Tech Notes

The Rich Client is Here

2004-10-24T23:32:00.000Z

You'll be surprised how much you can do with XUL. Very impressive, no?

[Requires Mozilla or Firefox.]

Pointless Achievements of Our Time

2004-09-26T17:19:00.000Z

A 3.6 GHz Pentium 4 has been overclocked to 6GHz, liquid nitrogen cooling required, of course. Such feats are of no importance without significant accompanying speedups in disk I/O, however, as very few applications in mainstream use are truly CPU-bound.
[Via Slashdot]

GDI Scan

2004-09-26T11:37:00.000Z

SANS has helpfully provided this tool as an alternative to the useless GDI vulnerability detection application provided by Microsoft.

JPEG Exploit on the Loose

2004-09-25T13:18:00.000Z

The Register has the story. It was only a matter of time, really.

A toolkit designed to exploit a recently-disclosed Microsoft JPEG vulnerability has been released onto the net. The toolkit makes it trivially easy for maliciously-minded attackers, however unskilled they might be, to exploit unpatched Windows systems and run malicious code.

The attack mechanism used here takes advantage of a recently discovered flaw in the way Microsoft applications process JPEG image files. Malformed JPEG files are capable of triggering a buffer overflow in a common Windows component (the GDI+ image viewing library), it was revealed last week. This behaviour creates a ready mechanism to inject exploit code into vulnerable systems. Windows XP and Windows Server 2003 make use of vulnerable library by default. Other Windows OSes might be vulnerable, depending on what applications users have installed.

Airbus abandons Microsoft as ally

2004-09-24T12:04:00.000Z

Why is this story less than surprising?

Is Blue Ray a Dead End?

2004-09-18T19:17:00.000Z

Mark Cuban has thought-provoking things to say about the current efforts by the rival consumer electronics consortiums to get a high capacity successor to the DVD established as a standard. Do the ever-rapidly declining cost of hard drive storage per megabyte and the advent of broadband spell failure for such initiatives?

There's a great deal to Cuban's argument, but it seems premature to me to suggest that he's got it completely right; for one thing, at this moment broadband is hardly the choice of the majority even in countries like the UK and Ireland, let alone in poorer countries in the Third World, and not everyone can afford keychain devices and iPods. I think there will indeed turn out to be a market for a successor to the DVD, especially in the form of a burnable that can be used for backup storage, just not quite as large a market as the success of the CD and the DVD might have conditioned consumer electronics manufacturers to expect.

Blogger Test

2004-09-08T14:21:00.000Z

This is a quick test to see if the problems with publishing are Blog-specific or Blogger-wide.

Overpricing Does that to You

2004-09-07T13:35:00.000Z

Via Slashdot comes some interesting news:

"In their 10-K filing, Microsoft says that Linux server units rose slightly faster on an absolute basis than Windows server units in fiscal 2004. To project the trends it is helpful to look at the percentages. Some Gartner Inc. statistics report Linux server unit shipments are up 61% giving it 9.5% of the overall market share. Windows has a much larger base, so it can get the same absolute unit growth with a much lower percentage. Gartner expects Linux to continue growing faster and have more than 1/2 of the new server shipment market by the end of 2008."

If anything, I'd say that this is an underestimate of the momentum behind Linux, as it doesn't account for PC shipments for which a downloaded copy of Linux is used to transform some spare machine into a server. From a market share perspective, Microsoft would have been better off in the long run either pricing Windows Server 2003 a lot more affordably, or turning a blind eye to piracy by leaving it free of product activation: the product just isn't compelling enough to warrant paying such a premium for, and yes, price does matter, as I can well attest having slapped Linux and Apache on more than my fair share of aging PCs in my day.

Subversion-Related Information

2004-09-05T22:13:00.000Z

OnLAMP provides ten Subversion tips for CVS users, while O'Reilly's Version Control with Subversion can be read for free at the linked website.

Writing Firefox Extensions

2004-09-02T20:25:00.000Z

A helpful HOWTO guide that walks one step by step through the process of extension creation.

Icaza on Avalon

2004-09-02T20:22:00.000Z

Miguel de Icaza has interesting things to say about Avalon and Microsoft's decision to backport it to XP. Others have already given their two cents on what it all means from a business perspective, but Icaza looks at the issue from the viewpoint of a developer.

Release Early and Often

2004-08-30T14:08:00.000Z

At first I didn't want to say anything about the disclosure that Longhorn would no longer include the much-hyped WinFS, if only to avoid the appearance of gloating, but this article pushed me to change my mind.

Steve Jobs was wrong: Apple’s Mac OS X 10.4 “Tiger” won’t be Longhorn after all.

Jobs and Co. tweaked Microsoft’s collective nose with this brassy assertion back at June’s Worldwide Developers Conference. During that Mac developer lovefest, Apple insisted that its next big cat (due in the first half of 2005) will deliver most of the features promised for the beefy Windows upgrade (slated for 2006). Longhorn is cowpathing, Apple maintained, and Tiger will take a chunk out of its hide.

Now that boast turns out to be inaccurate: It was too conservative.

Thanks to the intrepid journalism of Mary Jo Foley and Darryl Taft, we learn that Microsoft has put its big bovine on a radical reducing plan in order to make that 2006 deadline. Prime cuts carved out of the OS include the pivotal Windows File System and Avalon presentation technology.

"Longhorn is going to stop being a whole new thing and more of an XP with a lot of good new stuff," one unnamed developer told our intrepid Windows watchers.

Meanwhile, back here on the Mac OS X side of the tracks, Tiger development proceeds apace. In fact, the buzz is that the impressive feature set previewed at WWDC represents about half the loaf, and that Apple will unveil plenty more by the time Mac OS X 10.4 arrives. (I’m still holding out hope for my speculation that significant system-level Windows emulation will be one of those features.)

This is as complete a vindication of my conviction that Apple's incremental approach was to be preferred as I am ever likely to see. What is it with Microsoft and the need to do "Big Bang" releases anyway? Haven't they ever heard the saying "A bird in the hand is worth two in the bush?"

With the announcement that WinFS will no longer be part of Longhorn, and that Avalon and Indigo will be backported to Windows XP and Windows Server 2003, I see no compelling reasons left for anyone to even consider upgrading to the new operating system whenever ite ends up being released.

Making Windows Programs Large Address-Space Aware

2004-08-23T19:49:00.000Z

Raymond Chen gives an informative rundown of what it takes to give programs an expanded address space of 3GB. Simply using the /3GB switch available with Windows 2000 Advanced Server and Windows Server 2003 isn't enough, as the programs must also be marked as /LARGEADDRESSAWARE, which raises further complications of its own.

Generatingfunctionology

2004-08-23T18:44:00.000Z

I was sitting there wondering to myself how on Earth I was going to obtain a copy of Herbert Wilf's excellent but apparently out of print book when for some strange reason the thought occurred to me to run a Google search for the title. On doing so, what should I discover but that a PDF version of the book should be freely available for download via Wilf's own page? It's an amazing act of generosity on his part, as I'd have been more than willing to pay hard cash for a copy were it still in print, and I'm sure I'm not alone in feeling this way.

SIGGRAPH Screenshots of Half-Life 2

2004-08-22T18:38:00.000Z

A very impressive slideshow of pictures originally incorporated into a PowerPoint presentation given at this years SIGGRAPH by Viktor Antonov of Valve. The level of realism on display is amazing, but at what cost in hardware to obtain a decent level of performance, I wonder?

Angels, Assholes and Morons

2004-08-17T12:35:00.000Z

An amusing rant by Mark Pilgrim about the different classes developers fall into when it comes to complying with product specifications.

PostgreSQL 8.0 Goes Beta

2004-08-15T14:50:00.000Z

At long last. What's even nicer to know is that it finally comes in a Windows Installer package, which can be found here.

A Retrograde Step

2004-08-13T12:09:00.000Z

Microsoft once again shows that it just doesn't get it. What kind of a controlling fiend must one be to oppose the distribution of a vital security update except through one's own website? This is just too stupid for words.

Microsoft has taken steps to stop its security update for Windows being shared on file-swapping networks.
The SP2 update for Windows XP was being used by file-swapping activists to show how such systems can help get large, important files to lots of users.
But legal warnings from Microsoft have forced the file-swappers to end their experiment and stop making the software available to downloaders.
Now the only place people are able to get the update is from Microsoft.

[............]

When it started sharing SP2, Downhill Battle said: "This project shows how file-sharing technology gives people without budgets or huge server space the power to solve problems themselves, without waiting for the government or some corporation to do it for them."
The version being made available on the BitTorrent network was intended for corporations who have a lot of PCs to patch. A smaller consumer version of SP2 is due later this year.
When asked about Downhill Battle's action, a Microsoft spokesperson said: "The Microsoft Download Center site is the only authorized web source for downloading a licensed copy of Windows XP Service Pack 2.
"To report a website offering unlicensed copies of Windows XP SP2 for download, please send an e-mail to piracy@microsoft.com."
According to the Downhill Battle website, Microsoft has now gone one step further and issued take down notices to two of the web hosts helping the group distribute the file.

It's bad enough that Microsoft should be trying to block the redistribution of such an important security update, but that it should be doing so with the loathsome DMCA really takes the cake.

When to Use Stored Procedures?

2004-08-01T23:59:00.000Z

Slashdot has an interesting discussion on the subject. I personally think they're invaluable, if only because they help mitigate the risk of SQL injection attacks.

Technorati and Software Development

2004-07-26T20:46:00.000Z

Heavy users of the Technorati may have noticed today that the service is currently suffering from major issues, and not just of the garden variety we've all become accustomed to, either. The way in which Technorati's chosen to unveil its latest changes flies in the face of what I consider to be a fundamental law of web development: never use the same platform for developing and providing services if you can at all help it, in order to avoid causing service outages if any of the changes you implement screw things up.

I don't know what Technorati's cash flow situation is like, but I very much doubt that it can be so bad that the firm can't afford to acquire a few old machines to use for beta testing purposes, rather than rolling out breaking changes without warning and then scrambling to fix things (if they are even scrambling, that is). The sheer unreliability of the service is getting to be so irritating that I'm feeling more and more of a mind to put together a home-grown alternative of my own, by which I mean not an aggregator like the excellent Bloglines, but a spidering/indexing service which confines itself to weblogs alone, and is able to return both the numbers of links to a blog and the context in which a given link occurs.

One additional feature I'd like in my implementation should I get around to it is to do away with the whole link-aging thing used by Technorati: why should I care that a given link is more than X days old, as long as I'm able to search and sort links by age?

Recursion and Dynamic Programming

2004-07-24T17:56:00.000Z

Eric Lippert put up an interesting post on dynamic programming some days back which I've only just gotten round to discovering. Here's a topic that's very much an interest of mine, as sequence alignment techniques like the Needleman-Wunsch and Smith-Waterman algorithms make heavy use of it.

IEBlog

2004-07-22T02:09:00.000Z

Microsoft's Internet Explorer team now has a blog of its own. It will be interesting to see just what comes of it.

Mozilla Code Review and Super-Reviewers

2004-07-15T22:53:00.000Z

A useful list of who owns what, and which modules require super-review before check-in. Also recommended for would-be Mozilla developers are the SeaMonkey Code Reviewer's Guide and the SeaMonkey Engineering Bible

SQL Server Data Mining FAQ

2004-07-15T22:47:00.000Z

Available at the SQL Server Developer Center, "dedicated to discuss[ing] issues on the Microsoft Analysis Services data mining functionality available with the Microsoft SQL Server product."

New Issue of Phrack Released

2004-07-15T22:31:00.000Z

Issue 62 of the notorious hacker journal Phrack recently hit the streets - or, to be more precise, the Web. As is to be expected, there's lots of interesting stuff in it, including guidance on how to circumvent 3rd party buffer overflow protection on Windows, kernel-mode backdoors (i.e, rootkits) in NT-based Windows systems like Windows 2000, Windows XP and Windows Server 2003, and a tutorial on using process injection to bypass software firewalls on Windows - the sample provided works against Zone Alarm 4 (free and pro versions), Sygate Pro 5.5, BlackIce 3.6, and even Tiny Firewall 5.0 (though this last one did require a bit more effort). The lesson to take from the last of the three articles mentioned is a simple one - if security is important to you, don't expect a software firewall to do the job, or at least not one that's also running on a Windows machine.

I wonder if Microsoft's security people are Phrack users. They ought to be, and if they are I'm betting this latest article ought to keep them awake for a few nights. These Phrack guys are good at what they do.

Project Looking Glass

2004-07-15T21:48:00.000Z

The home page of the Java 3D window manager project.

Project Looking Glass is based on Java technology and explores bringing a richer user experience to the desktop and applications via 3D windowing and visualization capabilities. It is an open development project based on and evolved from Sun Microsystems' advanced technology project. It will support running unmodified existing applications in a 3D space, as well as APIs for 3D window manager and application development. At the moment, existing application integration is supported for Linux platforms.

The project intends to break two boundaries -- the 2D-ness of the current desktop environment and the way the desktop environment evolves. Project Looking Glass is in its infancy. We need to explore lots of ideas and possibilities. We're releasing the Project Looking Glass code to the whole community to explore every aspect of the technology rather than restricting access to a privileged few. We believe this open development is an excellent model to pursue this exciting and vast opportunity. So, your involvement is eagerly anticipated.

Talking about visualization is all well and good, but I've yet to see anything about Looking Glass that suggests it'll bring any real benefits to users beyond the sheer "gee whiz" element, and much the same could be said for the 3D windowing features shown off in Longhorn at WinHEC earlier this year. If Looking Glass and Avalon are to be more than opportunities to show off some 3D eye candy, they'll either have to provide radically new methods of interaction that aren't easily implementable using the traditional "PC as virtual desktop" paradigm, or (more likely) it'll be through their making it possible for others to do so. All that is likely to come from merely turning the desktop into a 3D space is that users will find interesting new ways to misplace items and become disoriented.

Free Online Books for ACM Subscribers

2004-07-15T19:32:00.000Z

The following is a from a message that's just arrived in my inbox.

ACM's Professional Development Centre proudly announces its new online books service, powered by Books24x7(r). Now all student and professional ACM members can take advantage of free, unlimited access to 395 online volumes, selected from the highly regarded ITPro Collection hosted by Books24x7. Members can look for books to help with their PD Centre online courses or just read up on new subjects! Members can also review citation information on books via direct links to The Guide for Computing Literature from the books list.

Topic areas covered include C++, C#, Java, ASP, SQL, PHP, Linux, .NET, Visual Basic, Data structures, Data mining, Networking, Security, and Web Design.

These complete, unabridged books can be searched (keywords, author, title, ISBN, publisher), bookmarked, or read from cover to cover. A personalized bookshelf allows for quick retrieval of a favorite book while bookmarks allow easy return to specific places in a book. Members can view as many books as they like, as often as they like. In addition, an ACM specially priced upgrade ($249) to the full ITPro Collection with over 3,000 volumes will be available in the near future.

Very nice. It's too bad reading books on a PC monitor is still such a pain.

Visual Studio 2005 - Product Line Overview

2004-07-15T13:28:00.000Z

At last, Microsoft finally gets around to providing some information about product differentiation in its upcoming Visual Studio 2005 release.

I like most of the options offered under the Visual Studio Professional Edition column, and the absence of Visual SourceSafe (which I've never lied) is something I can live with, as is the lack of support for unit testing. What does get on my nerves is that one should have to buy Visual Studio Team System to get support for code profiling and static analysis, which I find simply ridiculous. For goodness' sake, the freely available GCC compiler suite has had support for code profiling forever, and yet here's Microsoft asking developers to hand over $2500 (or likely far more) for a feature which one ought to take as a given in a decent development suite.

I can't wait to see what eye-watering numbers Microsoft decides to attach to the Professional and Team System editions come 2005. A full copy of Visual Studio .NET Professional Edition is listed at $1,079, while even the "Competitive Upgrade" goes for $489; by way of contrast, an MSDN Professional subscription that provides the same development suite as well as all of Microsoft's operating systems goes for $1,189. Why would anyone go for the standalone package in the face of such pricing? I suppose that's the whole idea, of course ...

PHP 5 Released

2004-07-14T01:49:00.000Z

A Slashdot story informs us of the release of PHP 5. Following is a list of key features.

The Zend Engine II with a new object model and dozens of new features.
XML support has been completely redone in PHP 5, all extensions are now focused around the excellent libxml2 library (http://www.xmlsoft.org/).
A new SimpleXML extension for easily accessing and manipulating XML as PHP objects. It can also interface with the DOM extension and vice-versa.
A brand new built-in SOAP extension for interoperability with Web Services.
A new MySQL extension named MySQLi for developers using MySQL 4.1 and later. This new extension includes an object-oriented interface in addition to a traditional interface; as well as support for many of MySQL's new features, such as prepared statements.
SQLite has been bundled with PHP. For more information on SQLite, please visit their website.
Streams have been greatly improved, including the ability to access low-level socket operations on streams.

Bioinformatics and Comparative Genomics

2004-07-13T18:56:00.000Z

A pretty decent, if short, primer on the subjects.

Windows XP Service Pack 2 Delayed Again

2004-07-12T22:32:00.000Z

Or so says Slashdot, at any rate. I really can't believe that Microsoft has done this yet again - when is this service pack ever going to see the light of day?

VTK - Visualization ToolKit

2004-07-11T21:18:00.000Z

An extremely nice, freely available, open source visualization toolkit with support for a broad range of algorithms. It's strange that it isn't better known.

Software Express for Solaris

2004-07-11T00:03:00.000Z

Seems like Microsoft isn't the only company getting on the "Express" bandwagon: development builds of Solaris are now available for download as (hmm, guess what?) "Software Express for Solaris". Unfortunately, there's a hitch, and it isn't a minor one either: one has to already own a Solaris licence to use the product, and the lowest outlay for one of those is $289 ($99 for a single-cpu license + $95 for Softawre w/ DVD-ROM Media + $95 for Administrator's CD/DVD Media and Installation Docs).

Frankly, Sun's policy doesn't make the least bit of sense to me. Linux is freely available and eating into the company's market share from below, while 6-month trial copies of Windows Server 2003 can be freely downloaded from Microsoft's website. Exactly how many would-be Solaris administrators and evangelists does Sun expect to fork out $300 simply for the privilege of trying out its operating systems? I thought the name of the game was to flood the market with people who are well-versed in caring for your products, thereby reducing the risk and TCO of buying your stuff for potential customers, but Sun's management evidently has other ideas.

PS: Actually, I spoke too soon. Sun does indeed have a program providing free copies of Solaris 9 for evaluation. It's still not as attractive as Microsoft's offering though, as the evaluation period is only 60 days.

Classification of Finite Simple Groups

2004-07-10T23:29:00.000Z

This month's Notices has an interesting article by Michael Ashbacher on the state of the classification that was supposedly finished off in 1980. Surprisingly enough (or perhaps not so surprisingly), it turns out that there was still quite a bit of work left to do after all; a great deal of effort was put into simplifying the proof to a level requiring no more than an acquaintance with elementary graduate textbooks like Rotman's Introduction to the Theory of Groups, while increased scrutiny saw all sorts of gaps appear in the proof, some of which stubbornly refused to be closed until recently.

Dictionary of Algorithms and Data Structures

2004-07-10T23:20:00.000Z

An NIST-hosted site with a cornucopia of entries on all sorts of useful algorithms on data structures. The entries are generally on the brief side, but it's a useful resource to know about even so.

SQL Server 2005 Express Edition Overview

2004-07-10T23:05:00.000Z

A nice, in-depth article on the functionality and management of SQL Server 2005, including comparisons with older technologies like Microsoft Jet and MSDE. This product has the potential to knock the stuffing out of a lot of the Windows market for products like MySQL, if only because it has all those high-end features one expects from a real RDBMS (e.g. views, triggers, stored procedures, foreign key support) at a price that can't be beat - gratis. MSDE also had all those features, but its 5-concurrent-user limitations made it extremely unattractive by comparison with MySQL.

I'm really impressed by the thought that's gone into making sure SQL Server 2005 Express is secure out of the box. For instance, the "sa" account is disabled by default if Windows Authentication is in use, and should the account be enabled, it will require strong a cryptographically strong password from the administrator; neither Named Pipes nor TCP/IP is enabled in a default installation.

There is one thing worth noting about SQL Server 2005 Express, however, which is that memory requirements have gone up since the old SQL Server 2000 days. The minimum amount of RAM suggested for a host machine is 256MB, with at least 512MB of memory recommended.

implementing SVG on OS X

2004-07-09T16:26:00.000Z

A clueful post about why implimenting SVG support on OS X isn't quite as hard as Dave Hyatt makes it out to be. The work's already half done, as the KDE Project has been working on KSVG for some time now. Even that "the SVG standard is too large and confusing" is a copout - ever heard of "SVG Tiny?" There's just no excuse for adding proprietary extensions to HTML to support Dashboard, as Apple seems intent on doing.

Database Abstraction Layers Considered Harmful

2004-07-09T16:20:00.000Z

Jeremy Zawodny has a thought-provoking piece up about why "Database Abstraction Layers Must Die!" I don't really agree with it (and I don't think it's quite as much against the conventional wisdom as its title makes it out to be), but it's definitely something to give some serious thought to.

B-Trees

2004-07-09T12:43:00.000Z

A nice article on B-Trees (or Balanced Trees, for the pedantic), useful for those who've been out of school a little too long, and even for those who've never been to school at all. "Why are B-Trees important?" one may ask, and the answer's straightforward enough - they can drastically reduce the number of accesses to slow secondary storage required to get at any given record.

The importance of understanding fundamental data structures can't be emphasized enough, and not understanding B-trees and doubly-linked lists ought to be a crime for anyone working with databases; for instance, SQL Server 2000's indexes are implemented as B-trees.

Fujitsu Bankrolling PostgreSQL Development

2004-07-09T03:13:00.000Z

As a native version of PostgreSQL isn't yet freely available for Windows, I haven't been paying much attention to ongoing developments with that rather impressive open-source RDBMS. As such, it struck me as a big surprise to learn that Japan's Fujitsu Corporation has decided to back further work on the project, and it looks to be a long-term commitment too.

Fujitsu this week announced an expanded collaboration with Microsoft on servers for mainframe computing, but the Japanese hardware giant is also investing in open source, paving the way for a handful of new PostgreSQL functions that will benefit all of the open source database's users.

The Japanese company, folding Windows as well as Linux and other open source into its mix of strategy, will support the BSD-based PostgreSQL database with code contributions and underwriting development that will be a part of version 7.5 of the database, PostgreSQL core team member Josh Berkus said. It is expected to be available before the end of the year.

Berkus said Fujitsu, which brought in $45 billion last year, is the largest company to contribute directly to PostreSQL to date, adding that the PostgreSQL community expects its relationship with Fujitsu to continue for "at least the next few years."

Fujitsu beats feature freeze

While Berkus referred to a July 1 freeze on features for the next version of the database, he reported three new features in PosgreSQL -- Tablespaces, Nested Transactions, and Java support -- that are being underwritten by Fujitsu in partnership with Tokyo-based SRA will be included in version 7.5.

"Much of this new functionality will be present in the forthcoming release of PostgreSQL, which is shaping up as the most significant new release of the software since version 7.0 almost four years ago," Berkus said, referring to full point-in-time recovery and two-phase commit, data integrity and scalability improvements, native Windows edition, and solutions for high availability, clustering, and replication currently being developed for different user requirements.

The support for two-phase commits, nested transactions and the like are very cool, but from an adoption POV, by far the most significant aspect of this announcement is the bit about a native Windows edition. If the PostgreSQL developers can deliver on this promise (a big if, seeing as they made the same promise for version 7.3), it will likely lead to an explosion in PostgreSQL usage and visibility. MySQL is fast, but that's about all one can say for it; PostgreSQL is a real RDBMS.

Data Features in Visual Studio 2005

2004-07-07T17:19:00.000Z

Robert Green, Program Manager for the Visual Basic team, gives a rundown of Visual Studio's new DB features in this video.

OS X Tiger Screenshots

2004-07-06T03:16:00.000Z

A nice bunch of pictures of the upcoming release, highlighting new features like Automator, Dashboard, Spotlight and VoiceOver, the new spoken command interface.

Looking at these pictures, if there's one thing that one is made aware of, it's that Apple's graphic design people are by far the best in the business. None of the currently available Microsoft operating systems even come close to OS X for sheer graphic elegance, and it's fair to say that Windows XP, with its garish default "Luna" skin, actually fares worse than Windows 2000 and Windows Server 2003 in the comparison stakes. When will Microsoft learn that "easy to use" and "childlike" aren't one and the same?

PowerPC Emulation on IA32 Hardware

2004-07-06T00:49:00.000Z

File this one under "Cool But Impractical Technologies" - PearPC is a PowerPC emulator which can run at anything from 400 to a mere 40 times slower than the real thing! Yes folks, now you too can use your 3GHz Pentium 4 boxes to emulate a PowerPC running at 77MHz!

Anyone serious about working with the PowerPC platform would likely be better off just getting a secondhand G3 iMac off Ebay or something. As a theoretical exercise this really isn't that awe-inspiring, as any Turing machine should be able to emulate another, given enough memory; still, there's a certain amusement factor to knowing that someone went to all that effort to actually implement such a thing.

PARC Publications on User Interface Research

2004-07-05T22:49:00.000Z

A real treasure trove of information. Looking at how long ago many of these papers were published, it's amazing that desktop user interfaces have seen so little progress since the advent of the Apple Lisa in 1983, and what's even funnier is that the Lisa itself was based on work done way back in the 1970s.

An idea suggests itself here - might one postulate what might immodestly be called "Abiola's Law?" The dictum I have in mind states that desktop interface design will lag the cutting edge research by at least a decade; whether or not it has ahead of it a career as illustrious as "Moore's Law" is uncertain, but as retrodictions go, I'd say it's pretty decent.

TouchGraph GoogleBrowser

2004-07-05T22:22:00.000Z

Although I have the distinct feeling that I've blogged about this tool before on my other blog, I don't see any harm in mentioning it here again. Information visualization constitutes the single most neglected aspect of information retrieval as far as I'm concerned, and as amusing a toy as the TouchGraph GoogleBrowser may be, it is possible to do far, far better; for example, one can look at Tamara Munzner's old Hyperbolic Viewer approach as one possible avenue of improvement.

If there's one aspect of Longhorn that I think worth getting excited about, it isn't so much what WinFS will make possible, as what the easy availability of 3D graphics primitives without going through the DirectX or OpenGL APIs will do for information visualization tools. Couple the arrival of a much more approachable 3D API with the relentless pace at which the demands of the gaming market has made ubiquitous ever more capable 3D graphics cards, and for the first time it looks as if all those advanced 3D interfaces cooked up ages ago, like Xerox PARC's Information Visualizer*, will finally be feasible on the average desktop. Humans, being primates, are largely visual creatures, and it strikes me as absurd that so little use has been made of this commonplace observation.

*More information is available to ACM Digital Library subscribers in a paper which can be downloaded from this link.

Google as Auditing Tool

2004-07-05T20:22:00.000Z

This page lists Google searches that reveal potentially extremely embarassing and financially damaging information. Following are a few examples:

There are even more outrageous examples available from the aforementioned page, including searches that bring up the personal financial details of quite a number of people - just the sort of information phishers live for. It's amazing how little so many site administrators seem to either know or care about security issues.

Interesting Browser Statistics

2004-07-05T13:15:00.000Z

According to this page at least, Mozilla-based browsers are starting to make serious inroads into IE marketshare. What I'm curious about is where exactly these numbers came from, and how they were collected.

Structural Analysis of Proteins

2004-07-05T01:24:00.000Z

In discusing the use of Java 3D for protein visualization, a blogger at Sun touches on a topic I've been fascinated by for quite a few years now - the structural analysis of proteins, and, in particular, predicting how a protein will fold, starting from just raw sequence data. This has to be one of the most important and yet most challenging tasks in computational biology today.

Using Google's Advanced Search Operators

2004-07-05T01:16:00.000Z

Here's a guide with more tips on using poorly documented Google features to get better search results. I've long been familiar with the "filetype:", "link:", "site:" and "related:" operators, but the "allin[xyz]:" operators are new even to me.

Breaking Changes in System.Xml from v1.1 to v2.0 of .NET

2004-07-05T01:07:00.000Z

Dare Obasanjo details changes to System.Xml in Beta 1 of .NET Framework v2.0 that will cause compatability headaches for unwary developers.

A Witty Comment on Security Disclosure

2004-07-04T02:51:00.000Z

In response to yet another browser security hole found by Secunia, a Slashdot commenter made the following clever retort:

The best place to get a response when reporting a security bug is on Bugtraq. :)

Funny but all too true, as the experiences of this other commenter illustrate.

Lorenzo Colitti and I found the same hole several weeks ago, independently of Mark Laurence. I reported it to mozilla.org on June 11 and to Microsoft and Opera on June 16. I got different results from each browser maker:
Mozilla (bugzilla.mozilla.org 246448)
Fixed on June 14. Firefox 0.9 released with the fix June 14. Mozilla 1.7 released with the fix June 17.
Opera (bugs.opera.com 145283)
No response.
Microsoft
On June 21, I received an e-mail containing the following: "... is by design. To prevent this behavior, set the 'Navigate sub-frames across different domains' zone option to Prompt or disable in the Internet zone. We are trying to get this fixed in Longhorn ... on getting this blocking on by default in XP SP2 but blocking these types of navigations is an app compatibility issue on many sites." I usually don't get any response from Microsoft when I report security holes to them; I think I only got a response this time because I used my employer's premier support contract with Microsoft.
Another cross-browser security hole I found (bugzilla.mozilla.org 162020) got similar responses from each browser maker: fixed in Mozilla 1.7 and Firefox 0.9; no response from Opera; confusing statement from Microsoft mentioning XP SP2. 162020 is an arbitrary code execution hole.

Although they're all quick to complain about "irresponsible" disclosures of vulnerabilities by individuals who are supposedly unwilling to give them the time to come up with patches, the ugly reality is that most commercial software vendors prefer to ignore such problems unless there's some media pressure preventing them from doing so. There's nothing quite like a Reuters report alerting the entire world of some embarassing new security hole to get the attention of indifferent corporate entities.

One more thing worth noting: the way in which the Bugzilla database enables such rapid turnaround in bug-fixing time really ought to serve as an inspiration to other organizations. It's good to see Microsoft providing a product feedback center for Visual Studio 2005, but what's needed now is something along the same lines devoted to security problems; one shouldn't have to trawl through the Bugtraq archives to see what, if anything, has been said about a potential problem, only to then be forced to report it by broadcasting it to the entire world in order to get a meaningful response. If Microsoft had a security database where registered outsiders could log and track whatever issues they'd discovered, the impetus for "disclosure by public ambush" would be reduced considerably.

SQL Server Express Manager

2004-07-04T01:44:00.000Z

Microsoft's Eric Feng, Program Manager for SQL Server Express, provides a rundown of SQL Server Express Manager, or XM for short. XM is described as a soon to be released lightweight tool for use in managing both local and remote instances of SQL Server.

Converting Firefox 0.8 Extensions

2004-07-04T01:34:00.000Z

A helpful page with information on how to convert Firefox 0.8 extensions to work with the new API introduced with Firefox 0.9. Although there's an overview of a few of the tags in the "install.rdf" file, here's the link to Ben Goodger's description of the file's format. Goodger's document should be considered the authoritative guide as to what is permissible/recommended and what isn't.

Selectively Deleting Saved Form Information in Firefox

2004-07-04T01:08:00.000Z

Firefox's "Autosave" of form information is usually a wonderful thing, but there are times when it really does get on one's nerves. This can especially be the case when one's made a typo, after which one then has to deal with seeing the erroneous information offered as an alternative forever henceforth.

Short of deleting all saved form information, there's been no easy way to correct such irritating mistakes, but courtesy of this page on the Mozilla Forum, here's a tip that is useful in selectively getting rid of such entries.

If you're using 0.9, you should be able to delete individual entries on form elements (what the original poster mentioned) within web pages with Shift-Delete.

I can verify that this also works with the 0.91 release of Firefox, and as someone else notes on the page, it works with the URL dropdown list as well.

No POSIX Support in Windows XP

2004-07-02T01:06:00.000Z

I hadn't realized that the the OS/2 and POSIX subsystems included with both Windows NT and Windows 2000 had been pulled from Windows XP; going by this document, they're also absent from Windows Server 2003. OS/2 support appears to have simply been discontinued, but the POSIX subsystem functionality at least can be obtained by installing the freely available Windows Services for UNIX (the actual download is on this page).

Debugging in Visual Studio 2005

2004-07-01T21:32:00.000Z

Microsoft's Andy Pennell discusses new debugger features in the Whidbey release of Visual Studio, Beta 1 of which should soon be available on MSDN Universal.

Dashboard is not a Konfabulator Clone

2004-07-01T15:01:00.000Z

Via MacMinute, I came across this interesting article by John Gruber about the differences between Apple's Dashboard and Arlo Rose's Konfabulator project. It confirms what I'd been suspecting myself - that what Apple's trying to do is a lot more ambitious than Konfabulator's objectives, and the superficial similarity between the two has been seized on by the technically illiterate who are always in search of a nice "Goliath cheats David" story.

The Enduring Importance of Understanding Principles

2004-06-30T05:57:00.000Z

This Performance Quiz #3 by Rico Mariani, as well as the accompanying solution, ought to prove a revelation to those who imagine that in this day of 3Ghz CPUs and point-and-click coding wizards, time spent profiling code or slogging through a copy of Knuth's Art of Computer Programming is so much time wasted.

Ours is a field in which products and technologies come and go at an often dizzying speed, but the fundamentals of computer science undergo little change with the passage of time, and it's unlikely there will ever come a time when the need to understand these deeper principles will cease to exist. There's a lot more to programming than putting up sites in PHP!

The funny thing about managed code is that sometimes people forget that just because we offer an easy/convenient way to do things if you're doing a quick RAD application doesn't mean that the RAD way is in fact the right way. In fact, the good old fashioned way is very likely still available and may be an excellent choice. So that brings us to Performance Quiz #3.

The question: Characterize the difference in space and speed between RadParser and ClassicParser, consider the given test input to be typical.

The C# code for the RadParser and ClassicParser he mentions are to be found on the problem page.

Thread-Safety vs. Reentrancy

2004-06-29T20:58:00.000Z

Raymond Chen discusses the difference between the two concepts.

OS X Enhances Search Technologies

2004-06-29T18:34:00.000Z

It seems like Apple's pulled out all the stops to try to answer Brad DeLong's complaints about the limitations imposed by the current level of support for file searching on most modern operating systems. Of course, Microsoft's big WinFS push just might have had something to do with this as well ...

Tiger introduces an innovative new system-wide metadata search engine that can instantly search through more than 100,000 files, documents, emails and contacts all at once.

Searching with Smarts
The metadata engine makes searching smarter, more flexible and powerful by indexing the descriptive informational items already saved within your files and documents. Metadata describes the “what, when and who” of every piece of information saved on your Mac: the kind of content, the author, edit history, format, size and many more details. Most documents, including Microsoft Word documents, Photoshop images and emails, already contain rich metadata items. By using this indexed information for searching, you can tap into tremendous power and accuracy for refining search results.

Faster Results
The engine automatically takes all the metadata inside files and enabled applications and puts the data into a high-performance index. This process occurs transparently and in the background, so you never experience lag times or slow downs during normal operation. When you make a change, such as adding a new file, receiving an email or entering a new contact, the metadata engine updates its index automatically. Results of search requests are displayed virtually as fast as you can type your query.

Application Metadata-Awareness
The metadata engine uses special importer technology to open and read heterogeneous file formats. Tiger includes importers for some of the most popular file formats. The metadata engine can be extended to any new file format, automatically adding an application’s information to your search results.

The search technologies in Mac OS X don’t stop with the metadata search engine. Whenever you perform a search, you will also be searching a powerful content index that uses the full contents of files to find matches. Even documents without any metadata are included in searches.

Apple now seems to have dealt with at least the free-text-search aspect of the scenario Brad outlined, and the company has also apparently taken to heart that the performance-crippling nature of the Indexing Service built into Windows 2000 and its successors is simply unacceptable if its indexing engine is to be worth using; there's no good reason why automatically keeping track of changes to documents should eat up loads of CPU time, Microsoft decided upon a boneheaded implementation.

As nice as this new indexing engine seems to be, however, I still think that there are ways in which it won't be able to come close to relying on Google to do one's indexing for one. Barring support for semantic features such as synonymy, metonymy, antonymy, simile, metaphor, polysemy, synecdoche and the like, no machine-based system of annotation will ever touch an implicitly hand-maintained system like Google's PageRank-based offering in terms of relevance or comprehension. Do any of the indexing systems out there even have support for something as rudimentary as word-stemming? I doubt it.

UPDATE: This Register story by Andrew Orlowski is also worth reading.

OSX 10.4 Preview: Hits and Misses

2004-06-29T18:08:00.000Z

Tristan Louis has some interesting things to say about the preview of Tiger offered by Apple at the WWWDC. Some of the criticisms he makes, while technically accurate, are, I think, unfair however.

It's easy to fault Apple for not providing today all of the gee-whiz promises being made for Longhorn tomorrow, but if one looks at the difference between the Apple and Microsoft approaches as being a matter of "release early and often" vs. "knock em out with big updates every so many years", there's much to be said for Apple's more incremental approach. For one thing, it gets at least some of the useful new functionality in users' hands earlier; for another, it's simply much more likely to work, as few things are as common in software development as drawing up grand schemes on paper, only to see the entire edifice collapse during the process during the implementation stage.

MSDN Product Feedback Page

2004-06-29T16:12:00.000Z

MSDN now has a bug reporting system! Microsoft really does seem to be listening after all! Hmm, maybe Robert Scoble isn't all full of cowdung after all? Being as cynical as I am about Microsoft's activities and intentions, I'm finding these changes difficult to process, but if the Redmondians can keep this sort of thing coming, I just may start to change my mind about the company everyone loves to hate.

SQL Server 2005 Express Beta

2004-06-29T16:03:00.000Z

I see that the SQL Server 2005 Express Beta (the successor to MSDE) is also now available for free download, as in fact are all the rest of the Visual Studio 2005 Express Beta lineup. The only interpretion I can make of all this is that Microsoft is starting to take the threat posed by the allure of free development tools on Linux and OS X seriously. Thank God for competition!

Visual C++ Express

2004-06-29T15:58:00.000Z

The first Visual C++ 2005 Express Beta (equivalent to the old Visual C++ Standard Edition) is now available online for free download, and unlike the old entry-level editions, it actually includes an optimizing compiler, which is a very pleasant surprise. This sort of openness really makes a change for Microsoft.

Google Hacks

2004-06-26T22:02:00.000Z

Sun blogger Rich Burridge discusses a book published by O'Reilly called Google Hacks, which contains, as one might guess, lots of cool tips one can use to search Google more effectively, many of which are poorly documented, if at all.

Here's a page on which a few of the hacks can be found, including my own personal favorite - a means for getting around Google's frustrating 10-term search limit.

Help comes in the form of Google's full-word wildcard (Hack #13). It turns out that Google doesn't count wildcards toward the limit.
So when you have more than 10 words, substitute a wildcard for common words like so:
"do as * say not as * do" quote origin English usage
Presto! Google runs the search without complaint and you're in for some well-honed results.
TIP
Common words such as "I," "a," "the," and "of" actually do no good in the first place. Called "stop words," they are ignored by Google entirely. To force Google to take a stop word into account, prepend it with a + (plus) character, as in:+the.

Source code accompanying the book can be downloaded from here. Also of possible interest to those looking for more hacks is this site

Using the "RunAs" Command

2004-06-23T17:36:00.000Z

Microsoft's Aaron Margosis gives a very detailed rundown of how to go about administrative tasks in Windows while running with limited privileges.

Virtuoso and the Semantic Web

2004-06-23T16:20:00.000Z

Kingsley Idehen talks about Tim Berners-Lee's Semantic Web vision in relation to his own Virtuoso product offering.

As I continue my quest to unravel the thinking and vison behind the "Universal Server" branding of Virtuoso, it always simplifies matters when I come across articles that bring context to this vision.

Tim Berners-Lee provided a keynote at WWW2004 earlier this week, and Paul Ford provided a keynote breakdown from which I have scrapped a poignant excerpt that helps me illuminate Virtuoso's role in the inevitable semantic web.

First off, I see the Semantic Web as a core component of Web 2.x (a minor upgrade of Web 2.0), and I see Virtuoso as a definitive Web 2.0 (and beyond) technology, hence the use today of the branding term "Universal Server". A term that I expect to become a common product moniker in the not too distant future.

The first challenge that confronts the semantic web is the creation of Semantic content. How will the content be created? Ideally, this should come from data, at the end of the day this is a data contextualization process.

A Key Phrase

2004-06-23T03:29:00.000Z

In a post by Dare Obasanjo, he says something that might easily be overlooked, but which I think is of great importance if true. In particular, he says:

However the primary scenarios the WinFS folks want to tackle are about rigidly structured data which works fine with using objects as the primary programming model. (emphasis added)

That would seem to imply that WinFS won't be doing much of anything to cure the problems arising from the ongoing information glut: how much of the data most people handle on a daily basis is "rigidly structured"? I'd say virtually none.

A Serendipitous Discovery

2004-06-21T23:59:00.000Z

A fellow who goes under the name Woit led me to this article by Barry Mazur in April's Bulletin of the AMS. To show what's so fascinating about it, I'll let Woit's own words do the talking:

It brings together ideas about elliptic curves and deformations of Galois representations that were used by Wiles to prove Fermat's last theorem, mirror symmetry, quantization, non-commutative geometry and much more. I'm not convinced it all hangs together, but it's a wonderful piece of expository writing.

If that isn't fascinating, I don't know that anything is. In fact, I could scarcely have imagined that all these things had much to do with each other, much in the same way, I suppose, as it struck me as farfetched on first learning about the GUE Hypothesis.

For someone with a background in pure mathematics, and whose interests have always lain in a branch long thought the least practical of all, it's always a pleasure to discover possible new deep and meaningful links between number theory and the physical world.

The Evolution of Windows Dialog Templates

2004-06-21T23:45:00.000Z

When it comes to the arcane details of Windows programming, everyone knows that Raymond Chen is the guy to look to, and he doesn't dissapoint with his latest post on the 32-bit classic DIALOG template. The older article on the 16-bit version is also worth taking a look at, if only for historical perspective.

OS X Made Difficult

2004-06-21T23:38:00.000Z

Microsoft's Matt Evans tells a horror story about fixing his sister-in-law's G3 machine after a system update installed a dodgy driver. Talk about an eye-opening experience!

Half of the stuff he describes won't even begin to make sense to the average person who's never dealt with Unix much at command-line level - suffice to say that while OS X does a great job of hiding the fiendish complexity of having a hybrid of NeXTStep and MacOS resting on top of FreeBSD from the user most of the time, there will be occasions on which the underlying complexity will need to be grappled with to get things going again. In a way this shouldn't be surprising: how realistic is it to expect the power of a modern operating system without any of the accompanying complexity?

Windows NT and VMS

2004-06-21T23:01:00.000Z

A December 1998 article by Mark Russinovich in which he lays out just how much the architecture of Windows NT owes to the design of VMS. Essentially, David Cutler brought his team over to Redmond and rewrote VMS from the ground up, except this time they made sure it could run Win32 programs.

When Microsoft released the first version of Windows NT in April 1993, the company's marketing and public relations campaign heavily emphasized the NT (i.e., New Technology) in the operating system's (OS's) name. Microsoft promoted NT as a cutting-edge OS that included all the features users expected in an OS for workstations and small to midsized servers. Although NT was a new OS in 1993, with a new API (i.e., Win32) and new user and systems-management tools, the roots of NT's core architecture and implementation extend back to the mid-1970s.

[............]

Most of NT's core designers had worked on and with VMS at Digital; some had worked directly with Cutler. How could these developers prevent their VMS design decisions from affecting their design and implementation of NT? Many users believe that NT's developers carried concepts from VMS to NT, but most don't know just how similar NT and VMS are at the kernel level (despite the Usenet joke that if you increment each letter in VMS you end up with WNT (Windows NT).

[............]

"Why the Fastest Chip Didn't Win" (Business Week, April 28, 1997) states that when Digital engineers noticed the similarities between VMS and NT, they brought their observations to senior management. Rather than suing, Digital cut a deal with Microsoft. In the summer of 1995, Digital announced Affinity for OpenVMS, a program that required Microsoft to help train Digital NT technicians, help promote NT and Open-VMS as two pieces of a three-tiered client/server networking solution, and promise to maintain NT support for the Alpha processor. Microsoft also paid Digital between 65 million and 100 million dollars.

Yet more evidence that there are few people alive who can beat Bill Gates for business acumen. Digital sold their birthright for a pittance, and now where are they?

A First Look at 3-D Support in Avalon

2004-06-21T00:54:00.000Z

A Longhorn Developer Center article on the new graphics-subsystem's support for 3 dimensional drawing.

Applies to:
Longhorn Community Technical Preview, WinHEC 2004 Build (Build 4074)

Summary: Demonstrates how Avalon's simple 3-D support enables you to create three-dimensional scenes. Discusses the Avalon ViewPort3D element and the use of point of view, camera, and lights in XAML markup.

Three Theses of Representation in the Semantic Web

2004-06-20T22:26:00.000Z

Abstract:
The Semantic Web is vitally dependent on a formal meaning for the constructs of its languages. For Semantic Web languages to work well together their formal meanings must employ a common view (or thesis) of representation, otherwise it will not be possible to reconcile documents written in different languages. The thesis of representation underlying RDF and RDFS is particularly troublesome in this regard, as it has several unusual aspects, both semantic and syntactic. A more-standard thesis of representation would result in the ability to reuse existing results and tools in the Semantic Web.

Dare Obasanjo - Jon Udell and WinFS

2004-06-20T21:56:00.000Z

Obasanjo responds to Jon Udell's article, and his comments are surprisingly ambivalent for an employee of a company widely known as the Borg.

Jon Udell has started a series of blog posts about the pillars of Longhorn. So far he has written Questions about Longhorn, part 1: WinFS and Questions about Longhorn, part 2: WinFS and semantics which ask the key question "If the software industry and significant parts of Microsoft such as Office and Indigo have decided on XML as the data interchange format, why is the next generation file system for Windows basically an object oriented database instead of an XML-centric database?"

I'd be very interested in what the WinFS folks like Mike Deem would say in response to Jon if they read his blog. Personally, I worry less about how well WinFS supports XML and more about whether it will be fast, secure and failure resistant. After all, at worst WinFS will support XML as well as a regular file system does today which is good enough for me to locate and query documents with my favorite XML query language today. On the other hand, if WinFS doesn't perform well or shows the same good-idea-but-poorly-implemented nature of the Windows registry then it'll be a non-starter or much worse a widely used but often cursed aspect of Windows development (just like the Windows registry).

As Jon Udell points out the core scenarios touted for the encouraging the creation of WinFS (i.e search and adding metadata to files) don't really need a solution as complex or as intrusive to the operating system as WinFS. The only justification for something as radical and complex as WinFS is if Windows application developers end up utilizing it to meet their needs.

Obasanjo's comments are well worth taking into account; I for my part don't see how WinFS can possibly live up to the hype Microsoft is generating about it, especially in light of the amount of time and effort that has gone into dealing with these issues with regards to the W3C's Sematic Web initiative.

The Semantic Web as a Language of Logic

2004-06-20T16:31:00.000Z

An article by Tim Berners Lee in which he discusses the semantic web from the viewpoint of mathematical logic. The key thing to take away is that there's an inherent tension between expressiveness and manageability - the more we can say, the harder it is for us to be sure that what we say makes sense, or to say things within a reasonable timeframe; think of the difference between propositional logic and first-order logic.

This looks at the Semantic Web design in the light a little reading on formal logic, of the Access Limited Logic system, in particular, and in the light of logical languages in general.

I'll have quite a bit more to say about this later when I'm less pressed for time.

Chris Sells - "WinFS is a Domain Ontology with Style"

2004-06-20T00:02:00.000Z

An old post by Chris Sells in which he links to a guy by the name Michael Herman, telling us the following:

Michael Herman caught onto WinFS's real nature last year and I'm just now catching up.

Herman in turn refers us to a Stanford paper titled "Ontology 101: A Guide to Creating Your First Ontology". Here's what Herman has to say about the insights he's obtained from reading the Stanford primer:

This paper has (for me) brought a lot of deeper clarity to what WinFS really is: WinFS is a knowledge repesentation, storage and synch system ...a literal implementation of a system strongly based on ontology related concepts (whether intended by MS or not).

To this I can only say "But of course! What else could it be?" I've read my John Sowa, and it's precisely because I'm aware of the central importance of ontologies to knowledge representation that I find myself bemused whenever I hear someone say that metadata is essentially a solved problem. Nothing could be further from the truth!

Material Related to Information Retrieval

2004-06-19T23:28:00.000Z

Here's my chance to make use of Google's organizing powers to reduce the number of browser tabs I have open, by saving interesting material for later perusal:

How to write a DCOM server in C#

2004-06-18T20:50:00.000Z

Adi Oltean walks us through the process of implementing a DCOM server with C#. "Why is this interesting", you ask? Here's why:

Well, why DCOM and not .NET Remoting? For one thing, DCOM offers a secure interprocess communication channel through TCP/IP... which .NET remoting doesn't have unfortunately. Also, a DCOM server can be hosted in almost any process, including Windows Services!

And here's an outline of the actual implementation process.

The ideas are described below (this is pretty straightforward assuming you already know COM)
1) Your server process will expose a COM class factory that would just create your .NET object.
2) In COM you register the class factory using the standard CoRegisterClassObjects API
3) Make sure you call CoInitializeSecurity on your first process, for example to allow only Administrators to call in
4) Register your .NET assemblies with REGASM.EXE. Make sure your .NET class is visible through COM so CCW can be created around it (more details in MSDN on COM Interop section).
5) Remove the auto-generated InprocServer32 key after registration (REGASM puts it there but we are going out-of-proc)
6) Add the standard LocalServer32 / AppID registry keys.

That's it! Now you have a secure DCOM service implemented entirely in C# :-)

The full source code is included in the actual post.

On the Economics of GMail

2004-06-18T20:36:00.000Z

A commenter by the name Ian Montgomerie says some very insightful things on Brad DeLong's Webjournal:

On another note, though, don't underestimate the cheapness of Google's storage. It's obviously very cheap relative to the competition, but in absolute terms they still can't afford to give everyone a gigabyte of email storage now. They know darn well that most people will use maybe 10% of that any time soon, and mostly in text (they would be stupid not to be compressing that text in the background down to a level where the typical GMail user's 100 megs or less of email are 10 megs or less of actual hard disc space, so a typical modern hard disc could serve 10,000 users). EVENTUALLY people will accumulate enough email, especially with attachments, so that many are actually using the bulk of their space. But that will take years by which time hard discs will be much cheaper. Google can reliably bet that from this point onward, hard disc prices will probably drop at least as fast as email volume rises.

Indeed, the speed at which storage costs per GB continues to drop is truly astounding to behold: Hitachi and Seagate both already have 400GB (i.e, 0.4 Terabyte) hard drives for sale, and this is for the low-end consumer market.

Linus vs. Tanenbaum

2004-06-17T22:24:00.000Z

A piece of history: the great debate between Finnish hacker Linus Torvalds and OS guru Andrew Tanenbaum, from way back in 1992. Following is what Tanenbaum had to say about Linux:

Most older operating systems are monolithic, that is, the whole operating system is a single a.out file that runs in 'kernel mode.' This binary contains the process management, memory management, file system and the rest. Examples of such systems are UNIX, MS-DOS, VMS, MVS, OS/360, MULTICS, and many more.

The alternative is a microkernel-based system, in which most of the OS runs as separate processes, mostly outside the kernel. They communicate by message passing. The kernel's job is to handle the message passing, interrupt handling, low-level process management, and possibly the I/O. Examples of this design are the RC4000, Amoeba, Chorus, Mach, and the not-yet-released Windows/NT.

While I could go into a long story here about the relative merits of the two designs, suffice it to say that among the people who actually design operating systems, the debate is essentially over. Microkernels have won. The only real argument for monolithic systems was performance, and there is now enough evidence showing that microkernel systems can be just as fast as monolithic systems (e.g., Rick Rashid has published papers comparing Mach 3.0 to monolithic systems) that it is now all over but the shoutin`.

MINIX is a microkernel-based system. The file system and memory management are separate processes, running outside the kernel. The I/O drivers are also separate processes (in the kernel, but only because the brain-dead nature of the Intel CPUs makes that difficult to do otherwise). LINUX is a monolithic style system. This is a giant step back into the 1970s. That is like taking an existing, working C program and rewriting it in BASIC. To me, writing a monolithic system in 1991 is a truly poor idea.

And what about Linus' reply? Here's an excerpt, to give a flavor of it:

In article <12595@star.cs.vu.nl> ast@cs.vu.nl (Andy Tanenbaum) writes:
I was in the U.S. for a couple of weeks, so I haven't commented much on LINUX (not that I would have said much had I been around), but for what it is worth, I have a couple of comments now.

As most of you know, for me MINIX is a hobby, something that I do in the evening when I get bored writing books and there are no major wars, revolutions, or senate hearings being televised live on CNN. My real job is a professor and researcher in the area of operating systems.
You use this as an excuse for the limitations of minix? Sorry, but you loose: I've got more excuses than you have, and linux still beats the pants of minix in almost all areas. Not to mention the fact that most of the good code for PC minix seems to have been written by Bruce Evans.

Re 1: you doing minix as a hobby - look at who makes money off minix, and who gives linux out for free. Then talk about hobbies. Make minix freely available, and one of my biggest gripes with it will disappear. Linux has very much been a hobby (but a serious one: the best type) for me: I get no money for it, and it's not even part of any of my studies in the university. I've done it all on my own time, and on my own machine.

Re 2: your job is being a professor and researcher: That's one hell of a good excuse for some of the brain-damages of minix. I can only hope (and assume) that Amoeba doesn't suck like minix does.

The normally mild-mannered Finn is clearly no shrinking violet when pushed sufficiently hard.

Looking back on events, the great to-do Tanenbaum made about microkernels vs. monolithic kernels now seems utterly strange; it's now crystal clear that this was one case of an academic being so infatuated with the latest elegant ideas about design that he allowed himself to be blinded to just how far one could take less avant-garde approaches. In that respect the whole microkernel vs. monolithic kernel argument now looks very much like the RISC vs. CISC debate.

Verifying Digital Signatures on Windows 2000/XP/2003 System Files

2004-06-17T01:17:00.000Z

Raymond Chen blogs about the File Signature Verification (sigverif) utility.

VSTS Newsgroups

2004-06-17T01:00:00.000Z

Microsoft now has publicly accessible newsgroups for Visual Studio Team System, the update formerly known as "Whidbey". Information on how to access these newsgroups is available on this page.

Helping the Enemy?

2004-06-16T22:20:00.000Z

Microsoft's Larry Osterman discusses a bug he found in Mozilla, and though he didn't bother to go to the trouble of filing a bug report himself, a helpful reader of his blog did, and it's now been voted up a few times. Here we see the virtue of openness - one simply can't imagine anything like this ever happening with Microsoft's own products.

Joel on Software - How Microsoft Lost the API War

2004-06-16T21:35:00.000Z

A very long but amusing rant by Joel Spolsky about the workability of Microsoft's penchant for continuous revolution in the age of web applications. He also makes a vital point that I've made several times myself:

So the Web user interface is about 80% there, and even without new web browsers we can probably get 95% there. This is Good Enough for most people and it's certainly good enough for developers, who have voted to develop almost every significant new application as a web application.

Which means, suddenly, Microsoft's API doesn't matter so much. Web applications don't require Windows.

It's not that Microsoft didn't notice this was happening. Of course they did, and when the implications became clear, they slammed on the brakes. Promising new technologies like HTAs and DHTML were stopped in their tracks. The Internet Explorer team seems to have disappeared; they have been completely missing in action for several years. There's no way Microsoft is going to allow DHTML to get any better than it already is: it's just too dangerous to their core business, the rich client. The big meme at Microsoft these days is: "Microsoft is betting the company on the rich client." You'll see that somewhere in every slide presentation about Longhorn. Joe Beda, from the Avalon team, says that "Avalon, and Longhorn in general, is Microsoft's stake in the ground, saying that we believe power on your desktop, locally sitting there doing cool stuff, is here to stay. We're investing on the desktop, we think it's a good place to be, and we hope we're going to start a wave of excitement..."

The trouble is: it's too late.

Microsoft isn't opposed to standards compliance simply because it reduces lock-in: after all, Mozilla and Safari both bend over backwards to accomodate Internet Explorer's idiosyncracies, and they are largely successful in doing so. The real reason behind Microsoft's inaction is that a web based on an easily extensible framework like XHTML 1.1 is a web in which semantically rich content can be made available to all regardless of what clients they're using. SVG would make possible fast and entirely web-based alternatives to heavyweights like Adobe Illustrator, as well as desktop-like richness in user interfaces; MathML would be the beginning of the end for old desktop standbys like Maple and Mathematica; all sorts of new extensions to XHTML could be invented to provide through the web browser the very sorts of functionality that have traditionally made Windows so compelling a platform. Bill Gates is no fool, so I'm sure he's realized all of this, and it'll be a cold day in hell before Microsoft makes any changes to Internet Explorer that bring this dangerous vision any closer to reality.

Java vs C++: Which is Faster?

2004-06-16T00:41:00.000Z

Via Slashdot, it transpires that a fellow by the name Mark Lea has updated the old "Java vs. C++ shootout" from way back in 2001, in which Java fared badly at the time; this time, though, things are rather different.

"I was sick of hearing people say Java was slow," says Keith Lea, "so I took the benchmark code for C++ and Java from the now outdated Great Computer Language Shootout (Fall 2001) and ran the tests myself." Lea's results three years on? Java, he finds, is significantly faster than optimized C++ in many cases.

There are some caveats to the test results, however, the most important of which is Lea's choice of compiler. Why GCC 3.3.1, instead of the Intel compiler or even the freely available Visual C++ Toolkit? As I've mentioned earlier, if there's one thing GCC is not, that is acting as a highly-optimizing compiler designed to squeeze the last ounce of speed out of a given platform.

The other point of contention with Mark Lea's tests is the choice of optimizer switches he made. In particular, he only opted for -O2 optimization, which is fine for most applications that spend their time waiting on data or user input, but far from optimal when high performance is important. He defends his choice by saying that -O3 performs space-speed tradeoffs, but that is hardly a worthwhile reason for not using that instead: hard drive space is cheap and continuously, rapidly getting cheaper, and most people would rather cope with a little storage bloat than spend more time waiting around for code to finish executing.

Having said all the above, I do think that these updated benchmarks indicate that Java is not quite the dog its reputed to be, at least not nowadays. As some of the Slashdot commenters point out, the JVM does have certain advantages over a C++ compiler, not least of which is that it can profile running code and optimize accordingly, something no statically compiled program can ever do. Another advantage Java has over C++ (and one Java shares with Fortran*), is that it lacks pointers, which makes code analysis and optimization a lot easier than it otherwise might be. Whether these advantages will outweigh the benefits of static compilation is something that must be ascertained on a case-by-case basis.

One thing that does stand out from the testing is how much faster the server JVM is than the client version in nearly all tests, so much so that Lea says the following:

They also show that no one should ever run the client JVM when given the choice ... [and] everyone has the choice.

*One final point: no one in his right mind who knew anything about high performance computing would ever write his numerical routines in C++. There's a very good reason why Fortran compilers are still in demand!

Mathematics Lecture Notes

2004-06-14T21:20:00.000Z

The University of Sydney's Bob Howlett maintains a web page with freely available lecture notes on several topics of mathematical interest, including number theory, galois theory and the theory of group representations. While we're talking about group representations, Cambridge's Lek-Heng Lim also has a web page up for the Part IIB Mathematical Tripos, covering - yes, you guessed it - representation theory. By the way, does anyone find it a tad bit strange that a page on lectures for Cambridge students is actually being hosted on a Stanford server?

URL Rewriting with ASP.NET

2004-06-13T18:43:00.000Z

An article on how to duplicate Apache-style mod_rewrite functionality on ASP.NET.

Mozilla Futures

2004-06-13T01:20:00.000Z

This links to a slideshow which outlines the planned roadmap for Mozilla as it approaches version 2.0. The main thrust seems to be to provide an alternative to Microsoft's proprietary XAML GUI markup language, which is expected to be an integral part of Longhorn in 2006/2007.

Native, fast SVG support is a central part of this vision of Mozilla's future, as is hardware-assisted graphics acceleration via OpenGL and GDI+, a la Quartz Extreme and Longhorn's Desktop Compositing Engine - except that Windows 2000/XP users won't have to upgrade to obtain the benefits of hardware acceleration within the browser. Here's as good a reason as any for non-game developers to be grateful to John Carmack - he kept OpenGL on Windows alive virtually singlehandedly, by refusing to write to the DirectX API. If not for him, native OpenGL support would long since have been relegated to the high-end workstation segment of the market.

The CoolWebSearch Chronicles

2004-06-13T00:08:00.000Z

A website run by a Dutch student who goes by the name Merijn Bellekom, devoted to everyone's favorite piece of spyware nastiness. He not only keeps a running tally of the numerous variants of this pest, but also provides useful tools that can (in most cases) get rid of CoolWebSearch even when old standbys like Spybot and Ad-Aware are defeated.

One interesting factoid I picked up on the page is that there are CWS variants so tenacious that not even the sorts of specialized tools he provides are able to remove them. This ought to serve as a wakeup call to all those lazy Windows users who never bother to run Windows Update and don't have the good sense to listen when urged to get themselves a real web browser. The smug assumption that third-party tools will always be able to compensate for end-user laziness and stupidity is about to die a long-overdue death.

Blum-Blum-Shub

2004-06-12T15:09:00.000Z

Wikipedia has a pretty decent entry on the Blum-Blum-Shub pseudorandom number generation algorithm. Why should anyone care about this, you ask?

The generator is not appropriate for use in simulations, only for cryptography, because it is not very fast. However, it has an unusually strong security proof, which relates the quality of the generator to the difficulty of integer factorization. When the primes are chosen appropriately, and O(log log M) bits of each xn are output, then in the limit as M grows large, distinguishing the output bits from random will be at least as difficult as factoring M.

[............]

If integer factorization is difficult (as is suspected) then BBS with large M will have an output free from any nonrandom patterns that can be discovered with any reasonable amount of calculation. There are very few random number generators or cryptographic systems with such strong results known.

That's why.

Optimization: Your Worst Enemy

2004-06-12T14:20:00.000Z

For a historically-informed and much more nuanced overview of the perils and pitfalls of performance optimization, this treatise can't be beat. No matter how much you may think you know, there's always someone who knows a lot more than you do.

Why Bother Learning Assembly Language?

2004-06-12T13:21:00.000Z

A very interesting Slashdot discussion is going on about the pros and cons of learning assembly language. Although I'm familiar with more than one assembly language myself, including Motorola 68000, DEC Alpha and (yuck!) Intel x86, I'm personally of the opinion that unless one is working in a field like game development or numerical computing where top performance is the utmost prioirity, messing about with assembly is mostly a waste of time, and performance improvements are better obtained by focusing on algorithms, i/O and program architecture. Even the most carefully hand-optimized piece of assembly code that happens to use an O(n²) algorithm like bubble sort will eventually be outperformed by a piece of Perl or VB6 code that uses an O(n log n) alternative like merge sort.

For numerical computation, game development or anywhere else where access to the SIMD functionality included in most modern-day CPUs is vital, intimate knowledge of assembly-language will continue to be vital, as it will be for those who have to work at the systems level, e.g. low-level driver writers and the like. For the vast majority of programmers outside these fields, knowledge of assembly language is only important insofar as it is difficult to do binary-level debugging without it, as is often necessary when source-code is not available. Fiddling about with register instructions and so forth is a massive drain of developer time and energy which can be put to more profitable uses, and the worst thing of all is that in most cases, the hand-tweaked code people come up with will actually turn out to be slower than what they'd have obtained had they left the optimizing to a decent compiler.

My own two bits of advice to those concerned about performance; don't bother programming with code execution speed foremost in mind, other than to avoid gross inefficiencies where possible. Write clean, maintainable, future-oriented code, and see whether it performs acceptably before going the extra step - you'll be surprised how rarely the speed of code execution is actually an issue these days, with network I/O usually being the main holdup. If greater speed does turn out to be of the essence, the first thing to do is profile, profile, profile, and only after identifying the most critical hotspots should you bother looking for optimizations; even then, you'll likely find that you can either obtain the desired improvements by modifying the algorithm you're using or by rethinking some design considerations, or you can essentially "outsource" the problem by relying on pretuned 3rd party libraries like ATLAS or the AMD Core Math Library. I know that I relied heavily on the Compaq Math libraries back when I was writing high-performance routines for the Alpha 21264.

On the Importance of Data Modeling

2004-06-11T23:31:00.000Z

An interesting post on data modeling by a Sun Microsystem employee named Kristen.

If I had a nickel for everytime some Web publishing manager told me their job requires them to copy and paste content between various Web sites... Well, let's just say, I could buy a lot more stock. :)

I hear about this from friends who work on sites across the industry -- there's lots of mindless manual repurposing of content going on out there. This is a problem on sooo many levels on sooo many sites... not only is it expensive, and time consuming, but it even affects usability of web sites since all that manually repasted data is pretty much trapped in its own little silo never to be used again.

Case in point: I was in a web technology User Committee meeting the other day and the subject came up that we're using two (or three or more?) different tools to create and manage a certain type of product content, with each destination site pretty much storing its own copy of the content.
We're copying and pasting, or building perl scripts to do our data mining. What we really want to do is write it once and reuse it.

A well-respected colleague, Martin Hardee, responded "You know, it really all comes down to data models, right?"

My mind jumped in gear... Maybe these blogs are my chance to make metadata evangelists and data modeling believers out of everyone! (ok, maybe a few, if they start reading!) I know every company has this same challenge. Now thanks to Will and others, we now have a cool place to talk about it.

Design Patterns: Abstract Factory

2004-06-10T00:22:00.000Z

An important pattern to know. Not everything can be reduced to singletons ...

An Annoying Firefox Bug

2004-06-09T19:26:00.000Z

I love Firefox as a browser, so much so that I no longer use anything else, but if there's one misfeature it has that drives me up the wall, it's that it often displays British pages without explicit charset settings in their <meta> tags using the Chinese Simplified (GB18030) encoding instead, even if the pages in question have been sent with the right encoding information embedded in the HTTP header. I plan to file this in Bugzilla once I've done a little more testing to ensure that there's nothing unique about my setup that's triggering this behavior.

Wow

2004-06-09T15:15:00.000Z

Apple has just announced its new Power Mac G5 lineup. and the only thing I can say is I'm impressed. Not only have the clock speeds beeen ramped up to a maximum of 2.5 GHz, but the entire product range now consists of dual-CPU machines. Here's one more respect in which Apple is ahead of the PC crowd, where 2-CPU machines continue to be restricted to the server and high-end workstation market.

One thing to note: though the 2.5 GHz CPU speed on the top of the line G5 might not seem like a lot in the current era of 3.4 GHz Pentium 4 processors, the really important thing is the amount of work that a machine can execute in a given time, which is a measure of IPC multiplied by clock speed. One consquence of the PowerPC's cleaner RISC design is that its IPC count is higher than that of the x86 alternatives, so a single-CPU PowerPC running at 2.5 GHz is actually comparable if not faster at most tasks than a Pentium 4 running at 3.4 GHz. It's also worth pointing out that the fastest AMD chips out are also actually running at 2.4 GHz.

The rough parity between the fastest chips from IBM, AMD and Intel isn't surprising once one takes into account that they're all using essentially the same process technologies, and none of the three has such a stranglehold on design talent as to be able to outrace the others for very long. The difference between Intel and the other two CPU vendors lies in the conscious decision by Intel to trade off IPC for higher clock speeds, with the expectation in mind that most consumers are so taken in by raw Megahurtz [sic] that they'd be fooled into thinking the Intel offerings were superior. While this probably did do the job with the most ignorant consumers, for the most part it seems to have failed, as AMD hasn't really ceded any market share to Intel in the desktop sector.

At any rate, what's really holding Apple back at present isn't its chip architecture but the quality of its compilers. GCC is a marvelously complete, portable and standards compliant compiler, but unlike Visual Studio .NET 2003 or Intel VTUNE, it was never designed to extract every last ounce of performance from any particular CPU architecture. IBM certainly has the requisite compiler technology to squeeze big gains out of the CPUs it's delivering to Apple, so I don't see what is preventing the licensing of these tools to the broader Apple developer community, even if at an appropriately hefty price.

ADDENDUM: I spoke too soon. IBM has already released the necessary software for the OS X platform.

What a Surprise

2004-06-08T23:33:00.000Z

Secunia's just disclosed two new Internet Explorer vulnerabilities. The suggested solution: disable Active Scripting support for all but trusted web sites - and, if I may throw in my own bit of advice, use another browser.

The Handbook of Applied Cryptography

2004-06-08T00:19:00.000Z

An excellent reference on the subject, well worth its weight in gold, and available online for all to read for free! If there's one shortcoming of the book worth mentioning, it is that, having last undergone major revision in 1996, it gives no coverage of the latest developments in the field (e.g. AES or the newest ECC research). Still, mastering all the material in here will take one a pretty darned long way, and at this price there's really not much for anyone to complain about.

The Handbook would probably work best as a second look at the subject for someone who's already gone through Bruce Schneier's Applied Cryptography, which provides a far less mathematically demanding treatment of the subject matter. Although there are no proofs in the Handbook, it does presume some acquaintance with abstract algebra, number theory, probability and information theory, one that cannot really be obtained just by reading through the theorems stated as givens in Chapter 2.

The Joy of Linux

2004-06-07T20:03:00.000Z

This post by Matt Mullenweg illustrates why Linux, whatever its merits as a server, engineering and HPC platform, is not about to take the desktop by storm anytime in the forseeable future.

It’s not there yet. I’m being totally unfair, because comparing Windows or OS X to the Linux distribution I’m using (Gentoo) is like apples and oranges. Gentoo is meant for people who are comfortable with the command-line and want to experiment. (It’d be fairer to compare Windows to Suse.) But I just want to bridge a connection between an ethernet card and a wireless USB device. Is that too much to ask? When I did this in Windows I just highlighted the two connections, right-clicked, and chose “Bridge Connections.” It spun for a little bit and then it was done. End of story.

The work started yesterday, when I figured out that the reason nothing would emerge is that there were bad GCC flags in my make.conf file. How they got there, I’ll never know. Bad ebuild I guess. So I got that fixed, synced, and updated world. 85 packages! The next day I compiled a new kernel (2.6.7-rc2) but forgot to load the Tulip module required for my ethernet card. Recompile, reboot. Runs great, and I tell myself everything is running faster. Right now I’m bridging my desk LAN to the main router through the Windows desktop, and since I just moved the linux box on a new UPS I’d like to move the wireless connection there too. I was feeling lucky, so I tried just plugging it in to see what happened. dmesg, device not recognized. Search search search the excellent Gentoo forums, find out that to get my MA101 working I shouldn’t use the drivers from Sourceforge, but rather the at76c503a Atmel drivers for wireless USB devices. Download, compile against current kernel sources, install. Reboot. Don’t have any wireless tools. emerge wireless-utilities. Twiddle for 45 minutes to see why it won’t see any networks. Forgot to enable “Wireless radio (non-HAM)” support in the kernel. Recompile. Reboot. iwscan shows my network, iwconfig wlan0 works as expected. The instructions that tell me to put in ad-hoc mode are wrong. (Hour later.)

The funny thing is that this extensive excerpt doesn't even describe in full the hoops he had to go through, and what is worse yet, without managing to succesfully resolve the problems he was having.

I've been where he's at far too often in the past myself, and if there's one thing to be said about Linux, it's that its rough edges force one to learn a whole lot more about the internal workings of Unix-like systems than one might ever voluntarily have chosen to - and this is true of all Linux distributions in the long run, not just Gentoo. Does anyone really see some blue-haired grandma spending her free time leafing through Maurice Bach's Design of the UNIX Operating System or Uresh Vahalia's UNIX Internals, simply so she can get her new digital camera working?

If anyone is intent on running UNIX without going through endless hassles over arcane technical issues, I strongly suggest getting a machine from this company. Sure, it'll cost more than downloading a copy of Debian and burning it to CD-ROM, but if one's time is worth anything at all, the difference will very quickly be made up in terms of time lost for no good reason. Linux has its place - I'd recommend it over Windows Server 2003 as a DNS, web or file server any day - but that place isn't in the home of the average individual.