Sunday, April 27, 2008

Florent Closing: Neighborhood Betrays its Own Founding Father

Florent is closing.  I could have predicted it.  I still find it sad.  The place that transformed the Meat Packing District from no-go zone to hip, fun precinct is now, apparently, seeing its monthly rent rise from $5K a month to $60K.  No, that’s not a typo.  The irony, of course, is that the landlords wouldn’t even be able to get their current rent were it not for this pioneer. 

I’ve been going there since it opened in the 80s.  It was a place filled with beautiful people, and yet friendly and devoid of ’tude.  A combination that is increasingly rare now.  One of my best friends took his wife there on their first date.  I’ve taken 20+ years of friends and girlfriends, not to mention my wife :-)

The growing list of disappearing, important Manhattan fixtures is becoming too large to maintain.  My childhood and young adulthood memories are being plundered.

Florent is going out in style though. For details, see The Gothamist.

#    |

LogMeOut

Bye, bye LogMeIn.  Live Mesh includes a version of Remote Desktop, that works a lot like LogMeIn: it’s peer-to-peer, runs over HTTP and can (but doesn’t have to) run in the browser.  Management also feels simpler.  Plus you get the ability to copy files between local and remote machines via the clipboard (which LogMeIn’s free edition won’t do) and you can throw up a “curtain” on the host machine so that your remote session is not visible to people in front of the machine’s monitor.  And it’s all free.  As it should be, thank you!

Only issue is that syncing the local and remote machines’ resolution does not seem to be supported in the current preview.

#    |
 Saturday, April 26, 2008

Reported iFrame Attacks _Not_ Due to MS Web/Database Stack

Recent articles like this one have been speculating on the possibility that a potential flaw in IIS might be responsible for a rash of malicious iFrame attacks that have plagued the Web recently.

It would appear that IIS, ASP[.NET, and SQL Server are not the culprits.  A response to me and others, direct from Microsoft follows.

***

We have been investigating these reports today and just posted two blog posts about them:

http://blogs.technet.com/msrc/archive/2008/04/25/questions-about-web-server-attacks.aspx

http://blogs.iis.net/bills/archive/2008/04/25/sql-injection-attacks-on-iis-web-servers.aspx

The high-level summary is:

These *are not* a result of any known security issue with IIS, SQL, ASP or ASP.NET (or any other Microsoft product)

These are instead the result of SQL injection issues within the web pages/applications hosted on these sites

You can learn more about SQL injection issues and how to prevent them in a blog post Scott Guthrie did a few years ago here: http://weblogs.asp.net/scottgu/archive/2006/09/30/Tip_2F00_Trick_3A00_-Guard-Against-SQL-Injection-Attacks.aspx

 The above blog posts provide more details on the attacks and have pointers on how to make sure your site doesn’t have SQL injection issues.

#    |
 Friday, April 25, 2008

First Impressions of Live Mesh

Got my invite yesterday and got it all working today.  From the user’s perspective (which is the only on available at this point in time), Mesh offers three things (1) FolderShare-style file synchronization between PCs, including the ability to share your folders with invited members/users (2) SkyDrive-style cloud storage, file access and sync participation and (3) Remote desktop access to connected devices that is VPN/NAT friendly (i.e. it works over port 80, in a peer-to-peer fashion).  That’s it.  For now.  Kind of makes me wonder why even the BBC reported on this thing.

Also, if you remember when Ray Ozzie first got to Microsoft and first got his blog set up, he posted on something called Simple Sharing Extensions (SSE).  These extensions are to RSS (and ATOM, as it turns out) and allow simple feeds to function as the transport for synchronization.  SSE was later renamed FeedSync, and is the basis for Mesh.  And, in fact, you’ll see “news” feeds all over Live Mesh.  These are really easy to produce, given the FeedSync foundation to Mesh.

And that means that this whole thing is going to be programmable.  Mary Jo Foley’s got a slide on her blog that even shows that there will be Visual Studio integration for all this.  But there will also be JavaScript interfaces, and interfaces for other languages, and a whole URI-based convention for getting to everything.  Nice.  That makes it seem like it will be easy for me to sync the data my apps use, over the Mesh infrastructure (including the cloud storage bit) without writing a lot of code.  In fact, with a little LINQ magic, I should be able to query and iterate through files within my mesh-enabled folders and items within my Mesh-enabled applications.

Goody gumdrops?  Not yet.  Because until Microsoft cleans up the mess of things it’s created that cry out for synchronization, no amount of DIY programmability is going to make me happy.  I’ve been thinking about this today.  Here are some things I’d like to be able to sync.  Easily:

  • Photos (to my PCs, Media Center/Windows Home Server, and mobile phone).  And I want the option to downscale the resolution on the copies pushed to my phone.  And I want the ability to push/pull content to flickr, Snapfish, Shutterfly, etc
  • Music (to my PCs, Media Center/Windows Home Server, mobile phone, and MP3 player).  And I want the option to downscale the bit rate on the copies pushed to my MP3 player and phone. 
  • Outlook calendar, contacts and tasks (between two separate Outlook instances on my home and office PCs).  And somehow this should work along with (and not against) Exchange Sync and ActiveSync/Windows Mobile Device Center.  And I want the ability to sync certain of my contacts with Facebook, Twitter, Windows Live, and other online services and social networks.  No more double entry, and no more forcing me into an all-or-nothing situation in terms of what gets synced.
  • OneNote notebooks, or sections or section groups between PCs and onto OneNote mobile (over the Internet, not only through USB and Bluetooth)
  • SharePoint libraries and lists should also be an endpoint, and a source, of data
  • Favorites, between my Favorites folder, and Live Favorites, and del.icio.us and others.  Make it work with Digg too.  And with Windows Help favorites.  And push mobile favorites to mobile devices as an easily selected option.
  • Internet radio stations.  Push their URLs properly into Windows Media Player, Media Center, my Sonos setup, and the Resco Radio app on my phone.  Not to mention any internet-enabled MP3 player.
  • RSS feeds, of course.
  • Backup volumes, from my local or NAS drive to my Amazon Simple Storage Service account or my records retention vendor’s server.
  • Ability to sync specific douments automatically to FedEx Kinko’s, Mimeo, and other printing services.
  • A configuration of all of the above assets (perhaps in the form of an OPML file), so that when I get a new PC, I can instantly get it syncing all the right stuff

Right now, here are all the different Microsoft Sync technologies I can think of.  Let’s get them all to use Mesh under the covers, and get them to work in a federated, cooperative fashion:

  • Exchange Sync
  • ActiveSync (Windows Mobile Device Center)
  • Offline files
  • Vista Sync Center
  • Windows Media Player sync
  • SQL Server Merge Replication (Is this too big a stretch?  I don’t think so.)
  • SQL Server Compact Edition Sync Services

It’s getting close to 1am now, so I’ll stop.  But I bet the above lists are nowhere near comprehensive.  The point is that a transport isn’t enough.  We need something that understands devices contextually and has a good idea of what to sync where, and at what quality. 

#    |
 Wednesday, April 23, 2008

Office 2007 Not OOXML-Compliant? And Your Point Is...?

A few articles have cropped up in the last couple of days on Office 2007's "failing" OOXML compliance tests.  If you're interested in reading up on that, perhaps you'd like to start with the slashdotting of it.

Well, the whole point of moving a proprietary file format into open standardization is that the format is controlled by the standards body and gets changed along the way. This has already happened with OOXML, and this is the reason for the apparent non-compliance.  So this "failure" is actually a success.  Or, to quote Run D.M.C.,  "Not bad meaning bad, but bad meaning good."

A more precise explanation, with background information, can be found here.

#    |