Patch Tuesday To Address Multiple Microsoft Bugs

IT pros can expect a mammoth patch release for the month of October on Tuesday if Microsoft's advance notification is any indication.

In this month's upcoming security patch slate, there will be eight "critical" items and "five" important hotfixes, Microsoft suggests. And it appears Redmond isn't just playing catch up with lingering issues but will cast a wide net. This rollout aims to patch Windows components as well as Microsoft Office, SQL Server, Silverlight, Visio and other Microsoft solutions.
Remote code execution (RCE) exploits are once again the predominant theme. Ten bulletins will have RCE implications. Spoofing, elevation-of-privilege and denial-of-service risks will round out the batch of incursion considerations.

Critical Patches
All of the critical patches will aim at addressing RCE vulnerabilities. The first three critical patches will be Windows hotfixes.

Item No. 1 is expected to touch Vista and Windows Server 2008, while the second critical item will affect every OS except for Windows 7. Critical patch No. 3 will cover every OS except Vista, Windows Server 2008 and Windows 7.

For the fourth critical item, Redmond plans to switch gears. It will be a Windows and Internet Explorer combo fix. This bulletin will address IE versions 5.01 through 8 along with Windows OSes.

The fifth critical item will address every currently supported Windows OS. The sixth item will affect Microsoft Office components sitting mainly on XP operating systems, including Outlook, Visio and Visio Viewer.

The last two critical bulletins will deal with Web, server and developer components. Critical patch No. 7 will apply a fix to Microsoft Silverlight developer tools. The last critical item will be a grab-bag of fixes for Microsoft Report Viewer, SQL Server, Microsoft Forefront, Visual Studio.NET and Visual Studio FoxPro programs.

Important Patches
All of the important fixes will be Windows patches, according to Microsoft. The first and third important patches will address RCE exploits. The second important patch will be designed to thwart spoofing attacks. Important items No. 4 and No. 5 will tackle elevation-of-privilege and denial-of-service vulnerabilities, respectively.

What's common about the five important patches is this: besides being Windows patches, they will all touch Windows 7.В 

Four of them affect every OS that's currently supported by Microsoft, plus Windows 7. Important patch No. 5 will cover the same turf except for Windows 2000 Service Pack 4.

Microsoft's October security patch release likely will keep IT pros busy with installation and testing tasks. Moreover, every single hotfix could require a restart. For those wanting more, Microsoft released this knowledgebase article describing nonsecurity and system updates that will come via Windows Server Update Services, Windows Update and Microsoft Update.

Tyler Perry’s ‘I Can Do Bad All By Myself’ Makes Good At Box Office‘Critical’ Windows Fixes Expected on Patch Tuesday

Microsoft Plans Scaled-Down Team Foundation Server

Microsoft hopes to convince development shops to move from its Visual SourceSafe version control management system to the more modern Visual Studio Team Foundation Server, by offering a scaled-down version of TFS.

The company on Monday took the wraps off TFS Basic Profile, which will work with the upcoming release of Visual Studio Team System 2010, expected next year. Matt Carter, director of Visual Studio product management, disclosed plans for TFS Basic Profile in a presentation at VSLive!, taking place this week in Orlando.

TFS Basic Profile aims to overcome two core objections to the full-blown TFS: high cost and complex installation, Carter said in an interview. While TFS requires a full server install, the new TFS Basic can run on a client device running Windows Vista or Windows 7. Microsoft is not yet revealing pricing, but Carter said it would appeal to those on Visual SourceSafe.
"There are still a lot of people who have stuck with Visual SourceSafe even though it wasn’t the most modern tool, because it was easy to set up, maintain and administer, and it required less hardware than TFS," Carter said.

"If you have a machine sitting under your desk and that's been the box you use for source control, you will have more options than you had previously," he added. "It's for those who want to walk rather than run with TFS. They can get up and running quickly and without the level of commitment of a full Team Foundation Server install, but when they need it they are able to migrate up."

Observers say Microsoft has struggled to convince IT organizations wedded to VSS, which has been around for nearly 15 years, to move to TFS. Many have moved to open source alternatives such as CVS and Subversion.

"Microsoft has been losing share because even though they have a better source code control solution than Visual SourceSafe but it costs more and requires a more complex installation," said Andrew Brust, chief of new technology at twentysix New York and a VSLive! program organizer who attended Carter's session.

"This is a way to recapture the people who used Visual SourceSafe and bring them back to the Microsoft fold with a clear path to upgrading to the full TFS if and when that time comes," Brust added.

 

Microsoft Offers Security Lifecycle Tool for VSTS‘Ninja Assassin’ Star Rain Answers Your Questions

Microsoft Security Essentials To Arrive on Sept. 29

Microsoft Security Essentials (MSE), Redmond's free consumer security software for PCs, will be available for download by the general public on Tuesday.

The rollout of the antimalware solution comes after three months of public beta testing, limited to thousands of users. The software offers basic protection against viruses and spyware. The free MSE offering likely will compete with paid security offerings from McAfee and Symantec.

MSE is sometimes described as a replacement for Windows Defender, a free app from Microsoft that just removes spyware. Apparently, the two security apps can exist side by side. MSE disables Windows Defender and users don't have to remove it, according to a June Microsoft forum post.
MSE will be available for download on Sept. 29 for use on "genuine Windows-based PCs," according to Microsoft's announcement issued on Monday.

The software will work with the following operating systems: Windows 7, Windows Vista and Windows XP using Service Pack 2 or 3. It's designed to use a small amount of CPU and memory resources and run on older PCs, according to Microsoft's announcement.

MSE also will work with Windows XP Mode, which is Microsoft's virtualized XP desktop that runs on Windows 7. Both x32 and x64 versions are supported.

The solution was formerly known by its code name, "Morro." Microsoft launched Morro with the aim of broadening security protection to Windows users. Microsoft had earlier experimented with a subscription-based security product for consumers, called Windows Live OneCare. However, Microsoft discontinued retail sales of OneCare in June, although it extended coverage for subscribers during the OneCare-to-MSE transition period, according to a Microsoft forum post.

MSE uses the same basic technology as Microsoft's "security solutions for businesses," according to Microsoft's announcement. Microsoft currently offers a suite of non-free security solutions to businesses all under its Forefront brand. The company's offering for PC malware protection in the enterprise is called Forefront Client Security.

The software likely won't meet most IT department requirements for security. MSE notably will not integrate with Microsoft Network Access Protection technology and Microsoft System Center management products. It also can't be controlled via group policy settings.

Microsoft plans to roll out MSE in eight languages, in 19 countries, on Tuesday. Those countries include "Australia, Austria, Belgium, Brazil, Canada, France, Germany, Ireland, Israel, Italy, Japan, Mexico, the Netherlands, New Zealand, Singapore, Spain, Switzerland, the United Kingdom and the United States," according to the announcement.

The home page for the MSE solution can be accessed here.

Microsoft Security Essentials Beta Available June 23‘Twilight’ Documentary Screening To Take Place In Forks

Microsoft's Ramji Joins Sonoa Systems

The mystery of where Sam Ramji is headed is over. The former senior director of platform strategy at Microsoft has led Redmond's open source efforts since 2006. Now Ramji is reuniting with his erstwhile BEA Systems colleagues to head product strategy and business development at Sonoa Systems.

Sonoa provides API management, allowing developers to add policy management, security, governance and scale to enterprise applications running in the cloud. The Santa Clara, Calif.-based company delivers the technology via appliances and through a services-based offering.

Ramji announced that he was leaving Microsoft three weeks ago, in conjunction with the launch of the CodePlex Foundation, a non-profit 501.c6 organization with a stated mission to enable "the exchange of code and understanding among software companies and open source communities." Microsoft seeded the CodePlex Foundation with $1 million in funding. Ramji agreed to serve as the foundation's interim president during its first 100 days as it seeks to establish itself. During his final weeks at Microsoft, he was primarily focused on getting the foundation off the ground.
"I had very little time for anything else," Ramji said in an interview. "I was dealing with very mundane logistics like getting a tax ID and opening a bank account and all the things required of creating a startup that you don't necessarily associate with a non-profit foundation." See also, Exit Interview: Sam Ramji Assesses Microsoft's Open Source Ascent.

While Ramji had disclosed his decision to relocate back to California and indicated he would be joining a Silicon Valley cloud infrastructure startup, he declined to reveal the new company until after leaving Microsoft. Ramji's last day at Microsoft was Friday and he joined Sonoa this week. Ramji's decision to join Sonoa came as a surprise to Steve Coplan, an analyst at 451 Group who has followed the company.

"Sonoa has not made a big bet in open source to this point," Coplan said in an interview. "His experience will come in handy in developing relationships with platform-as-a-service vendors, and particularly in terms of controlling access to development platforms in the cloud"

Ramji acknowledged that Sonoa to date has not made any major open source bets. But he said that engaging a larger developer community is key to developing more services. "A sensible way to do that includes an open source offering," he said. "The more we can enable developers to build secure and scalable cloud services quickly, the more services will be available as part of this cloud service economy."

Sonoa, founded in 2004, offers technology that Ramji said will be critical to enterprises looking to deploy applications in the cloud with the same scale, security and service level as on-premises systems.

"It's hard to produce a performance-neutral cloud API gateway that can do the kinds of packet inspection and routing and transformation that is required to build a scalable cloud service and enable those things to operate within service level agreements, performing in real time," Ramji said.

Key to developing the gateway is Sonoa vice president of products Ravi Chandra, who like Sonoa CEO Chet Kapoor and Ramji worked at BEA Systems (now part of Oracle). The three helped build a developer-focused business based on BEA's WebLogic and AquaLogic Web services integration technologies.

Among other things, Chandra was a key architect who helped create the Border Gateway Protocol (BGP), the core routing protocol of the Internet. "He has incredibly strong networking and low level core protocol chops, as well as the kinds of insight required to take application semantics into the network," Ramji said. "It's rare to find people who are good at applications and networks."

Sonoa offers its gateway as hardware- and software-based appliances, as well as through a service hosted on Amazon's EC2 cloud service. Ramji didn't rule out the possibility of supporting other cloud services over time. "I don't see anything preventing us from getting there," he said. Likewise, he hopes to play some role in promoting cloud interoperability. "It's been a point of personal interest and it's going to continue to be," he said.

In August, Sonoa launched a preview of Apigee, a service that provides Web analytics of mashups and API usage. Apigee creates a dedicated API proxy that can be used within an app, according to the company.

As Ramji embarks on his new assignment at Sonoa, he said he is satisfied that he accomplished his goal of seeing Microsoft embrace open source technology.

"I am not saying it happened overnight, it was pushing on four years or so but more and more people have gotten on board with it and it started to go faster and faster," Ramji said. "What I expect to see from Microsoft in the coming 12 months would probably be conservatively twice as much open source contribution activity than we saw in the previous 12 months. The open source concept is really spreading across the engineering teams inside the company. It's really becoming part of the DNA"

Kim Basinger In Talks To Play Zac Efron’s MomAlfresco Launches Cloud Developer Program

Report: IT 'Tech Boom' Will Revive Next Quarter

The global IT market will see an upturn, starting next quarter, according to a report released last week by Forrester Research.

Such optimism in the face of the current economic downturn may seem a bit unwarranted at this point. However, Andrew Bartels, the report's author and analyst at Forrester, pointed to recent revisions on IT investment data by the U.S. government. The data now indicate that 2008 was a better year than previously indicated.

The revised data shows that a "tech-boom" actually occurred in the IT market, beginning in 2007, according to Bartels in the report, "US and Global IT Outlook: Q3 2009."
"If there were any surprises in this report, it was that 2008 was better than what we had projected and 2009 was worse," Bartels explained in a telephone interview. "This makes 2010 look a little better than we expected, and it marks the return of a tech boom that started in 2007."

The boom was snuffed out by a deeper-than-expected recession and a financial crisis that put capital investment in reverse. Bartels added that a general dissatisfaction with Microsoft's Windows Vista operating system had many companies putting off buying new PCs.

"The whole PC category had been going into a slump both from the release of Vista and because of emerging technologies such as netbooks and smart phones," Bartels said. "We see the release of Windows 7 as playing a factor in new capital investment in PCs, especially for companies that have not refreshed their PCs in four or five years."

He added that the PC category, which includes desktops and laptops, is a mature space. That means that even though PC sales may spike in 2010, the category as a whole will only grow four percent to five percent annually in the coming years.

"The market for classic PCs is eroding and the laptop market is fragmenting because of the trend towards netbooks and smart phones," Bartels said. "Neither is an endangered species yet, but the category is shrinking."

The report speculates that the bottom of the IT tech market happened in the first and second quarters of this year. Analysis of that market is based on the sales of computers and peripheral equipment, communications equipment, software, IT consulting services, and IT outsourcing services.

Looking ahead, the report predicts that the use of IT consulting services will increase by 11.7 percent in 2010. In addition, software purchases will be up by 9.3 percent, computer equipment sales will increase by 8.3 percent and communications equipment sales will show a bump at 3.6 percent. Outsourcing will rise by 4.5 percent in 2010, the report predicts.

"We see licensed software as a strong category that was hit hard by the recession, especially at the enterprise level," Bartels said. "With the return of capital investment we see it making a strong comeback."

Microsoft will ride the rising tide of increased license sales and new application development, Bartels said. He doubts that many enterprises will make a major switch to cloud services and virtualized machines as opposed to owning and operating their own IT footprint.

"At Forrester, we recognize that cloud computing is a trend, but it is a somewhat vaporous concept that is sucking up a lot of existing platforms such as software-as-a-service and redefining it as cloud," Bartels said. "At the end of the day, most companies, and especially in the enterprise, still want to own, operate and control their IT environment."

Bartels predicts that enterprise businesses will be the first to reinvest in IT and lead the revival of the tech boom.

‘Michael Jackson’s This Is It’ Ticket Sales Break International RecordsForrester: Worst May Be Over for IT Market

.NET Rx Framework: A Watershed Advance in Asynch Programming

This summer Microsoft quietly released the first key components of its .NET Reactive (Rx) Framework, which allows developers to write Language Integrated Query (LINQ) expressions against events. Components of the Rx Framework were included in the latest drop of the Silverlight Toolkit. A complete version is expected to be part of Visual Studio 2010 and will be supported by .NET Framework 4.

According to language designer Erik Meijer, the Rx Framework consists of a pair of interfaces (IObserver/IObservable) that represent "push-based" observable collections, along with a library of extension methods that implement Microsoft's LINQ Standard Query Operators and other stream-transformation functions. Meijer runs the Data Programmability Languages Team at Microsoft, and he outlined the .NET Rx Framework during a session at the recent O'Reilly Open Source Convention (OSCON) in San Jose, Calif. Observable collections capture the essence of the subject/observer design pattern, Meijer said, and are especially useful for dealing with event-based and asynchronous programming.
Meijer and software design engineer Wes Dyer have designed what Meijer described as a major breakthrough in asynchronous programming: "Of all the work I've done in my career so far, this is the most exciting," Meijer told session attendees. "I know it's a bold statement, but I really believe that the problem of asynchronous programming events has been solved."

Veteran .NET developers agree that the Rx Framework is likely to change the way developers deal with asynchronous programming. "This is a completely new way of perceiving event handlers, delegates and asynchronous programming," says Julie Lerman, a .NET mentor and the author of the recently released book "Programming Entity Framework" (O'Reilly Media Inc., 2009). "I'm reacting like most programmers. We're uttering a collective, 'Oh my god.' They just peeled something open and showed us something new that has always been there."

Andrew Brust, chief of new technology at twentysix New York, says the Rx Framework solves the challenges inherent in asynchronous programming, which is the model employed in AJAX, Silverlight, Microsoft's Azure, cloud-based services and multi-core/multi-processor/multi-threaded programming. "It's an important step in making the delicate parts of AJAX, rich Internet applications, and cloud computing less disruptive to line-of-business programmers," Brust says.

"Asynchronous programming is really hard," Lerman notes. "It's hard for programmers to get their heads around it. Microsoft has been trying to find a way to make it more accessible to developers. In the same way that LINQ has made interacting with data objects easier, the Reactive Framework is going to make interacting with events easier. But not only that, it's going to give us a new level of access to working with events."

Microsoft included components of the Rx Framework in the latest version of its Silverlight Toolkit. The biggest chunk is a new assembly called system.reactive.dll, located in the bin folder of the Silverlight Toolkit Unit Tests. Jafar Husain, a software developer who works on Microsoft's Presentation Platform Controls team, has posted bits of sample code on his blog that can be downloaded and run inside Visual Studio 2008 via the Silverlight SDK.

"Just by thinking about events and asynchronous complications as collections, I know I have this very powerful mechanism to glue these things together," Meijer said at OSCON. "Really, I've just sort of rephrased stuff that people have been doing for a long time."

He pointed to the Unix shell as an example. "Unix pipelines are also an observable collection, because each stage of the pipeline pushes the value to the next stage," he said. "The way you glue these things together is by wiring up these data-flow networks." Another example: event-driven state machines in Windows Workflow, which is also a concrete type that implements the Observable interface.

Meijer has been involved in the development of a wide range of languages, including Haskell, Mondrian, X#, Cw, C# and even Visual Basic. He also led development of LINQ, which adds native data-querying capabilities to .NET languages such as C# and VB.

As for .NET Rx Framework, Lerman says it will take some time to understand. "Be patient while you wrap your head around this thing," she suggests. "Once it clicks, it will make perfect sense, and it will change the way you think about event handlers and delegates."

Telerik’s .NET Tools Suite Bundles Updated RadControls, ORM and UI Test FrameworkOfficial ‘Twilight’ Fan Conventions Launched By Studio

Is Your Dev Budget Being Squandered?

One-third of expenditures on development projects are squandered by three-quarters of organizations, because they lack consistent requirements and discovery management processes, according to a recently released study.

The finding was based on a survey of 450 enterprises by IAG Consulting, a New Castle, DE-based provider of professional services. "One of every three dollars in development is getting wasted by poor requirements," said Keith Ellis, the report's author and a vice president at IAG Consulting, in an interview.

Furthermore, nearly three-quarters of those surveyed were using low maturity level development processes: classified as Level 1 or Level 2. (Five is the highest maturity level.) Those organizations waste up to 39 percent of their dev budgets due to inadequate requirements definition and maturity. In some cases the loss could increase to 50 percent of overall IT spending on development and maintenance, according to the report.
It also concluded that organizations with insufficient requirements maturity hit their business objectives just 54 percent of the time, while taking 35 percent more time to reach that result. By comparison, those at Level 4 maturity will outperform their peer groups by10 percent.

Lower skilled developers in a company with high maturity requirements can outperform more highly skilled ones in a low requirements organization, Ellis said.

While the findings may appear self-serving coming from a consulting firm that provides requirements definition and management professional services, industry analysts said the trend is consistent with their own findings.

"Of course the report serves AIG well given their business," noted InfoTech Research Group analyst Brendon Kerton in an email. "At the same time, there was nothing in the report that surprised me and that we haven't seen with clients we speak to."

Development organizations struggle with processes and QA/testing and often project management, she added. "They end in a discussion about the struggles to elicit and communicate requirements," she said.

"Many of our clients start off thinking about requirements work as easy and something any IT person or business person can do. Requirements are rarely easy to 'gather' like eggs in an Easter egg hunt. Elicitation is often as much about business design as business partners' work through their needs."

Architects and dev managers must have strong facilitation skills, business process design skills and political savvy to work through those issues, she added. "The person has to be able to organize what they've heard, find the patterns, articulate the data and rules and document and communicate in ways that both business people and IT developers, designers and architects can all understand."

Macehiter Ward-Dutton Principle Analyst Bola Rotibi said implementing definition requirements is a longstanding problem. "This has been a problem for a long time, part of the problem is getting the definition process right and the key challenge is to get people to communicate," Rotibi said in an interview.

Those organizations that move to Agile development processes are more likely to achieve higher success rates, she said. "In talking to people who have been doing Agile development, they have noticed a decrease of defects," she said, "and increased satisfaction in quality."

Survey Finds BPM Projects Lack Architecture‘Michael Jackson’s This Is It’ Premieres Worldwide On October 27