By Extension

December 18, 2011 by Robert C. Watson

Seeing What We Expect to See

I'm a Unix/Linux programmer. It capitalizes on my tendency to take what I see quite literally. By making few assumptions, I'm able to see the problem as the computer does.

By contrast, "normal human thinking" depends heavily on our imagination filling in many blanks. We have to make lots of assumptions. Those assumptions cause us to see what we've seen before... what we expect to see.

With almost all of my attention on Unix/Linux over the years, I've mostly just used Microsoft Windows and Office as tools and not followed their inner workings much. Long ago, I attempted to decipher the raw format of a Microsoft Word document (and failed to do so reliably). It left me with a mental image of Word documents consisting of intermixed binary values and text that only Microsoft understood.

A few years later, someone sent me a document in Microsoft Word 2007's new .docx format that I needed to convert to HTML for the web. I only had Office 2003 and was horrified by the mess Word made when exported "As a web page". So I proceeded to read the document into a text editor to see if I could just cut out the content and reformat it by hand. Knowing it was supposed to be XML, that's what I was expecting to see. What I saw instead was gibberish -- pure binary.

"Damn that Microsoft!"

Sliding back and forth through the sizable document and finding no blocks of text or other discernible patterns, I brought up Firefox and started many hours of Googling.

Now one thing I've learned over the years is that, for me at least, there's a very consistent inverse relationship between the intractability of a problem and the complexity of its solution. The longer it takes to solve it, the more simple the solution is likely to be. Assumptions and expectations lead me down an increasingly complex path of study, experimentation and failure as I exhaust "obvious" solutions. (Is "Occam's Razor" misunderstood?)

Lots of Googling have also taught me that simple, fundamental facts and concepts about a piece of software are often documented only once and thus rarely found in search results. Assumptions again.

The more intractable the problem, the more likely that the solution hinges on one of these obscure bits of information.

I finally came across somebody in a forum explaining the new format to a newbie (A Newbie! A Noob! How mortifying...) and discovered that in the world of Microsoft...

Though a .docx is named much like a .doc, looks like a .doc and is used like a doc... it's really a .zip!

Secure Boot News - Future Day 1

Microsoft Windows Secure Boot - Then and Now
by RobertC

The newest version of Microsoft Windows finally provides some long-sought enhancements to the Secure Boot feature launched with Windows 8 a few years ago. No longer do storage devices have to be removed and slaved to another computer in order to regain access after lightning strikes, "key hijacks" or boot image corruption. Users can now login from another registered device to their account at Microsoft, the computer manufacturer or any other entity they have keys registered with, and download a new key.

After a multi-step authentication process that includes an email-reply verification and optional phone callback, a user or System Administrator downloads new keys for one or more of the registered machines and copies it to a storage device, usually a memory card or flashdrive. The downside of having to physically be at the computer remains for large data centers, but life is better than it was. At the computer, Secure Boot looks for new keys on the first boot device during powerup. (Anybody remember floppy drives and serial dongles used like this? No? Never mind...) Since the Unified Extensible Firmware Interface (UEFI) software in conjunction with a Trusted Platform Module (TPM) allows multiple, equally valid keys to exist on a "keyring", the new key can just be added and full access restored.

Microsoft has given in after losing market share to Apple, Google, Ubuntu, RedHat, IBM and other Linux and Unix-like operating systems for several years. The "*nix" common underlying operating system architectures used by those companies made the anticompetitive approach of Windows Secure Boot a non-starter with all but Apple. However, even Apple saw the legal liability dangers of purposely locking companies out of their systems due to common events like upgrades, repairs or natural disasters. The companies and many open-source organizations hammered out procedures that greatly reduce vulnerabilities while giving people a reasonably secure way of getting back into their phones, computers and other devices.

Historical References

• Thanks to Matthew Garrett's blog entries that largely started the whole Windows 8 Secure Boot controversy:
• UEFI Secure Booting
• UEFI Secure Booting (Part 2)
• Supporting UEFI secure boot on Linux: the details
• Thanks to the research of Robert Lemos at InfoWorld for his piece, Windows 8 Security: Stronger but gentler
• ...which contains a link to a 2005 Security Focus article on Microsoft's plans to use TPM technology in Windows Vista (abandoned amid user fears of locking out other software): Microsoft reveals hardware security plans, concerns remain
• ...which contains a link to the Electronic Frontier Foundation's seminal article on PC security issues, these techniques and their repercussions: Trusted Computing: Promise and Risk
• Check out Wikipedia for a more up to date overview of Trusted Computing concepts and technologies.

Is .NET Today's UCSD Pascal?

Discussion with a colleague reminded me of some work I did related to ASP.NET and ADO.NET a few years ago. The CLI concept is a logical next step for Microsoft. They just need to remember what happened to the last player that tried that...

In the 1980s, UCSD Pascal was gaining in popularity. Versions were coming out for a lot of the microcomputers of the day and people doing serious programming liked it because it was a "structured" language, unlike BASIC's wide-open approach that often resulted in unmaintainable "spaghetti code".

Instead of being interpreted as most of the BASICs were or compiling to machine code like COBOL or C, UCSD Pascal compiled to an intermediate pseudo code ("p-code") that was then interpreted at run time. So it was faster than BASIC but slower than compiled languages like C.

With the success of UCSD Pascal, they started adding languages that would compile down to the same p-code so you could write in whatever language you liked and the end user only needed one interpreter to run it. Great!

Then a little company named Borland came along.

Borland came out with Turbo Pascal which had the first Integrated Development Environment for microcomputers. In that less than 40KB IDE, your program could be compiled and linked in seconds instead of taking several minutes in UCSD Pascal and other compiled languages. It also provided keyword help (very attractive to self-taught programmers) and was very inexpensive (also attractive to starving self-taught programmers). Not only was the development process much faster, but because it compiled to machine code, the resulting programs ran much faster than the p-code interpreted ones.

Turbo Pascal's success took the language makers in a new direction and pretty much spelled the end of p-code languages.

Microsoft's CLI is a p-code system. Different name. Different innards. Same idea. It addresses a problem of large organizations employing many programmers with different backgrounds.

But is it practical for the plethora of portable devices poised to dominate software development?

It may work fine for the new "big iron" ("big aluminum?") environments of large websites though.

At least until a more nimble competitor comes along.

Clean and Disinfect Your Computer

Always on the lookout for better products to keep the pests at bay, I keep coming back to the reliable combo of CCleaner, AVG AntiVirus, and SysInternals RootKitRevealer.

CCleaner
If you're "not a computer person", make friends with (or hire!) someone who is and point them to this program. (They probably already use it.)

CCleaner is a freeware Microsoft Windows (98/NT4/ME/XP/Vista) registry and files cleaner. It's not automatic like AVG because, like another fine freeware product - HijackThis, not all of the suspicious registry entries and files it finds are necessarily superfluous or malicious. That said, I've found that by unchecking certain of its many categories, I can routinely let it delete everything it finds without corrupting the system and still getting rid of most of the bad stuff.

AVG AntiVirus (Free)
AVG AntiVirus is the core of my disinfecting suite.

AVG AntiVirus 8.0 is one of the many commercial products that began life free and still distributes a fully free version, albeit missing some functionality from its commercial brethren. Once setup through the very nice user interface, AVG automatically keeps itself updated and watches for malicious files coming down the pipe. This product pretty much "just works". They've done a better job than most at making it easy to use yet robust. A "poor stepchild" (version 7.5), though quite functional, Linux version is also available.

The commercial product adds anti-rootkit, website-screening and support for $34.99 with the full Internet Security product adding anti-spam and a firewall to that for $54.99. Not a bad deal. See the feature comparison for details. See Wikipedia article, AVG Technologies, for info on the company which was formerly known as Grisoft and AVG (software) for more about the products.

SysInternals RootKitRevealer
Like having a good set of mechanical tools, the SysInternals utilities have never let me down.

I picked up the TBSS rootkit a while back on a machine running just AVG Free (no anti-rootkit) so I got to scan the field of (free) rootkit detectors and found this one to be reliable and robust with excellent rootkit detection and a simple, solid user interface. Microsoft now owns the rather extensive array of free SysInternals utilities which can be downloaded individually or all together in the entire SysInternals Suite. Highly recommended.

CA eTrust PestPatrol Causing High CPU Use

At work they're running Computer Associates eTrust PestPatrol 7.1.501 and on one of two "identically" configured workstations the program ppmcactivedetection.exe started using 48-50% CPU all the time which made everything else run very slowly.

Discovered that there were thousands of quarantine files in C:\Program Files\Common Files\PestPatrol\Quarantine occupying over 150MB of space. Had to kill all of the PestPatrol and related processes, then drop to DOS and delete the directory and all the files. Under Windows, it just sat there forever trying to build a list of all the files.

Once I recreated the Quarantine directory and restarted. ppmcactivedetection.exe ran fine using no more than a few percent CPU.

Windows XP Network Protocols

As of Windows XP, NetBEUI is not recommended and must be installed separately if needed. If the LAN includes a router setup to not pass local traffic to the internet, TCP/IP should be used instead and NetBEUI is not needed for secure File and Print Services.

Windows XP: Browsing Slow From XP to 98

Can change File and Print Services and Client For Microsoft Networks bindings to use only NetBEUI which is non-routable (will not cross router to internet). However, this is not necessary if there is a router on the LAN guarding Internet access.

Windows XP: Missing Administrator Account

This is normal behavior once another account with administrator privileges has been created. Press Ctrl-Alt-Del twice on login page to login to the Administrator account.