[karsten samaschke]

Today's SPAM count

xxxkarsan3020 — Sat, 29 Jan 2005 01:12:00 GMT

...is 181 SPAM-mails in my inbox...

Man, I am really important!

Bug in CommunityServer::Forums 2.0.1 fixed

xxxkarsan3020 — Wed, 26 Jan 2005 00:09:00 GMT

After playing a while with the current version of Telligent's Community Server :: Forums 2.0.1, I found a real work-around for its annoying moderation bug in the administration. The complete solution is posted here:

http://weblog.ksamaschke.de/PermaLink,guid,26003bf3-0e04-497c-bca7-290e4bd66569.aspx

:-)

ASP.NET Forms vulnerability does not only affect Forms Authentication!

xxxkarsan3020 — Sat, 02 Oct 2004 21:20:00 GMT

It gets worse and worse: As Lorenzo Barbieri states in is weblog (http://weblogs.asp.net/lbarbieri/archive/2004/10/02/237049.aspx), the \- and %5c-vulnerability does not only affect Forms Authentication: It also affects Windows Authentication!

If you secure a path - say: http://localhost/site/secure/default.aspx - and the client (=browser) tries to access the resource using Backslashes or (even worse) the hexadecimal representation (http://localhost/site/secure\default.aspx or http://localhost/site/secure%5cdefault.aspx or a mixture of it: http://localhost/site/secure\%5cdefault.aspx), IIS does not reject the request, but allows you to enter the resource without any authentication. This affects every pre-Windows 2003 system without URLScan and / or IIS Lockdown tool.

To protect yourself from this type of vulnerability, install URLScan and execute IIS Lockdown tool!

Additional resources:

URLScan: http://www.microsoft.com/windows2000/downloads/recommended/urlscan/default.asp
IIS Lockdown tool: http://www.microsoft.com/technet/security/tools/locktool.mspx

Major ASP.NET Forms Authentication vulnerability found!

xxxkarsan3020 — Sat, 02 Oct 2004 20:12:00 GMT

A major ASP.NET Forms Authentication vulnerability has been found! In short: When you secure sub-directories using Forms Authentication, you'll usually define this in your web.config. If you use IE to access a sub-directory - for example http://localhost/site/secure/default.aspx - you'll be redirected to the defined login page. This will also happen, when you have a typo - say: http://localhost/site/secure\default.aspx (note the backslash). But - and this is the bug - it wont happen with Mozilla Firefox or other browsers. When you try to access a secured directory using this browsers and the malicious url, you'll be able to access the directory. Without any Authentication. This is serious!

IE is not affected, because it rewrites the url before sending the request to the server. If you type the malicious url in a different way - say: http://localhost/site/secure%5Cdefault.aspx - it will be behave as the other browsers.

Affected systems: Every Windows before Windows 2003 with an installed .NET framework. Because in IIS6 (which is shipped with Windows 2003) Microsoft has rewritten the parser responsible for doing path normalization.

Solution: Install URLScan and run the IIS Lockdown Tool.

More information:

Got my 4th MVP award!

xxxkarsan3020 — Sat, 02 Oct 2004 19:54:00 GMT

Two days ago I was informed about my fourth MVP award. I'm really proud of this and I want to thank Microsoft for this. And I will continue to do community work. This is a promise!

Having been off for nearly four months...

xxxkarsan3020 — Sat, 02 Oct 2004 19:52:00 GMT

...but I was quite busy: I wrote my very first Java book. And I worked a lot. And I finally bought a new laptop - it is an IBM ThinkPad R50p, which I don't want to miss anymore... :-)

Help: Looking for a quit Centrino!

xxxkarsan3020 — Mon, 12 Jul 2004 21:26:00 GMT

Now I need your help: I own a Dell Inspiron 8200, which is okay for my work. But there is one thing that drives me crazy: It is noisy! The cooler's always running and it is loud enough to be heard from the other side of the room. :-(

So, I need your recommendations for the successor of my noisy dell: It will need to have a Pentium-M-processor, the Centrino-certificate, a 1400x1050 or 1600x1200 (or something in between) 15.x" display, a seperate graphics-adaptor (ATI Rage 9x00 or some NVidia device), some 40+ gig harddisk, dvd burner and at least 1gb of ram. And, most of all, it should be quit!

Until now, I was looking at Dell's Inspiron 8600c and at IBM's ThinkPad R51. If you know better / similiar units or if you're using one of the devices, I'd appreciate your info! :-)

Useful article on XML-Serialization

xxxkarsan3020 — Mon, 12 Jul 2004 21:18:00 GMT

Read it once, read it twice and still find it very useful: http://msdn.microsoft.com/msdnmag/issues/03/06/XMLFiles/

Funny one: Files named incorrectly at MSDN Subscriber Downloads

xxxkarsan3020 — Wed, 07 Jul 2004 04:25:00 GMT

This mail just dropped in:

--- SCHNIPP ---

Our records indicate you recently downloaded Visual C# 2005 Express Beta 1 and/or Visual C++ 2005 Express Beta 1 from MSDN Subscriber Downloads at http://msdn.microsoft.com/subscriptions/downloads. Unfortunately these two files were incorrectly named: the Visual C# download was actually Visual C++ and vice versa. The file names have since been corrected.

You can verify the correct files by their file size:

Visual C++ (en_vc_2005_express_beta1.iso): 297.57 MB (312,027,136 bytes)

Visual C# (en_vcs_2005_express_beta1.iso): 261.03 MB (273,704,960 bytes)

We apologize for any inconvenience this may have caused.

--- SCHNAPP ---

And I was wondering about the odd new C# syntax... :-)

Is Microsoft going to drop C#?

xxxkarsan3020 — Mon, 05 Jul 2004 11:24:00 GMT

As Hannes Preishuber reports in his weblog, MS is going to drop C#. It sounds like a joke. Or is it serious? Ask Hannes, if you want to know more... :-)

Sensational: GREECE IS EUROPEAN SOCCER CHAMPION!!!

xxxkarsan3020 — Sun, 04 Jul 2004 20:40:00 GMT

Great! Nobody ever imagined this! Congratulations!!!

Keep 'em free, Bill!

xxxkarsan3020 — Fri, 02 Jul 2004 22:29:00 GMT

Personally, I love the new Express products! I feel, this is something special and new in the Microsoft world. Sorry 'bout this, but in my opinion, SharpDevelop is no alternative compared to the Express editions. And WebMatrix isn't either.

Because of this, here are my personal reasons, why Microsoft has to continue to give away the Express editions for free:

We need a free, but really powerful IDE! Imagine, you're an enthusiast or student: You would mind paying for a development environment you'd use in your spare time, wouldn't you?
Microsoft wants to sell Windows licenses, because this is their business. With a free and powerful IDE, developers may develop more and better applications. The more and better applications (possible some of them for free, too) - the more reasons for buying a license (okay, this is some sort of idealistic... ;).
If you're looking at Java, they offer lots of free and powerful IDE's: Eclipse, NetBeans, etc. .NET's market share is way behind Java's, so we need to compete with them.
A hobbyist won't be interested in some sort of a special "development experience", but in an affordable (free) solution which allows him to do the tasks he wants to do without annoying limitations (missing IntelliSense, missing Web-Features, etc.)
.NET is way behind Java in terms of market share - we need to offer better tools for lower prices to the students and the ones in the companies which decide, what framework (Java or .NET) to use. And if this wasn't possible, we need to have the better tools at the same price.
ASP.NET is way behind PHP in terms of market share - we need to give the hobbyists a real alternative - by offering better tools for free.
ASP.NET-development without VS.NET was frustrating - give the developer a VS.NET for free (or an Express edition of something) and they will use it! More users - more marketshare!
The community wants free but powerful tools. They won't pay for their tools. That's a fact.

For professionals, there won't be an alternative to VS.NET (except C#Builder or similar products)- so keep the Express-editions free, Bill! This is exactly what the community wants and what we need.

Just one addition: It's not about this horrible "everything must be free"-stuff! I do pay for my development environment, I do pay for my virus scanner, I do pay for my software, I do pay for my music. Because I think it is worth it. But here I'm speaking about hobbyists, enthusiasts and students - this is the audience, which isn't reachable when you charge it

Speaking a German a MVP for ASP.NET, we are actually in some sort of war with the PHP and Java-community. And without any help by Microsoft (which should include a free but powerful IDE) we don't have a change to play equal or even win. This is a fact, too.

PHP-Plugin for VS.NET

xxxkarsan3020 — Fri, 02 Jul 2004 18:37:00 GMT

Yes! Here it is: http://www.jcxsoftware.com/jcx.corporate6/modules/wfsection/index.php?category=11. And as far as I heard it: It works and it offers you IntelliSense and support for many of the PHP-features. So, if you like to program in P*P, then you should consider using it.

Read the Readme when installing any of the Express-products using BITS

xxxkarsan3020 — Fri, 02 Jul 2004 16:35:00 GMT

To avoid any confusion whether the install is continuing or not, please read the Readme for the Installation: http://lab.msdn.microsoft.com/express/readme/

MSDN Universal Downloads as RSS-Feed

xxxkarsan3020 — Fri, 02 Jul 2004 16:00:00 GMT

Found it today, added it and will be using it: http://msdn.microsoft.com/subscriptions/rss.xml