A first encounter with Google Chrome

For some time now, the media and blog-spheres are full of praises for Chrome and hence I have decided to dip my toe into the Chrome (version 1.0.154.48) to see what it is like.

1.   Chrome is not a unsual Windows program in that it does not require Administrative rights to install. It is more akin to a .Net ClickOnce deployed solution in which the solution is installed in the user's profile area. So if you, like me, has several accounts in an XP box, you need to install it with each account.

2. I was really interested in the much hyped feature of one tab page per process technique which protects the Chrome process (the one visible to the user) from being torn down by a crash when processing one page. Armed with Spy++ and Process Explorer, I began my exploration. What I can tell is:

• Yes, there is indeed one process (Chrome.exe) per tab page. Actually more than one process per page. 
• But all visual Windows belong to one process, the parent process of Chrome. 
• On the supporting processes, they seem to also host some dummy windows whose functions yet to be identified. They seem to be hidden windows of 0x0 size. 

After all, I have never heard of a way to marshal a window across processes. This makes sense, albeit a very blunt way of doing thing, of using process isolation to do all the polling, threading and interaction with remote internet sites and then rendering the data in one process.

This technique is nothing new and is a common idiom to provide the most robust defence against crashes.

One nice touch of Chrome is its support for Tablet PC without Add-in that is required in Firefox. Opera does not even support Tablet PC. Then again, does Chrome have add-in?

Chrome starts much much much quicker than Firefox and this, together with the support of Tablet PC out-of-the-box, Chrome may have won my approval for a switch.

Can you really trust the piracy damage claims?

A report on CNet on the trial of Pirate Bay has several interesting facts:

One of the most difficult tasks for companies that sell copyrighted music, movies, or computer software is estimating how much money they lose due to piracy. So they have been known to--how to put this delicately?--exaggerate.
[...]
The music industry's statistics have been called into question before: a 2006 government report obtained by The Australian says copyright owners "failed to explain" how they reached such dire conclusions. A report by the Organization for Economic Cooperation and Development found that losses due to counterfeiting and piracy are much lower than estimated by business groups. (In a related industry, The Economist has assailed software piracy statistics.)

The Best way to set up Vista

Many months ago, I was asked for recommendation to set up a brand new Vista machine to provide maximum security protection. I subsequently discovered that my recommendation earns the 'Best' rating by Jesper M. Jphansson in his article "The Long-Term Impact of User Account Control".

Here are the ratings for various set up (figure 2):

Protection Level	Elevation Method
Worse	Turn off UAC.
Bad	Automatically elevate administrators.
Good	Run in admin-approval mode.
Better	Run as standard user and elevate to a separate admin account.
Best	Run as standard user and switch user to a separate admin account instead of using UAC to elevate.

The default set up is to rely on AAM (Admin-Approval Mode) and that only earns a 'Good' rating. Jesper explains why this is not as good as using a separate account:

This lessens the risk of a poisoning attack, where a malicious non-elevated application poisons the user environment for an elevated one, but it does not necessarily remove the ability of a non-elevated application to control an elevated one.

Next time you find a USB drive lying around beware...

This experiment reported here shows that there is no free lunch:

....Steve Stasiukonis of Secure Network Technologies during a penetration test for a customer. He seeded the customer's parking lot with USB flash drives, each of which had a Trojan horse installed on it. When the employees arrived for work in the morning, they were quite excited to find the free gadgets laying around the parking lot. Employees eagerly collected the USB drives and plugged them into the first computers they came across: their own workstations.

Maybe some employees were wise enough to ignore these USB drives, and perhaps some of the USB drives were discarded, but it really only took one user with one drive to infect his own system and provide a gateway into the network. Stasiukonis did this exercise as a test, of course, but this technique has been used by real criminals to infiltrate large corporate networks.

Updates on disabling Autorun

With the report of the spreading of Conficker virus/Trojans and that one of the techniques for spreading this is helped by Microsoft's support in the form of Autorun, if you have not disable this dumb feature you should follow the instructions on this Microsoft support article.

I cannot see one good reason for this feature, which incidentally is enabled by default. Would it be better to disable it by default and right mouse click to launch?

Let's hope Windows 7 has this Trojan assistance taken out.

This is a very good in-depth article on this kind of attack using autorun/autoplay.

The concluding remarks from this article is worth quoting here:

Ignoring the DMA scenario for a moment, the success of the attacks I have discussed, as well as the success of the countermeasures, will depend on the privileges of the user using the computer. If the user is a standard user, the amount of damage the exploit can do is limited. It can still steal that user's data and anything that user has access to. However, the attack will likely not impact the network at large.

However, if the user being exploited is an administrator, the consequences can be a whole lot worse.

Who's afraid of new technology?

Recently, Rupert Murdoch, the chairman of News Corp, is asked to present the 2008 Series of Boyer Lectures. The second lecture bears the title of this blog message, contains something worth remembering and pondering:

But technology will do you no good unless you have men and women who know how to take advantage of it. That leads me to my second point: the growing importance of human capital. In other words, an educated and adaptable population.

[snip]

That's because computers will never substitute for common sense and good judgment. They will never have empathy, either. To be successful, a business needs people who see the big picture, who can think critically, and who have strong character.

Economists call these skills 'human capital'. You won't find this capital listed on a corporate balance sheet. But it is the most valuable asset a company has. If you talk to any chief executive about his number one challenge today, he will probably not say technology. It's far more likely he will say his top challenge is attracting and retaining talented people.

[snip]

If you are a worker, you have an even greater incentive to invest in yourself....

My point is this: as technology advances, the premium for educated people with talent and judgment will increase. In the future, successful workers will be those who embrace a lifetime of learning. Those who don't will be left behind.

That may sound harsh. But it is a truth we must face. And it is a great opportunity for us all.

For most people, adapting to the changes that are coming will require moving out of comfort zones.

Moving out of comfort zones begins with education.

Is it wise to break convention - the wildcard convention

I have been a long term user of 7Za.exe, the command line version 7-ZIP, and recently have been using it to back up my Subversion repositories. Like many that use this kind of programs, one is too trusting to believe that it will honor the same convention as other CMD commands to archive all files, with the exception of those files in used, when one issues a command line like this:

7za a -tzip Test.zip MyWork\*.* -r

To many long time users of Windows Dos Prompt, this is the standard way to instruct a program to process all files; the Del, Attrib, Copy, XCopy, Cacls, Dir, RoboCopy, and Rar all conform to this convention and hence one naturally assumes that 7Za.exe would naturally honor this.

Not so, and I learned this the painful way. According to the help file of 7-Zip:

7-Zip doesn't follow the archaic rule by which *.* means any file. 7-Zip treats *.* as matching the name of any file that has an extension. To process all files, you must use a * wildcard.

Well, while it is admirable for someone to make a partial stand of this 'archaic rule', it is dangerous to use the same syntax and then silently producing a different result set. It is like switching the active and neutral wires in the electric wiring just because someone took exception to the color coding convention of the wire.

The fact remains that before 7-zip comes along to Windows, that convention has already been established and entrenched, way before it was mistakenly claimed by 7-Zip as introduced in Win 95. There are millions of users accustomed to this convention whether it is logical or illogical; this has become their second nature; it is like arguing whether it is logical or illogical to drive on the left hand side or right hand side of the road; a lone group of dissenting drivers taking a stand can not only play havoc on our roads but producing fatalities.

A convention has been established and people driving on public road has therefore to conform to it, like it or not. In US, all vehicles driving in a mine drives on the opposite side to those on the public road. The change of convention was explicitly stated, for reason sound in mining operations, and drivers are deliberately made to go through a change over section.

7Za however, did not do such a thing. It took *.* to mean 'all files must have extensions' in contrast to the Windows convention which means 'all files with or without extensions', which is understood by millions or trillions.

It is not a dispute of 7Za for being correct. It is raised here for its dangerous and irresponsible practice of flaunting a convention while using the same syntax.

For example,

7za a -tzip Test.zip MyWork\*.* -r

Should pick up all files in a Subversion repository regardless if the files contain extensions of not; many Subversion files do not have extensions. Rar with this command picks up all files honoring the Windows convention:

Rar a -r Test.rar MyWork\*.*

This is not only wise but also responsible realizing the consequence for failing to and taking a stand only brings at best hollow victory and wrath from users at the worst; such is the case with 7za now.

According to the Windows API and treatments of wildcard characters, there is no way to specify collecting files only with extensions. For example using Dir as an example:

Dir *.* /s /b

and

Dir * /s /b

produce the same result: a list of files with or without extensions. The second form is 7Za's way of specifying any file with or without extension but accepting the first form and producing a totally different result set.

Dir *. /s /b

produces a list of file without extensions. But there is no wildcard syntax to say 'file only with extension'.

As a result of 7-ZIP hollow stand against a convention entrenched in more users of Windows than 7za, it has successfully dislodged people's trust on this program. Archiver should behave much like a copy/xcopy commands; changing the operation with the same syntax is extremely dangerous and developer should not toy with this kind ideological stand in an important tool.

My ill-placed trust on 7za has caused me losing the collection of my Subversion repositories. It is an expensive loss and 7Za's ideological stand against an illogical convention is equally illogical resulting in real loss; what is 7-ZIP hoping to achieve? It has hardly won any friend!

The result is a total distrust of this tool. While I can use Subversion's command to ascertain the integrity of the restored repository, other archives produced by 7Za lack such detection and hence there remains an unknown number of imperfect archives.

I don't discourage 7za to take this kind of admirable stand but it should be selected by users. The default should always follow the convention of the OS in which it is deployed into. 7Za has already established this kind of overriding switches/options and its admirable attempt to correct the convention should only be selected when user makes the choice.

If that is a Unix convention, then either build 7Za to be a Posix conforming program that runs in Windows' Posix subsystem, in which case 7Za can even use case-sensitive file names or have a switch to turn on Unix convention.

This should be a real-life example of the danger of developers failing to conform to entrenched convention, no matter how 'archaic' or illogical that is. The first occupancy rule applies here!

For me, 7Za is now being banished to the recycled-bin as it is too dangerous to use tools that do not conform to convention. It will not earn my recommendation for sure.