Everything, Everything

I was reading "Surprises Inside Microsoft Vista's EULA" by Scott Granneman, and he normally writes some good stuff, but he's clearly shot himself in the foot at one point in this article:

If you're like many security professionals, you may not run Windows as your main OS, but you have to use it for testing purposes. In cases such as that, virtualization is the perfect answer. Fire up VMWare or Parallels, open up your image of Windows XP, and let 'er rip. In cases like that, the Home edition of XP was perfect: a lot cheaper than XP Pro, and still close enough that your testing was valid.

Things will be different with Vista. Buried deep in the back of the EULA, in the sections titled "MICROSOFT WINDOWS VISTA HOME BASIC" and "MICROSOFT WINDOWS VISTA HOME PREMIUM," are two identical clauses:

4. USE WITH VIRTUALIZATION TECHNOLOGIES. You may not use the software installed on the licensed device within a virtual (or otherwise emulated) hardware system.

So you can't create a virtual image using Home Basic ($199) or Home Premium ($239). However, the EULA does allow you to use Vista Business ($299) or Vista Ultimate ($399). Hmmm... I wonder why? It couldn't possibly be because those editions cost more, could it? Wanna bet? The fact that there aren't any technical restrictions in place to prevent users from loading Home editions into VMWare, only legal and support barriers, sure lends credence to that supposition.

Well hang on a minute, you can install them under a virtual machine. It says "You may not use the software installed on the licensed device within a virtual (or otherwise emulated) hardware system" but Scott said at the top "If you're like many security professionals, you may not run Windows as your main OS, but you have to use it for testing purposes. In cases such as that, virtualization is the perfect answer." Well if you're not using that version of Windows Vista as your main OS (perhaps you're using Slackware Linux and VMWare Server as they're both free and legal?) then you won't be installing the software on the licensed device, you'll be doing a single install within a virtual hardware system (i.e. using the license once). Therefore it's fine. It's only if you install Vista Home Basic and then try to install it again in a virtual machine that it's an issue. What people don't seem to realise is that the new EULA allows an additional installation of Windows under a virtual machine; the old one would have insisted on your paying for a second copy of Windows XP.

I saw this on Sky News, apparently it was a real entry in the London Review of Books:

Romance is dead. So is my mother. Man, 42, inherited wealth.

Extract from They Call Me Naughty Lola by David Rose, published by Profile Books.

The RTM build 5824 was originally set to be released last Friday after reducing the number of bugs found in the Vista RC2 from 1450 to around 500. However, additional bugs were found in the RTM build 5824 version, and together the bugs could paralyze an upgraded Vista-capable Windows XP OS. Microsoft has overcome the problems, resulting in RTM build 5840, added the sources, noting that Microsoft will continue to test the new version until its release in November.

Perhaps I'm being cynical, but I wonder if this announcement has anything to do with this too?

Ah, the good old "ad-hoc" design. I saw this sentence in the latest BOFH and it made me chuckle:

"We could, but then we have service redundancy to consider and putting all our eggs in one blade basket, so to speak, could lead to a complete disaster. So it pays to have our services scattered on various servers in what appears - to the casual observer - to be a random and ad-hoc manner designed to increase our spend with a computing vendor so as to qualify for free conferences at holiday destinations."

Read the whole episode here.

I was reading Scott Adams' blog and he was talking about the Australian Muslim cleric who got in trouble for explaining his reasoning for why women should wear head scarves. His translated quote goes something like this: "If you take out uncovered meat and place it outside ... and the cats come to eat it ... whose fault is it, the cats' or the uncovered meat's?"

Like you, I am highly offended by this comment. He compared men to CATS! Now don't get me wrong - I love cats. But they do clean themselves with their tongues, eat bugs, and have the IQs of squirrels. No offense to squirrels. And these cats are apparently rapists too. As you know, rapist cats are the very worst kinds of cats - even worse than the hairless ones.

I suppose I should consider the fact that the cleric's analogy is nothing more than a colorful restatement of a common Muslim religious view. But that's no excuse for comparing me to a cat that can't resist meat. I'm a vegetarian, ferrchrissake! I've been resisting meat for years! I call for that cleric's resignation.

But the best part of this story is the cleric's defense that he was just quoting an "ancient scholar." Apparently that strategy worked out pretty well for the Pope, so he thought he'd give it a go.

I love that last line :)

I think Microsoft are going to encourage Windows 2000 users to upgrade through a cunning plan entitled "annoyance". Starting next year, Daylight Savings Time (in America) will move, and for those with Windows 2000 machines that time change won't be automatic because Window 2000 won't get a patch. Ever. Presumably because it's not a security issue.

What percentage of UK men have had more than one sexual partner in the past 12 months? It's 12%, according to the Office for National Statistics.

Taken straight from Kristin's site on E! Online:

Yes, NBC just announced their new Thursday night lineup this nanosecond. It begins November 30 and will be: My Name is Earl at 8:00, The Office at 8:30, Scrubs at 9:00, 30 Rock at 9:30, and ER at 10:00.

For we Scrubs fans, this is, of course, nothing short of a miracle, because not only is the show coming back earlier than expected (the buzz around town was that it'd be January), but Zach Braff and his crew at Sacred Heart also finally get a solid lead-in worthy of their genius comedic talents.

Sadly, I hear that NBC are moving away from creating new Thursday night comedies, so once this lot are over it'll probably mean lots of (cheap) reality TV shows. What will Sky and Channel 4 broadcast instead?!?

I got a call earlier from a number that appears to be based where Sarah lives (it wasn't her calling me, I asked her over MSN), but a quick search on Google revealed it to be yet another phone company (not Communications Direct this time). The annoying thing is my mobile number has been registered with TPS* (but I CBA to answer the call just to tell them that).

* I can tell, as if I try and register my number at http://www.tpsonline.org.uk/ctps/number_type.html I get the following message (I did this just now):

The following number(s) is/are already registered with the TPS

07XXXXXXXXX: has been registered as a Residential number.

Ok, so it's EasyJet, I shouldn't be suprised. It's been delayed by 70 minutes though. So I went to McDonalds. They don't do double cheeseburgers here, so I bought two cheeseburgers instead. Eating first one now, no gherkin!

I finally solved my sign in problem on my fileserver, after reading the Microsoft newsgroups onine. For some reason I couldn't sign in anymore with my main account (or a second one, but another one worked fine), and I believe this is what fixed it.

Run regedit and navigate to HKEY_CURRENT_USER\\Software\\Microsoft\\MSNMessenger\\Policies

Then delete the key "contacts.msn.com"

According to Jonathan Kay (I've read posts from him before last time MSN had trouble), it's a misconfigured policy that Microsoft put into place accidently. Deleting the key is just removing this policy (and you won't lose anything - unless you somehow make a mistake while editing the registry).

Aria have a new site design that's in beta. Want to know more? Lucy and Robin have made a very wooden introduction video. It's not meant to be funny, but it is.

It's finally gone RTM.

http://www.microsoft.com/windows/ie/default.mspx

When Scott Adams brought him back last week I didn't think he could make him funny, nor did Scott, and I didn't get around to catching up with Dilbert for a few days, but I finally saw the one from last week and loved it.

Fab told me today's strip is good, I thought it was okay, but not as good as Howard.

Yesterday on my drive home I saw two female joggers heading towards each other, they were wearing exactly the same clothes, and I wondered if (as they passed) they'd think to themselves "bitch, she's wearing the same outfit as me".

On my drive home today I had a Fatboy Slim track stuck in my head (Weapon of Choice, with the catchy intro), even though I was listening to my Zero 7 album.

Are there any adults in this country that don't have U2 somewhere in their music collection?

Damn, they called me and I foolishly answered. It wasn't their Cardiff based number, it was 01792 350023 (it seems they also use 01792 474700, after a search with Google).

They said my contract was due to run out, and I said I didn't think it was (actually, they might be right, as I got my new phone at the end of October last year). They asked when I got my upgrade, and I said I wasn't sure. They tried to ask me how long I'd had the phone (surely it's the same question?), I said I thought it was under a year ago (which, it turns out, is true) but then - clever me - pointed out that they should have records of when I got an upgrade and extended my contract. That was when she admitted that they weren't related to Vodafone, at which point I jumped in and asked "would my contract remain with Vodafone?" (knowing full well that they want to sign me up to 3) and she replied "no, but Vodafone is the most expensive network", and I said I wasn't interested. She then asked if I wasn't interested in saving money, and I said "it depends on who you call" and then said goodbye and hung up.

Just had a missed call from this number (because I ignored it), it looks suspiciously like another Cardiff based cold caller number owned by Communications Direct Ltd, although I can't see anything on Google yet. They didn't leave a message on my voicemail, which is usually another sign that I've not missed an important call.

Scott Adams makes me laugh, people should read his blog:

Recently an airport security guy confiscated my 4 ounce shampoo container because he said the maximum allowed is 3 ounces. I pointed to the airport's own sign that says 4 ounces is allowed, but that didn't seem like a good argument to him. It was too late to check my bags, so he confiscated my mostly empty 4 ounce container.

But here's the interesting part. The container is semi-transparent, and contained obviously less than 1 ounce of liquid. Apparently the empty portion of the container posed a threat. Or to put it another way, as we humorists like to do, the airport confiscated my 3 ounces of nothing so that I couldn't use that nothing to blow up the plane.

What they didn't seem to realize is that my carry on bag was not entirely full either. There was a whole bunch of nothing in there along with the clothes and shoes and belt. And if I were to combine my bag of nothing with the nothing that other passengers smuggled aboard, that would make a huge stockpile of lethal nothing.

For a fleeting moment I considered reasoning with the TSA guy. Surely he could see that the liquid part of my container was minimal. But one look in his eyes told me that thinking wasn't his sport. And on some level I have to agree that we shouldn't let airport security use too much of their own judgment. Sooner or later some security person would allow a hand grenade on a plane because the passenger "didn't look angry."

I wanted to point out that the Ziploc bag itself is a container larger than 3 ounces, and that's also mostly full of dangerous air. Or perhaps I could have argued that once the airplane doors are closed, the cabin is essentially a huge container with plenty of gels and liquids and dangerous nothingness. I would have been a beacon of common sense and righteousness, right up until they started beating me with batons.

Do not pause the Virtual Machine that is also the DNS server if you still want to browse the net on another host that's configured to use said DNS server. Doh.

I know you lot think I'm a geek, but sometimes I come across people that are far worse than me, like these guys that are trying to make a very small executable that will download and execute a file (notepad.exe in this case). For some reason I also found it quite cool and interesting. Here's a snippet of the conversation that they had :

Arkon: The problem with that URLDownloadToFileA is that it creates another thread,
Arkon: and that thread never terminates for some unknown reason to me.
Arkon: So I HAD to call ExitProcess and finish it, otherwise my process will hang.
Arkon: But now what I'm going to do is raising a silent exception
Matthew: Just blow away the SEH chain and trigger an INT3.
Arkon: It will eliminate the string "ExitProcess" and the GetProcAddress code for it as well.
Matthew:
MOV FS:[0], 0xFFFFFFFF
INT3
Matthew: BAM! Instant process death...
Arkon: This is too long.
Matthew:
PUSH 0
POP FS:[0]
Arkon: Nah
Matthew: XOR ESP, ESP might also do the trick
Arkon: LOL!!!
Matthew:
XOR ESP, ESP
PUSH EAX
Arkon:
XCHG EAX, ESP
PUSH 0
Arkon: Wait I'm stupid, push 0 is 2 bytes long.
Arkon:
XCHG EAX, ESP
PUSH EAX
Arkon: 2 bytes ExitProcess OMFG
Matthew: You're a maniac

The filesize is merely 384 bytes, 99% usage of all spared room in the file. You can see it here: http://ragestorm.net/tiny/tiny2.exe

I've been creating a small network based on a few clones of a VMWare host with an installed and activated copy of Windows 2003 SP1 (MSDN licences allow up to 10 activations). I've heard people mention problems with using cloned images/virtual machines, but never came across it myself as up until now I've only used them as standalone hosts, but it's clearly an issue with a domain (they can join the domain okay, giving the illusion that all is well, but that's about it). Well it seems the nice SysInternals guys (the ones behind ProcessExplorer, RegMon, FileMon etc.) have created NewSid.

It's fine for private or commerical use, but you're not allowed to use the source code in a commercial or freeware SID-changing product. I've tried it on two copies of 2003 SP1, and it appears to work fine (although when the admin logs in for the first time you get an unexpected restart error, that appears to be safe to ignore but don't be surprised when you see it). It turns out that Joe already knew about it, but I don't know if anyone else in the office had come across it. Altiris and Symantec have similar programs to help with deployment of images, but you have to pay for them.

But this tool is tiny, it only takes a few clicks to work, and you can either let it choose a random SID or even specify one.

Oh, and I've found How to install the Microsoft Loopback adapter in Windows XP, useful if you want to get VMWare up and running (e.g. for a demo) but don't have a network connection.

When did they get their new looking logos? I must watch more terrestrial TV sometime.

But I just came across this. Here are the top ten most stressful jobs, according to SkillSoft:

IT
Medicine/Caring Profession
Engineering
Sales and Marketing
Education
Finance
Human Resources
Operations
Production
Clerical

That's the conclusion of a probe of 3,000 "IT experts" carrried out by "online learning provider" SkillSoft, which reveals the staggering fact that "97 per cent of people working in IT claim to find their life at work stressful on a daily basis". Indeed, four-fifths of IT consultants "feel stressed before they even enter the workplace", while a quarter of the poor buggers "are under such enormous pressure to perform at work they have taken time off suffering with stress".

Shameless pinched from Em's blog post, I love this U2 track (arguably my fave track of theirs), someone has made a video based on Bush speeches.

... when I'm on my own, I Google myself.

;)

It's not just me, it seems that modern men don't want women to have fake boobs, according to a new survey. A poll found that 85% of men aged 18 to 34 said that they hated plastic surgery and found it a "complete turn-off" in women.

The survey, which polled 1600 men across the UK, found that a further 15% claimed not to even notice women's cosmetic surgery. A spokeswoman for More magazine, which commissioned the poll, said: "It seems as though women may have misjudged a lot of blokes". They look at false cleavages but it is clear that it is a big turn off both sexually and in terms of forming a relationship. Asked which female celebrity they were most attracted to, most opted for the slimline celebrity look with 51% going for singer Cheryl Tweedy, 24% fancying actress Scarlett Johansson and 10% choosing model Kate Moss. Just 9% said they liked the look of pumped up silicon glamour girl Jordan.

I was shocked (okay, pleasantly pleased) to discover that the cheese sandwich I bought today contains a staggering 450 calories. That's way more than the ham and mustard sandwich I go for (and the cheese sandwich contains less salt), and a lot more than a can of Heinz baked beans with pork sausages. No wonder Tania is finding cheese to be a terrible weakness.

Microsoft Internet Explorer 7 (English) is targeted for release on Wednesday, October 18, at 9 p.m. (presumably in America), but as always, product quality will determine the final release date.

It's Wednesday, Microsoft's patches have just been released (there are a lot), and it's looking incredibly dark outside right now.

I just got emails from the RAID managament service telling me that the spare drives are back in the pool, which means the server has finally finished rebuilding the array! I've just logged in via Remote Desktop, and all appears to be well again. Not bad, only took 3 days instead of 3 hours.

It's national Family Learning Week, and to celebrate that fact BT is relaunching its Internet Rangers website to encourage more youngsters to help old codgers understand this new internet thing (at least that's what The Register says).

The only encouraging thing I could think of is that at least the sensible codgers can point out to the foolish kids when they're doing stupid things, like handing out their mobile number to random strangers (amongst other things). That and the codgers will mean the kids are supervised for once.

I was reading a Sky News article that said: Consumer groups and health campaigners have called for a ban on junk food TV ads aimed at children before the 9pm watershed. This sounds like a crazy idea to me.

Which? and 23 other organisations want an advertising watershed for foods high in fat, salt or sugar. But what's the point? Kids can still go out and buy the unhealthy food at any time in the day. Adverts for cigarettes are only allowed in certain places, and we have a stricter system of advertising regulation in the UK which bans advertising of alcohol which could appeal to under 18s, particularly in regard to TV advertising, but that's all enforced by making it illegal to drink before you're 18 (unless in a pub with a meal) or smoke before you're 16. If they're going to ban adverts before the watershed, they might as well make it illegal for kids to enter McDonalds on their own, and they'll have to produce ID if they want to buy that sandwich with a high salt content (the Ham and Mustard sandwich I love to eat contains something like 48% of my recommended daily intake of salt) next time they're at the supermarket.

Perhaps we should ban Top Gear, or only show it after the watershed, just in case kids watch it and decide to joyride? Perhaps we should ban all sexual contact in TV shows before the watershed, in case it encourages underage sex? Perhaps some of these organisations should get some common sense and stop trying to mess with our lives, and do something genuinely useful for a change.

Intel EOLs Pentium D 805. The 805 was only introduced in July this year. It's the only Pentium D chip that operates on a 533MHz frontside bus - the rest run on 800MHz FSBs. Clocked at 2.66GHz, the 90nm 805 was aimed at low-end dual-core systems, except it turned out to be very good at overclocking, with some people reaching over 4GHz. Mine can run at 3.8GHz, but in an attempt to keep the temperatures fairly reasonable under full load, I've only got it running at 3.6GHz. Still a pretty good overclock.

It's very changeable today. I want to see glorious sunshine until late in the evening. I guess I won't see that happen again until sometime next year.

Listening to Zero 7 today, this start of this track reminds me a lot of Radiohead. Mind you, a few tracks remind me of them.

More than half of all graduates say they cannot afford to buy a home, a Scottish Widows survey suggests. High house prices combined with student debts are pushing property ownership out of the reach of many. Of the 3,500 people surveyed, 10% believe they will never be able to afford their own property. Out of those graduates who have bought a home with a partner, 68% said they would not be able to afford to buy the other out in the event of a split.

I read this in Jesper's blog, and it summed up how I feel:

McAfee today joined Symantec in complaining about Microsoft making Windows Vista too secure, making it difficult for them to rootkit the OS to do their security voodoo.

[...]

PatchGuard prevents us (the security vendors) from root kitting Windows Vista. PatchGuard is a technology introduced with the AMD 64-bit versions of Windows Server 2003 and Windows XP two years ago, and which also exists on Windows Vista. It prevents software running on the system from hooking certain kernel structures and replacing them, including function hooking. [...] For instance, let's say you wanted to prevent a particular file from showing up when a user lists the contents of a directory. You could hook the function that provides the output of the directory listing so that the call gets routed to your function instead. Your function then calls the original, but modifies the output to your liking, in this case to simply remove the file you wanted to hide. [...] The security vendors have been hooking these types of functions on 32-bit operating systems for years to provide some form of intrusion detection service. On 64-bit platforms this no longer works. Of course, not being able to hook kernel functions will make it much harder for malware to do it as well, thus lessening the need for detection of malicious activity. However, that would also lessen the demand for third-party software to detect malicious activity, which is really McAfee's and Symantec's core problem. In a sense, they have built their business on protecting users of Windows from Microsoft, and Microsoft healing the patient cuts into their business doing the same. As Microsoft's Security Chief Ben Fathi said, the security vendors want Microsoft to "keep the patient sick," and by extension, keep customers at risk, so that the security vendors can keep charging for the healing.

The second issue the vendors are complaining about is the Security Center, which first shipped in Windows XP Service Pack 2. In Windows Vista, instead of allowing vendors to disable Security Center, as they do on Windows XP, Microsoft made it extensible and gave vendors API hooks to harvest information from it. However, this means that, fundamentally, Microsoft still controls the security experience in Windows. That is where the rub lies. When users see something related to security in Windows, Symantec (and McAfee) want them to see a Symantec (or McAfee) logo at the same time so they know that it is Symantec (or McAfee) that protects them, not Microsoft. They are not really providing different functionality; they just don't want users to think Microsoft is responsible for their security. Again, the vendors are building a business on protecting Microsoft's customers from Microsoft's screw-ups, and they can't keep doing that if customers keep seeing that Microsoft is actually doing some of the protecting. Not being able to hide the fact that Microsoft is providing protection is a threat against the security vendor's current business model.

It is a sick eco-system indeed where we have third parties complaining because the first parties are helping their customers be safe.

For those that I haven't spoken to (which is everyone except Holly and Tania), I spotted last night that Amy has deleted me from her MSN contact list. I sent her a text saying "Hey, do you still need more time, or is this goodbye? I hope you're feeling a lot better." and I haven't received a reply. I doubt I'll ever get one.

I thought to myself last night that I could do with some more washing up liquid, and on my way to the shops (I wanted to stretch my legs) for a very late lunch I decided to buy some. As I walked in, I noticed a ham and mustard sandwich was still available (woohoo!), so that went into the basket. Then I made my way around to the cleaning supplies and spotted that Fairy was on offer! So I now have a bottle of original and an apple scented one.

This will ruin the first punchline a little bit, but it's so damn funny: "I don't have those, but I do have this box of non-sequentially numbered fifty pound notes..."

I just found out why we don't have a nice and simple hot water urn. Apparently it's a health and safety thing, we're not qualified to use it. Only qualified catering staff are allowed to use them, so we're stuck with this naff little device in the kitchen.

Mmmm, coffeeeee.... :)

Mmmm, ham and cheese sandwich. I was after ham and mustard, but they had sold out by the time I got to the Co-op.

Finally, I'm on top of things. Kinda. Just need to make two phone calls later, maybe three.