to convince us that it really has a bright future. A sparkling launch for Windows Phone 7 would do nicely.