May 2004 - Posts
My proposal for an O/R mapping BOF at the TechEd Europe 2004 event has been accepted! If you're planning to go to TechEd Europe 2004, please vote for this BOF at this URL: http://www.ineta.org/bof. (select TechEd europe, then in the top menu, select Proposed Topics)
Also, vote for other topics you'd like to see at TechEd Europe 2004 as well. See you there! 
Phil Winstanley blogs about the very slow pace of the SqlServer(s) behind the blogs here at weblogs.asp.net. I agree, the blogs are very very slow (posting a comment takes ages and reading the main feed is often resulting in a timeout).
I think part of the deal is that the RSS feeds here are produced dynamically. This means that if there are 10,000 users pulling the main feed's RSS data every 10 minutes, the engine will every 10 minutes produce 10,000 versions of the RSS feed dynamically, consulting the database and other logic. For not that popular feeds, it's not that bad. However with a highly popular feed like weblogs.asp.net, it's not that efficient.
Now, imagine that the engine would produce every T minutes a new RSS feed file. The 10,000 requests for this file will only be fulfilled if the file is changed. If the file hasn't been changed, the webserver will return a HTTP 304 message. If the file has been changed, no database activity has to be performed: just send the bits. Scott told me that due to some clustering issues this is not yet possible here, but perhaps that can be (and has to be) changed.
Using a fixed time window of T minutes, you can produce content which is always producible within a fixed time period smaller than T (otherwise you have to set T higher). This is the mechanism used by high traffic sites like Slashdot for years: every T minutes the complete content is generated. If something changes in that window, you can decide to generate the content dynamically into a cache (a comment for example) or wait for the next time window. For the main feed(s) for example, you could generate every 30 minutes a new file or when a new blog is posted.
That would greatly reduce the access to the database server, which seems the bottleneck at the moment.
Alex Thissen blogged about it this morning after keeping his readers into the dark for more than a day after his announcement that some big news related to Objectspaces was about to be posted:
Objectspaces will be merged into WinFS.
Read more about it here: http://msdn.microsoft.com/data/. In short this means, if I read it correctly, that Objectspaces will not be an add-on to ADO.NET but will be available as a technology in Longhorn's WinFS filesystem.
For O/R mapper vendors and developers, this is of course good news. For the people who were waiting for Objectspaces, it's a disappointment. How I see things, I also think it will be a disappoint for the developers working on Objectspaces for the past two years or so: most of their work is not going to hit the streets in its current form.
What puzzles me is: if Objectspaces is merged into WinFS, is Microsoft Business Framework a layer on top of WinFS or does it /will it use a different foundation than Objectspaces or will it use the Objectspaces code as well as an integrated own layer (thus not as a separated layer) ? Time will tell I think.
... have you seen the Gran Turismo 4 trailer already? If not, check it out here. As a PS2 and GT3 owner I already knew what kind of quality the name 'Gran Turismo' stands for, but after seeing this trailer... I'm beyond words... Unbelievable, how realistic it looks and acts. Can't wait!
Edit: it seems there is some confusion. The topic title is meant as a 'joke'. Gran Turismo is a PS2 only game. Sorry XBox folks 
Tim Brookins blogs that MBF (Microsoft Business Framework) has been delayed and will be released when Longhorn is. For what I've seen from MBF, it will be a very great platform and reading Tim's explanations I can fully understand why MS is delaying it, as much in MBF requires technology released with Longhorn anyway.
My question is: what about Objectspaces? Objectspaces is one of the foundations of MBF and was scheduled to be released slightly after Whidbey, approximately together with the first MBF bits, however now MBF isn't coming in 2005, is Objectspaces' release also delayed?
One of my best friends, Jeroen van den Bos, is now also blogging on weblogs.asp.net! Welcome!
He also made a cool button for attendees at TechEd Europe 2004:
Internetnews.com reports that Microsoft is working on a new feature for Windows Update which will remove all worms from your system. It's slated for release at the end of the year. Personally I find every initiative to offer a service for customers to fix their systems a good one. However will this particular initiative be a good one?
In theory it might sound great: you visit Windows Update, the site scans your system for worms and other nasties and removes them for you. Wait... visit Windows Update... but if you do that, you will get the patches already, narrowing the attack window for worms. Most people who are currently suffering from Sasser haven't visited the Windows Update in quite a while, the patch was released on April 13th. If you're one of them, you're in good company: yesterday my newspaper, NRC Handelsblad, arrived very late because they had a computer network breakdown due to Sasser. After almost a month the system administrators at PCM (owner of NRC) didn't patch the computers, nor did they protect their network for worms and other crap arriving from the Internet.
Besides the point of the necessity to visit Windows Update, this feature falls into the same trap as a lot of copy protection schemes fall into: when you disable the check code, the code called by the check code is useless. Windows Update uses ActiveX controls (COM components) to perform the checks on your system. ActiveX components which are ran by Internet Explorer. IE contains a protection for malicious ActiveX components: if the 'kill bit' is set to 1, the ActiveX component will not be loaded nor ran. The kill bit is a registry value for each ActiveX component that is set to be able to run inside IE. You can use this for example to disable Macromedia Flash to run in IE. Read this KB article for details about the kill bit. What will likely be the first thing a worm will do when it enters a vulnerable system? That's right, set the kill bit for all the Windows Update ActiveX controls.
Now, to avoid this, IE has to be told via hard-coded GUID's that a set of controls with those given GUIDs always have to be ran, no matter what the kill bit says. However, this can lead to security holes as well (overwrite a registry entry where to find a given COM dll for a given GUID and you're set). With a simple registry entry, the worm can disable this new removal feature completely.
As I mentioned earlier, every initiative to protect customers and to fix infected systems has to be supported. I find it however sad to see how such an initiative is promoted as something which will help customers but in practise will probably not help anyone because it is easily disabled or circumvented.
The only thing which I think will help is to block any incoming request on any TCP port unless the user has enabled it explicitly and with that action suggests s/he knows what s/he's doing. I hope with the SP2 for XP a lot of the worms can be avoided. SP2 is slated for release later this year. However the firewall is available in XP today. Perhaps it's a good idea to release a fix now which enables the firewall on every TCP connection and disables the TCP/IP Netbios helper service if the system is not part of a domain. Users are not aware of the firewall in XP, nor are they able to find the setting somewhere on a properties tab. Releasing a fix now which will turn on the firewall will also require windows update, however it will be much smaller in size than the complete SP2.
Oh, and although it will cost a lot of money, it might be wise to distribute the SP2 on free CD's which are available with magazines and in supermarkets and gas-stations. Then, people with a modem connection to the Internet will also be able to install the service pack as well as the people who will never visit windows update because they don't know where it's for.
More Posts