Paul's Down-Home Page

Microsoft has released a nifty automated tool for building threat modeling documents for applications you develop.

It organizes relevant data points, such as entry points, assets, trust levels, data flow diagrams, threats, threat trees, and vulnerabilities into an easy-to-use tree-based view. The tool saves the document as XML, and will export to HTML and MHT using the included XSLTs, or a custom transform supplied by the user.

This might seem to have low relevance for Exchange, but if you take a look at what’s in these documents, you’ll get a good jump start on understanding how to build a threat model for your network and deployed messaging applications (yes, even if you’re using something besides Exchange).

I flew out to San Diego yesterday and got to the convention center about 45 minutes before my first session, a troubleshooting panel with Chris Nelson (from Microsoft’s IT group), Karl Robinson of HP, and the legendary Paul Bowden. It was fun to share the stage with three knowledgeable people, and we got some good audience questions.
Next, I had a book signing, at which I sold three whole copies of my book. It was fun nonetheless; I got to spend some time chatting with the legendary Charlie Russel, with whom I’ve worked but who I’ve never met, Paul Cayley of the MS UNIX migration team, and Eldon Nelson from Microsoft Press. After that, it was off to the “Meet the Technologist” area (aka “Ask the Experts”). The place was mobbed! Erik Ashby was drawing a steady line of folks asking 5.5 migration questions, and there were lots of miscellaneous troubleshooting questions.
John and I got together for a short visit (wherein I learned that his first session outscored mine by about 0.5– significant on a 1.0-9.0 scale!) before I headed out to the MVP dinner organized by KC Lemson at the Zocalo Grill. I had the good fortune to sit with Andy and Kim Webb, Andy David, Scott Schnoll, David Sapery, and Sue Hill (all MVPs, save Sue, who works on the Exchange User Education team), and there were a ton of other MVPs (including Sue Mosher, Diane Poremsky [at least it looked like her from the back], Chris Scharff of MessageOne. The product team was well-represented: KC and David Lemson, Ed Wu, Nicole Bonilla, and a few others were there. As a bonus, I finally got to meet Brandon Hoff, the MVP lead for Exchange; he and I have missed each other several times in Redmond, so it was good to finally shake his hand. The food was quite good, and the company was great. (Thanks, KC, for setting it up!)
Today I’m back in the Ask the Experts area for a while, but I should be able to actually attend some sessions– more on that later.

Very cool news: the Exchange Intelligent Message Filter is out, and it’s available at no cost to all Exchange 2003 customers. Microsoft had previously said they would only offer it to SA customers, which generated a lot of discontent. I’m glad to see them reversing their stance. Get the IMF here, and be sure to read the deployment guide. (Oh yeah– Exchange 2003 SP1 is out, too).

Very cool: Evan Dodds of Microsoft has a blog about (drum roll) Exchange clustering. You should only go there if you want actual factual technical information, though; you’ll have to go somewhere else for $spin.
So, Evan, here’s a clustering question: can I force all outbound SMTP traffic on a cluster to originate from the IP address of the cluster instead of one of the physical nodes therein?

Happily, there’s finally a review of Secure Messaging online at the Windows IT Library. My thanks to David Sengupta. (Now, if only Amazon would start posting the reviews that I know are queued up there…)

John Welch is posting a long review of the entire Office 2004 suite. It’s not done yet, but the first part— which, conveniently, covers Entourage in depth– is ready now.

At the 2002 MEC, John and I were both presenting multiple sessions, and we had a little friendly competition to see who did better. (I honestly don’t remember the results; I just remember how psyched he was at successfully evading the wrath of the demo gods). This year, he has a crushing four sessions, all deeply technical (BPR310 is “Office Developer: Programming XML Solutions”, BPR311 is “Office Developer: Programming Word XML Solutions”, BPRC14 is “Building High Performance InfoPath Solutions”, while I have but one (MSG381,”Designing a High Availability Exchange 2003 Solution”) , so I have somewhat of an advantage. Both of us have some hard work to do to catch the top guns from last year’s TechEd, though.

This sounds cool: a get-together for developers at the San Diego Automotive Museum. The big draw: remote-control racing, with trophies. I won’t be there, since it’s before I arrive, but I definitely think John should go.

Ed’s at it again. Rather than waste my time with a long rebuttal, let me just say this: I generally prefer to spend my time explaining technical things that help people understand Exchange better rather than pointing out shortcomings in competing products. I could go on at length about what’s wrong with Notes and Domino, but why bother? So, it bothers me when Ed takes an explanatory technical article and twists it around in an attempt to make his competitive point, but hey, he’s preaching to a choir of Notes admins, so I shouldn’t be surprised.
Well, OK, just one rebuttal point: since the column was on geoclustering, I didn’t mention the many software replication products [e.g. DoubleTake] that are being used to provide geographically distributed DR without geoclustering; I also didn’t mention ballpark hot dogs, ‘57 Chevrolet Bel Air coupes, or lots of other things that don’t relate to geoclustering. Ed’s guilty of claiming that there’s no other way to solve the problem, which isn’t what I said. These replication products have their own limitations, as does Domino replication, but they’re not germane to a column on geoclustering, so I didn’t mention them.
Update: edited to fix a typo and to turn comments back on. Ecto sometimes randomly changes the “allow comments” and “format line breaks” flags between posts, and I don’t always catch it.

I’ve been using Office 2004 for Mac OS X for the last six months or so. It’s awesome. Don’t take my word for it; go get the 30-day “test drive” version and see for yourself.