March 1st, 2009

Posted by Ed Bott

Last week my colleague Mary Jo Foley reported on rumblings of discontent from the invitation-only Windows 7 technical beta test community:

A number of Windows 7 testers have complained recently that Microsoft was not sharing enough information about changes it planned to make in response to their feedback.

Windows SuperSite’s Paul Thurrott questioned in a post yesterday whether Microsoft had already locked down Windows 7’s feature set before the majority of technical and public beta testers ever got to see a first release of the product. I’ve wondered the same.

This was all in response to another epic post on the Engineering Windows 7 blog by Steven Sinofsky, who tried to explain how the feedback process worked. The whole thing is worth reading, although at 4700+ words I’m afraid most people will just skim it.

Frankly, I’m having a hard time working up any level of sympathy for those doing the complaining, partly because I heartily approve of the way Windows 7 development is going right now and partly because I have seen the feedback process up close and personal. Microsoft is getting a bad rap from a group of people who are mourning the reality that they’re no longer being treated as privileged elites.

I was going to ignore this whole brouhaha, until I read a post on the subject by WinPatrol developer and Microsoft MVP Bill Pytlovany that included this provocative proposition:

Most Beta Testers Suck

As a developer I can tell you , beta tests aren’t what they used to be.  The number of people who actually report decent bug information is minimal. Most people download the beta just to be an earlier adopter. Developers are lucky if users read the release notes and compatibility list let alone any beta instructions. There are so many different machine configurations that sadly the only way to find some bugs is to have full global adoption of new software.

Bill isn’t going to endear himself to any beta testers with that line of argument, but he does have a point. I’ve read many of the complaints Mary Jo referred to and a few hundred others on the members-only Windows 7 technical beta newsgroups. I think a lot of beta testers need a refresher course in the basics of what it means to be involved in the development of a product as complex as Windows.

In that spirit, here’s my list of five things every Windows 7 beta tester should know:

1. Things have changed. According to Thurrott, “The real problem here is that the feature set of Windows 7 was frozen well before the Beta release. So the feedback [Sinofsky] discusses throughout this post is 99 percent bug testing, really (and 1 percent, we hear your concerns but have a million reasons why we can’t change a thing).”

And this is a problem? I don’t think it’s any accident that the two most troublesome releases in the history of Windows also had the longest beta cycles. I was running pre-beta builds of Windows 95 in 1993, nearly two years before it was released. The first alpha releases of Longhorn, which eventually became Windows Vista, were handed out at the PDC in late 2003, nearly three years before Vista shipped.

By the time a beta is released, the feature set should be pretty much frozen. That’s how you concentrate on things like quality and performance.

As for the complaint that Microsoft hasn’t listened to feedback and ignored its most loyal customers when developing the feature set for Windows 7, I say, “Give me a break.” Since November 2006, Microsoft has gotten an earful about its Windows design decisions. The feedback loop includes:

• Every blog post, review, newsgroup posting, and rant about Vista ever published
• Support calls to Microsoft and its partners
• Requests from PC makers and software developers
• Telemetry data (all those crash reports really do go somewhere)
• Field research and usability testing
• Interviews with opinion leaders, including Paul and me, who have given feedback to Microsoft in person and on the phone many times in recent years. You think they weren’t taking notes?

That’s a helluva lot of feedback to take into account. There comes a point where more doesn’t mean better.

2. Windows design is a series of compromises. A lot of the complaints I’ve heard boil down to “Well, that’s not how I would have designed that feature.” Right. When you’re building a product that is going to be used by hundreds of millions of people, you have to find some common denominators. And as I wrote last year, sometimes there is no right answer: you can bet that for any decision you make, some nontrivial number of people will think you’re a complete idiot, no matter which option you choose.

I also hear lots of feedback suggesting that Microsoft should never remove a feature and should always give its old-time users a way to preserve the procedures they learned five or 10 or even 20 years ago. Seriously, I’ve heard people argue that Windows 7 should include the old File Manager utility from Windows 3.1. Can you imagine how complicated, even bloated, Windows code would be if no feature was ever cut and you could choose from a dozen or so Classic interfaces going back to 1991? But that’s the logical conclusion from that line of argument.

Things evolve. Old features disappear, and new ones are introduced. Deal with it. If you think there’s a better way to implement a new feature than the one Microsoft chose, blog it. But it helps if you can make a rational case – remember, you’re dealing with engineers. Simply saying “XYZ feature sucks” isn’t likely to win hearts or minds.

3. Writing good bug reports is hard work. I sympathize with testers who complain that their bug report was closed as “Non-repro.” buy viagra cheap But that’s reality. If it was easy to reproduce, the bug would most likely have been caught in one of the many, many automated testing cycles that each Windows build goes through. The really tricky bugs are those that are triggered by unusual combinations of hardware and software under specific conditions.

In fact, if you talk to the developers who dig into those incoming bug reports from technical beta testers, as I’ve done, you’ll quickly learn that it’s a pretty low-yield process. Most are duplicates and the vast majority are just requests for new features or changes to existing ones. When they get closed as “won’t fix” or “by design,” it’s because someone already considered that request and decided for any of a thousand reasons (budget, compatibility, risk of regression, or conflicting data) that the feature is going to remain as it is.

4. One more build does not mean a better product. In fact, you could argue as I did last week that the work of building an “official” beta release slows down progress. Pytlovany, who has worked inside Microsoft, agrees:

Every new beta release is a distraction to developers. The time it takes to create a frozen version takes away from a developers imagination and productivity. […] The internal testing required before any public beta is a lot longer than you might think.

If you’ve identified a bug and it’s made it onto the must-fix list, it shouldn’t take multiple passes to fix it. Microsoft’s Charlie Owen, who works on the Media Center team, had some great advice for beta testers  in a blog post last week:

When the Windows 7 Release Candidate becomes available immediately download, install, test deeply and quickly provide actionable feedback.

Seriously: As the release candidate is downloading and with tenderness, kiss your spouse on the cheek and tell him or her you’ll be back in a week or so. Then lock yourself in the home office and be relentless and unforgiving in your testing of the Windows 7 Release Candidate and provide feedback.

5. Shipping is a feature. There is no such thing as perfect software. If the developers of any complex software product like an OS waited for every bug report to be “fixed.” the software would literally never ship.

The one thing Microsoft can do going forward that it has not done well in the past is to incorporate feedback from the current test cycle into the next version. The best way for that to happen is for Microsoft to develop a consistent, professional process for planning and shipping new releases on a predictable schedule. In theory, features that don’t make it into this release have a legitimate shot at making it into Windows 8. As Charlie Owen put it, “You should consider the Windows 7 Release Candidate as your first and best opportunity to influence the next version of Windows.”

February 26th, 2009

Posted by Mary Jo Foley

Windows 7 testers wanted more feedback from Microsoft. It looks like they’re getting it.

In a February 26 post to the Engineering Windows 7 blog, Microsoft itemized some of the changes that it is making to Windows 7 that will be part of the Release Candidate (RC) test build that is widely expected in April.

From the blog post introduction by Windows chief Steven Sinofsky:

“(W)e want to start posting on the feedback and the engineering actions we’ve taken in responding to the feedback.  We won’t be able to cover all the changes (as we’re still busy making them), but for today we wanted to start with a sampling of some of the more visible changes.”

The post goes on to detail some of the Windows 7 changes Microsoft is making in response to tester feedback — in the task bar, Media Player, networking, touch, the Windows Explorer and overall performance.  Given that Windows 7 was deemed “feature-complete” as of the public beta that Microsoft released in January, the changes coming between then and the Release Candidate are largely cosmetic. (At least it seems that way to me….)

A number of Windows 7 testers have complained recently that Microsoft was not sharing enough information about changes it planned to make in response to their feedback.

Windows SuperSite’s Paul Thurrott questioned in a post yesterday buy cheap generic viagra color=”#004d99″>whether Microsoft had already locked down Windows 7’s feature set before the majority of technical and public beta testers ever got to see a first release of the product. I’ve wondered the same.

It’s great Microsoft is starting to share feedback with the thousands, if not millions, of testers who take their time to help the company find and fix bugs and usability problems. But Thurrott’s question is still a good one.

Windows 7 testers: Is this feedback that Microsoft is providing enough? Any other specific features/areas you’d like to see addressed in the future?

If you read my article 10 things you should do before, during, and after reinstalling Windows you will be aware that I mentioned five ways to get the important updates and the latest Windows service pack and five ways to install the same. While writing the article it became apparent to me that there was a security risk immediately following a reinstall of Windows.

Microsoft recommends that you connect to the Internet to get the important security updates and service pack. But the catch-22 is that your computer is more vulnerable until the security updates are installed. That left me wondering if there was a better way to secure my PC when it was at its most vulnerable — immediately following a clean install.

The best and easiest solution would be to simply download the security updates before a reinstall. This cumulative self-executable security update file simply does not exist on the Microsoft download site. I’ve seen Microsoft security update files available for download at various Web sites, but this is one of the few times that a third-party solution won’t work. You simply can’t trust replacing your core system files to anyone but Microsoft.

So I set out to find a proactive way to secure my computer immediately following an install or reinstall. I detail five ways (Table A) to better secure your computer until all the important security updates can be installed. They range from simple to complex and from less secure to more secure. This document refers specifically to Vista, but the concepts apply to all versions of Windows.

This blog post is also available in PDF format in a TechRepublic download.

Five ways

Table A – The Five Vista Install/Reinstall Security Options

Options three, four, and five offer a more secure way to retrieve SP1 and the important update files. Option five is potentially the most secure and is the most difficult to implement.

Option one

Stand-alone computer users must follow this option. Since the computer will not be connected to a network, there are no online threats to worry about. You will still need to consider the risks involved when running any applications. The service pack, if any, will have to be installed manually.

Option two

This is the standard default option for Windows. Most of you have always used this option to update your PC following an install or reinstall.

If you select this option, you will have to rely solely on Vista’s built-in Windows Firewall and Windows Defender. The security updates you will be downloading fix known security vulnerabilities with Internet Explorer, MS Mail, and Windows Media Player. Until the security updates are installed, you should consider not browsing the Web, reading your e-mails, listening to MP3s, or starting any other applications that connect to the Internet.

Option three

The comments in option two also apply to option three. This option requires you to connect to the Internet to get the latest security updates. Then do a manual install of the latest service pack. By installing SP1 manually you reduce the amount of time you have to be connected to the Internet.

Option four

The comments in option two also apply to option four. Option four is similar to option three but installs the security updates contained in SP1 before having to connect to the Internet. By installing SP1 manually, you also reduce the amount of time you have to be connected to the Internet.

I have tried Option four, and it seemed to work well for me without any major problems, even though it is not Microsoft approved. I was able to experience firsthand some of the problems that can be experienced by manually installing SP1 prior to a Windows Update scan. Be aware that if you choose this option it is possible that any problems may require you to reformat the target partition and reload Windows from scratch again. You can also try manually installing SP1 in safe mode if you experience any problems.

Option five

This option involves configuring a firewall to block all network traffic except traffic to the Windows Update server. Actually implementing this requires advanced knowledge of the Microsoft Management Console (MMC) and the Windows Firewall with Advanced Security MMC snap-in or another third-party firewall that supports application blocking. To be honest, I tried to set up a new inbound rule in Windows Firewall with Advanced Security and gave up after a few hours of fruitless effort.

A good third-party firewall is an alternative option that may provide better security while Windows Update is busy retrieving and installing important updates. In the hands of the right person, a third-party firewall like Comodo Internet Security (CIS) is more secure than Windows Firewall and Defender. And third-party firewalls can solve the transparency problem that Vista’s firewall has.

If you are looking for a firewall for simple everyday protection or for easily creating inbound and outbound network rules, Comodo Internet Security fits the bill and then some. And the full-blown version with anti-virus protection and Defense+ is totally free.

If you do use a third-party firewall like CIS, you will have to understand how to properly configure the firewall and what application alert prompts to allow and which to deny. This is not the level of knowledge you can expect from the average user. Even tech pros can find using such a firewall challenging. You can dial back the settings in Comodo Internet Security but at the cost of reduced security.

How highly is Comodo Internet Security rated? The CNET editors rate it five stars. You can download the 32- and 64-bit versions from the Comodo Web site.

Installing CIS and not running any apps that connect to the Internet should safely secure your computer until all the important security updates are in place. If you want to lock down your network traffic further, it can be done using network rules, but you need to understand some firewall basics first.

Basic firewall theory

There are two ways that personal software-based firewalls fundamentally work. They can start with a solid wall in place, and specific network or application rules can be added that poke holes in the wall. Or they can start as a bare foundation, and specific network or application rules can be put in place to build the wall.

The first technique is used by most of today’s firewalls — and you can see why. If you are using the second type of firewall and you don’t build your firewall rules properly, you can let in uninvited visitors.

By using the first type of firewall you can create network rules to allow inbound/outbound network traffic. By default, a firewall of this type with no network rules will block all inbound and outbound traffic.

Using the second type of firewall you can create network rules to block inbound/outbound network traffic. By default, a firewall of this type with no network rules will allow all inbound and outbound traffic.

Comodo Internet Security implements the first type of firewall strategy. It can block or allow network traffic by:

If you are new to firewalls and network rules, you will almost certainly be confused by in and out network connections and Source and destination computers. It is confusing. First, don’t think in or out. Think inbound connections generic cialis overnight delivery and outbound connections instead.

A good analogy is a telephone call. For an inbound connection call that you receive, the source is the phone making the call and the destination is your phone. For an outbound connection call that you make, the source is your phone and the destination is whomever you are calling.

In this analogy, the phone number is the IP address and the device receiving the call is the port. For example, you could have both a phone and a fax machine using the same phone number. OK, you probably don’t have more than one device, but you get the point. Remember this analogy when setting up your network rules.

Using Comodo Internet Security with Defense+, I developed a method to block applications and sent the script to Comodo for a sanity check. Comodo was kind enough to have their Senior Research Scientist look at my script. He sent me a method that is much better than my solution. It will block all Internet traffic to all applications except Windows Update, and you won’t even have to worry about any pop-up alerts. Here are the relatively simple steps that he sent me.

Make sure that your modem or the Internet cable is not connected to the Internet.

1. Install CIS and restart the computer.
2. Open the Comodo Internet Security status window.
3. Click the Firewall icon at the top of the window.
4. Click the Advanced button in the left pane.
5. Click on the Network Security Policy link (Figure A).

Figure A

The CIS Network Security Policy Application Rules Window looks like this before you add any network rules.

1. Click on the Windows Updater Applications entry and drag and drop it to the top so that it is the FIRST entry in the policy.
2. Click the Add button.
3. Click the Select drop-down button, then click Running Processes followed by System under Windows Operating System, and then click the Select button.
4. Click the Use a Predefined Policy radio button, click the drop-down arrow, and choose Trusted Application. If there is already a rule entry for the system, it can be modified. Click the Apply button.
5. Click the Add button again.
6. Click the Select drop-down button and then click File Groups->All Applications.
7. Click the Use a Predefined Policy radio button, click the drop-down arrow, and select Blocked Application if not already selected. Click the Apply button.
8. Click the Apply button in the Network Security Window.

Be sure that the blocked All Applications rule created in steps 10-12 is the LAST entry. Double-check that the order of the rules in the Network Security Rules Window matches the order in Figure B.

Figure B

This is the CIS Network Security Policy Application Rules Window after we moved the Windows Updater Applications entry, added the trusted System, and blocked All Applications network rules.

Important! After all security updates and the latest service pack are downloaded and installed, the blocked All Applications rule created in the steps 10-12 must be deleted to allow the normal operation of the firewall. Highlight the network rule and use the Remove button to delete it. You can optionally also delete the trusted System rule created in steps 7-9.

You will need to disable Windows Firewall if you are installing a third-party firewall. Please read Installing and Configuring Comodo Internet Security with Defense+ for instructions on how to do this and for more information about how to install CIS.

Partition imaging

As it was so kindly pointed out to me more than once in the forum for the 10 things you should do before, during, and after reinstalling Windows article, an image of the Windows operating system can be made when you have it installed and configured the way you like. There is a legitimate and compelling reason to image your system after an install or reinstall. A system image can be created and used in the future to reinstall Windows with both the latest service pack and all security updates up to the image creation date already in place. And there is a way to do it with freeware — at least for owners of Maxtor or Seagate hard drives.

MaxBlast 5 is freeware application that is essentially Acronis True Image Home lite. The Seagate version is called DiscWizard and is also free to Seagate hard drive owners. You must have a Maxtor or Seagate hard drive installed in your system in order to run MaxBlast 5 or DiscWizard.

For more information about how to create a system image using MaxBlast 5, please read Partition Imaging with MaxBlast 5.

Editor’s Note: According to Stephen Lawton, Senior Director, Strategic Marketing, Acronis Inc., Acronis True Image supports hardware RAID in all of its products and software RAID is OS-dependent. It really depends on how the manufacturer implements software RAID in order to know if it’s supported. The best way to determine if your software RAID is support in Acronis True Image is to boot the system from an Acronis Rescue Disk. See the accompanying discussion thread for more details.

There are two partition images that you should consider creating after a Windows install or reinstall. The first image is an image created after Windows is loaded and you have made all the changes to personalize Windows the way you like it.

The second image should be created after you have downloaded and installed all the important updates and the service pack, if any. You should also consider running an anti-virus scan set to its high or thorough setting prior to imaging. You want to create an image that is Trojan and virus free.

The final word

I thought long and hard about whether I should submit this article for publication. I realize that the security issues discussed here aren’t near the top of most people’s list of concerns and for good reason. It is difficult if not impossible to assess the security risk after an install or reinstall. The Vista installer warns you about additional possible security risks if you do not connect to the Internet to get the latest updates. This is a relatively insignificant issue compared to any possible security risks immediately following a clean install or reinstall of Windows.

There are still a lot of unanswered questions. I doubt if anyone including Microsoft can tell you whether Windows Firewall and Defender is sufficient to protect your computer until all the important security updates are in place. I can tell you that your computer is more vulnerable until the service pack and all the important updates are downloaded and installed.

Neither can I tell you, patient reader, what security option you should choose. Whether to use Windows Firewall and Defender or to install a third-party Firewall like Comodo Internet Security and lock down the network traffic with network security rules, I leave it entirely up to you, depending on the option you feel most comfortable with.

DNS is the manageable way to resolve computer names to IP addresses, yet Windows admins usually use host files because they always work. But when you need to make a change to a bunch of host entries, where do you start?

—————————————————————————————————————-

It can be risky to use the Windows host file (which is located at C:\windows\system32\drivers\etc\hosts) for default installations if you need to make a change to a large number of systems with a local entry. Fortunately, there are a few ways to change these entries.

For example, look at a simple host file entry:

Imagine that the DHCP-122 host is frequently generic cheap cialis used and many systems have a host entry with that IP address. As the system becomes more important, it is moved to another network and a static IP address. Assuming there is a resolution mechanism, the task is to replace the entry with a hashed out entry, as shown below:

Let’s also assume that we don’t want to remove the other entries in the file. This change comments out the entry and puts the new IP address in place. In the event that DNS or another mechanism cannot resolve the address, we can easily flip this entry for access.

To accomplish this task for a large number of systems, there are a few ways of going about it. One tool that I came across recently is Advanced Find and Replace, where a text file of paths can be loaded for a large find and replace task. The text file would contain entries like this:

Advanced Find and Replace can then go through all of those paths and make the requested change if the text string exists in the file. This task can also be accomplished with a stream editing tool like Sed for Windows.

Another way to address easy short name resolution without the nightmarish management of host files is to migrate to Windows Server 2008’s DNS engine and use the GlobalNames zone — although the host files would need to be removed for the DNS results to work.

Whatever tool you use to modify the entry, make sure you do not add a file extension to the hosts file — the file will not function correctly with an extension. In general, you should stay away from using host files; however, certain situations warrant their use, and the manageability issues will soon follow.