Another reason I’m proud to be a Marine

From an interview in this week’s Marine Corps Times, this quote from Sergeant Major of the Marine Corps Carlton Kent:

Q: How will the repeal of “don’t ask, don’t tell” affect the Corps?

A: It won’t be a problem. We made sure that the Marine Corps had a voice in this policy. We’re past the point of talking about if it should change. We’re past that point. We execute and we follow orders as a Marine Corps, and if our senior leadership says something should change, we’re going to execute it,

Semper fi!

Leave a comment

Filed under General Stuff

1394, DMA, and BitLocker

The IEEE 1394 spec (also called FireWire by Apple and briefly, i.Link by our friends at Sony) specifies a high-speed interface for connecting peripherals. One of the reasons 1394 offers high speeds is that it supports the use of direct memory access, or DMA. Normally, when a peripheral device is performing I/O operations, the system CPU has to be involved. For example, to read a block of data from a disk drive, the CPU sends commands to the disk controller, then stores the resulting data into a block of system memory. (This is a somewhat simplistic description, I know, but it’s good enough for now.) That means that I/O operations could end up being CPU-bound, or they could negatively affect CPU performance.

To fix this some bright stars came up with the idea of DMA, which allows the peripheral controller to read from and write to system memory without the CPU’s involvement (and, often, without its knowledge or supervision.) Sounds neat, right? It is, but it also introduces a security threat: a malicious device can read valuable data out of memory… like, say, an encryption key.

The basic attack is simple: the attacker walks up to a BitLocker-protected computer, plugs in a custom 1394 device, and steals the key. (The details of how the attacker finds the key are interesting, but unimportant here.) Key in hand, the attacker can then decrypt the protected volume.

Not all BitLocker-protected machines are vulnerable to this particular attack. If you have a TPM, but are not using an additional authentication factor like a PIN or a USB token, this attack may succeed. However, even if you do use an extra authentication factor, if you leave your machine powered up or on standby, an attacker who gets physical access may be able to steal your BitLocker key.

This isn’t a huge threat for systems that are kept in physically secure locations, but it is worrisome for mobile users. That’s why the Data Encryption Toolkit that I helped write counsels you to be very careful about leaving portable computers powered on and unattended, and it spends some time going over the different security issues with standby, sleep, and hibernate modes. You should read it. Trust me, I’ve been to the doctor Smile

This is all a somewhat long-winded way of explaining that Microsoft has released a KB article describing how to turn off DMA for 1394 ports to reduce the threat of a DMA attack against BitLocker on TPM-only machines. The article, 2516445, describes how you can turn off the driver that provides DMA for 1394 devices. Given that very, very few Windows machines are ever connected to 1394 devices, this is probably something that you should implement if you have sensitive data on your BitLocker-protected machines.

If you’re not running BitLocker, well, why not?

1 Comment

Filed under Security

Thursday trivia #33

From the excellent-videos department: a magic helicopter whose blades don’t turn. (Actually they do, but you’d never guess it from this video.)

New Music Thursday: my friend Michael recommended Caro Emerald and I’ve had a wonderful time listening to them– a neat mix of swing and dance with a touch of Dixieland and some fun retro-style videos.

I think I want to try learning how to cook sous vide. The promise of a simple, repeatable way to quickly make delicious entrees is pretty darn compelling. A group of friends at Microsoft is planning on doing a group build of a home sous vide machine, so I think I’ll try building my own at first.

 

Leave a comment

Filed under General Stuff

Preparing the content for Maestro round 2

This week Microsoft held the 2011 MVP Summit, which Tony ably summarized here. I wasn’t able to attend, which is a real shame, as seeing my MVP peers and the many Microsoft Exchange team members who come to the summit to teach, debate, and gather information from and with the MVPs is usually one of the highlights of my year. However, despite the fact that Tony, Brian, and I were not able to sit down together, we are still making good progress on developing the revised content for the 2011 series of Maestro events.

For the 2010 event’s, we focused on covering Exchange 2010 SP1. We are continuing that focus for the 2011 event, even though common sense tells us that SP2 will likely be forthcoming sometime this year. Microsoft has not said anything publicly about the release schedule for, or the likely contents of, SP2, so it doesn’t make sense for us to try to include it in our planning. What we can do, however, is refocus on some areas of SP1 that have proved to be particularly interesting from a technical standpoint or particularly challenging for people who are deploying Exchange 2010.

For my part, that means rethinking the way we approach the material covering the client access server. CAS is a complicated topic. There’s just no getting around that fact, but based on feedback from attendees and the kinds of questions I see posted in online fora, I think we can do a more focused job of covering the things that people have the most difficulty understanding. This is especially true for people who are migrating from Exchange 2003, which is a much less complicated client access story. (Having said that, I am not planning on stealing Greg Taylor’s elephant jokes. I don’t have the accent for it!)

I also want to change the approach I take to RBAC to include more demonstrations; we’ll probably also revamp the RBAC lab a bit. Although RBAC is a tremendously useful feature, it really does require some experimentation and hands on usage to really make it click for most people.

Finally, although I am pretty pleased with the way the unified messaging coverage stands right now, I would like to include some more demos and labs. With that in mind, I will be approaching a few hardware vendors to see if we can get them to loan us some demo hardware. Ideally, I would like to have an optional lab for UM that has students set up an UM topology that allows them to experience the thrill that comes when the phone rings and you hear “Welcome to Exchange unified messaging.”

Once we finish wrangling over the exact contents of the course, we’ll post an updated agenda on the Penton registration website. We’ve also followed the lead of practically every other company and event in the entire world and set up a Facebook page for the 2011 Maestro series. I hope that we will see attendees who have registered and people who are considering it congregate around this page to share comments and feedback. For events like this, when the attendees get a chance to communicate before the event, increases the value to them by increasing the interpersonal connectivity of their time in the classroom. (That is one of the major advantages of the way the MCM Exchange training is currently done, something which I will have more to say about in a future post.)

Leave a comment

Filed under UC&C

Exchange Maestro: the 2011 version

Good news: the official registration site for the 2011 Exchange Maestro events is now open for business.

We have three upcoming events: San Diego on 3-5 May, London on 13-15 June, and Greenwich, CT on 26-28 October. (Tony answers the question "why Greenwich?", as well as some other notes, here.)

As someone who’s been presenting deeply technical multi-day events for a number of years, the second time is always the hardest. Fred Brooks called this the second-system effect: the first time you design something complex, you learn a great deal, and the things you learn often emerge the second time around… not always with positive results.

In this case, Tony, Brian, and I have a lot of solid feedback from our attendees, so we know what the Boston and Anaheim attendees would like to see changed in future events. We also have some ideas about where the larger Exchange community and marketplace are going; this helps us update the content so that it remains timely and relevant. We will have no problem updating and improving the content; I hope in particular to add some unified messaging-related labs to give attendees more hands-on time.

Speaking of hands-on, one of the most consistent pieces of feedback we got was there weren’t enough hours in the day to do the labs and cover the lecture material. This is by design; we want attendees to work on the labs on their own during breaks and at night, coming to us with questions when they arise, then take the labs back to their workplace where they can dig into them without having to divide their attention between the material we’re presenting and the labs. The whole point of these workshops is that they are richly technical, so it’s important that attendees be able to focus 100% on the new material.

A couple of eagle-eyed readers (hello, Mr. McBee) noted that the London Maestro event is co-located, and overlaps the schedule of, the new Connections Powered by Microsoft event. It was significantly less expensive for us to combine the logistics for the two shows; shipping, customs, food and beverage services, and so on, but I want to make clear that there’s no overlap of content between the two events.

Think of the Connections series like a visit to your local food court. You can shop around and have a little of this plus a little of that… a couple of sessions on Exchange, maybe a little Lync on the side, a smidgen of Windows, and SharePoint for dessert. Maestro is, by contrast, like a six-course dinner at a fine restaurant: a richer, deeper, more complex experience that, admittedly, takes more time and money. The two complement each other nicely, but both stand alone.

To abandon the restaurant analogy, the content that we’ll be presenting at Maestro is both broader and technically deeper than the sessions available at Connections. That’s because Tony and I are able to use our knowledge of Exchange and the broader industry to pick out the most useful, most interesting, and least-known aspects of Exchange 2010 design, deployment, and operations and present them to you on a platter, so to speak. (All right; I didn’t entirely abandon the analogy…)

Registration is open now for the San Diego and Greenwich events, and we expect it to open shortly for London as well. Stay tuned for future details, including a few neat new steps we’re taking to help those interested in the Maestro classes get the most out of their attendance…

4 Comments

Filed under UC&C

Introducing the E5000 messsaging system

This week I had the unique opportunity to spend some quality time with two of my favorite people: Tony Redmond and Brian Desmond. The occasion was that we were invited by Hewlett-Packard and Microsoft to take an advance look at their new E5000 messaging system before its formal unveiling. Our goal was to spend some time with the program managers on the E5000 team learning about the system and experimenting with it a bit. The kicker: the whole process was videotaped.

Of course, nothing is as simple as it first seems. Tony, Brian, and I thought that “videotaped” meant “hand-held camcorders.” We were in for a rather rude surprise when we were greeted by Jenny, our makeup artist:

IMG_0248

She wasn’t rude in the least, but boy, were we surprised to see her. Jenny quickly got our makeup on and onto the set, where we found no fewer than four large, dolly-mounted video cameras, each with a camera operator, plus a sound guy, a director, and assorted other studio folks. We very quickly got used to their presence and sat down with Dean Steadman and Karl Robinson of Hewlett-Packard and Jeff Mealiffe of Microsoft to talk about the specifics of the E5000 series.

Tony’s writeup gives a good summary of our discussions. Going in, I was of the opinion that having a solution that combines two DAG nodes in a single physical enclosure was useful, but that it was lacking in three key areas: it still needs load balancing; it introduces the potential for the E5000 to be a single point of failure, and it doesn’t include Exchange server licenses so it isn’t really a complete solution.

However, once I had a chance to talk things over with Dean, Jeff, and Karl, I started to come around.

First, load balancing. Yes, you still need it. In this respect the E5000 is no different than any other set of Exchange 2010 servers. I’d love to see load balancing integrated into a future revision of the E5000 series, as I think the customers who will be most interested in the idea of an all-in-one appliance are least likely to want to deal with the complexities of CAS load balancing.

Second, HA. It’s true that if you put an E5000 in your server rack that a site-level failure (including mains power, fire, flood, and so on) can kill both nodes at once– but this is no different than the situation faced by the majority of Exchange 2003 sites now, the very customers at which the E5000 is targeted. Replacing a set of Exchange 2003 servers with a set of E5000s means that customers can not only take advantage of Exchange 2010’s I/O improvements to reduce the total number of servers, but that they can also use DAGs to reduce the risk of data loss from a disk, controller, or server failure. Where business reasons require protection against site-level failure, it’s a simple matter to drop one or more additional E5000s in a remote site and join them to the existing DAG. The more I think about it, the more I like the idea of using building block-style hardware like E5000s as the basis of building remote sites. There’s quite a benefit to standardization of hardware, software, and operations.

Third, license bundling. Because the E5000 will primarily be sold through HP’s channel partners, I’d expect that customers who need Exchange server licenses or CALs will be able to order them at the same time as their E5000 units. The E5000 Quick Deployment tool won’t proceed with installation until you enter a valid Exchange PID. This is required because some models of the E5000 line will be configured with more than 5 databases, and to prevent unpleasantness the installer wants to verify that the PID is for the Enterprise Edition of Exchange. Making things a bit more complicated, from a business standpoint, Exchange server licenses have never been previously bundled in the way that Windows Server licenses have. I’m hopeful that we’ll see the option to bundle all the needed licenses in with the product. (In fact, I had a great discussion with the Microsoft folks about the desirability of an in-app purchasing system for CALs– imagine being able to buy additional CALs or server licenses as easily as you buy songs on iTunes or points on Xbox LIVE.)

The deployment experience is quite smooth; all of the questions normally spread throughout the Exchange setup process are consolidated onto a single page. Once you answer them, the setup tool does the rest. Bear in mind that you have to complete installation on the first blade before you can do anything with the second blade. Don’t give in to the temptation of starting setup on blade 2 before it’s done on blade 1. Trust me on this.

However, if you want to do things like pull out disk drives or even blades while the E5000 is running, go right ahead. I got to experiment with doing exactly this and it was quite a lot of fun. Bear in mind that there are two hot spares allocated for each blade, so if you pull a spare nothing will happen. However, pulling a data drive triggers a rebuild of the mirror pair containing the affected DAG, and then pulling another drive causes a DAG failover, just as you’d expect.

Tony, Brian, and I left the HP folks with quite a bit of feedback on every aspect of the E5000, but that’s why they asked us to come. The basic product is quite solid, and I expect it to be warmly received in its target market of organizations with 500-3000 mailboxes. It’s definitely a major upgrade over what customers in that segment have with Exchange 2003. On to March 1st, the official release date!

2 Comments

Filed under UC&C

Divorce and taxes

I am neither a tax professional nor a divorce lawyer, and I haven’t stayed at a Holiday Inn Express in years, so don’t take this post as advice. Rather, consider it a cautionary tale.

As far as our friends at the IRS are concerned, your marital filing status is whatever you are on 31 December. That is not what I thought; my understanding was that you could file as either married or single if your status changed during the year. With that in mind, I now face a much larger tax bill than I expected, or budgeted for, because now I am being taxed at the single rate for the entire year’s income… while simultaneously having had taxes withheld at the married rate.

So, a word to the wise. If you’re getting divorced, from a tax standpoint you will probably be best off if you have the divorce become effective as early in the year as possible. Don’t take my word for it, though. Read IRS publication 501, and consult an accountant. I wish I had.

Comments Off on Divorce and taxes

Filed under Musings, Oops!

Thursday trivia #32

  • I was all excited to see that Safeway delivers groceries. Sadly, they only deliver the next day, and someone over 18 has to be present to sign for the delivery– that makes their service completely useless for me. If I was at home to sign for the delivery, I’d just buy the stupid groceries.
  • I just ordered a bunch of Girl Scout cookies. Now the long wait for late February begins…
  • Dear Costco: if you’re going to try to sell me an $8000 package with two Super Bowl tickets, they’d better not be in the "upper end zone". Thanks for trying, though.
  • Learning to fly has been a terrific experience so far. There’s soooo much to learn, though. I’ve been flying a 1980 Cessna 172 that has a few, um, quirks– like a staticky intercom and wildly variable radio volume. My instructor talked me into trying a newer model of the same airplane, and the difference in flight is amazing. The two aircraft have very similar specs, but the newer one is smoother, quieter, and much more responsive both to throttle and control inputs.
  • Speaking of which: the boys and I together weigh nearly 700 pounds, which means if I’m going to fly them anywhere I’ll have to get checked out in a bigger airplane. Oh, the sacrifices we make for our kids…
  • Who says nothing exciting ever happens in Utah?

Comments Off on Thursday trivia #32

Filed under Friends & Family, Musings

Thursday trivia #31

  • This article says that Cleveland, Buffalo, St Louis, and Columbus are growing in population. No mention, sadly, of Detroit, but I’m guessing they’re not having the same benefit.
  • I’m a little scared to watch this FRONTLINE episode about aircraft maintenance.
  • Matt won every single race of his Cub Scout pack’s Pinewood Derby. First place, his ribbon said. Way to go!
  • Apparently sitting on your butt too much will kill you. Good thing I just got a new standing desk; expect a full review soon.
  • My friend Chris is running a half-Ironman in two months. He was lamenting the fact that he got talked into it by an enthusiastic friend. I told him that next time he’s considering something like that, he should just call me and I’d talk him down.
  • The Kindle David got for Christmas abruptly went crazy. A 10-minute phone call to Amazon on Tuesday resulted in a new Kindle arriving at my house today. I have never had a bad customer service interaction with Amazon in all the years I’ve dealt with them.
  • Wow. That’s a lot of water.

Comments Off on Thursday trivia #31

Filed under Friends & Family, Musings

A little more on group metrics

About a year ago (wow, how time flies!) I wrote about group metrics generation in Exchange 2010. In that article, I posted a link to an article that EJ Dyksen of Microsoft wrote about MailTips troubleshooting. I was reminded of that article when I noticed event ID 14039 in my event log– it was claiming that the last group metrics file generated was more than a month old. "That’s not right," I thought. "I’d better verify that group metric generation is enabled."

Only, the EMS parameter for group metrics generation has changed. You now have to use Set-MailboxServer -ForceGroupMetricsGeneration $true. This is documented, but I had to hunt for it, grumble. Sure enough, group metrics generation was turned off on my mailbox servers, I suspect erroneously. Interestingly, the problem cropped up the day after we started our two-week Christmas break… a day or so after I applied a rollup to the servers. I smell a rat…

Technorati Tags:

Comments Off on A little more on group metrics

Filed under UC&C

Thursday trivia #30

  • Last night I had a minor plumbing emergency at my rented house. At that point it dawned on me that having a property management company as a landlord is perfectly OK until you need them outside of normal business hours. They just called me back, giving them roughly a 12-hour response time. That much delay could have been a real problem; time to get an emergency contact number from them.
  • I think I’m pretty much done using Twitter for the time being. It always feels like a huge time suck, and if I don’t watch it like a hawk I’m always afraid that I’ll miss something useful or interesting. Twitter and Facebook should be where you chronicle what you do; they shouldn’t be what you do.
  • The next Microsoft Certified Master for Exchange rotation has already started, which means I’m getting ready to teach unified messaging again. This time I’m trying to make the material much more technical, which should be an interesting challenge. If you’re already familiar with Exchange UM, feel free to let me know what kind of technical content you’d like to know more about.
  • Flying lessons! I could write a whole series of blog posts about this, and in fact I probably will when I have time. For the meantime, let me say I am delighted with Advantage Aviation at KPAO so far.
  • This year I bought the NFL Sunday Ticket package, hoping to watch more Saints games. I think I watched a total of about two. File this under the "failed experiment" category. The coverage was great, but I’m just not enough of a fan (or equipped with enough free time) to watch enough football to justify the cost.
  • So far, I’ve learned to cook three things that the boys eat with gusto: pulled pork, chili, and beef stew. This weekend I’m branching out into some pasta dishes. Part of my strategy will be to feed them small breakfasts and lunches so they’re hungry enough to eat whatever I cook for dinner.
  • Can’t wait to see what the yellowsphere has to say about this. Congratulations to the Exchange team!
  • Spring break: Washington DC or someplace fun and warm? Decisions, decisions.

Comments Off on Thursday trivia #30

Filed under Friends & Family, Musings

Fried fish considered harmful?

Might as well just kill me now:

Scientists writing online in the journal Neurology analyzed the diets of more than 21,000 people nationwide. They found that people in eight stroke belt states — North and South Carolina, Georgia, Alabama, Mississippi, Tennessee, Arkansas and Louisiana — ate a three-ounce serving of fish an average of twice a week, roughly the same as people elsewhere. But they were 32 percent more likely to have that fish fried. Nationally, African-Americans ate more fish meals than whites, and twice as much fried fish.

The NYT storyalso contains this fascinating quote from the study’s author, Dr. Fadi Nahab of Emory University:

“The No. 1 thing [that leads to changes in stroke risk] is diet,” he said. “And yet when we look at dietary differences in and out of the stroke belt, it’s hard to find any other than this one.”

I’d suggest that Dr. Nahab must not have been in the South all that long if this is the primary dietary difference he’s identified between Southerners and those living in other parts of the country.

More seriously, the Emory press release says that people in the stroke belt eat “an average of 0.68 servings of fried fish per week, compared to 0.64 in the stroke buckle and 0.62 in the rest of the country.” For non-fried fish, the press release says that stroke belt residents averaged “1.45 servings per week, compared to 1.52 servings in the stroke buckle and 1.63 servings in the rest of the country.” Those are awfully small differences, so I’m not quite ready to stop eating fried catfish just yet (not that you can get it in the Bay Area anyway.)

Comments Off on Fried fish considered harmful?

Filed under Musings

2010 in review

If I were a pessimist, I would talk about what a rotten year 2010 was. Instead I prefer to believe that 2011 will be better.

Professionally it was a banner year. Things at Acuitus continue to go superbly, and I was able to work on a variety of interesting side projects (including editing Tony Redmond’s book and working with him on a roadshow.)

Personally: well, my marriage of 19 years ended. All I want to say about it here is that it was amiable and that Arlene and I remain committed to working together to raise our sons. (OK, one more thing: thanks to all who have offered support to either or both of us.)

In 2011, my plans are to continue learning Spanish; get my private pilot’s license; do more writing, and learn to cook a bit. That should keep me busy.

Happy New Year!

1 Comment

Filed under General Stuff

Light blogging for the next few weeks

Right now, I’m in an airport. Yes, yes, I know, quelle surprise, right? This time, I’m in Atlanta en route to Alexandria to see my mother, grandmother, uncles, and cousins. I’m really looking forward to the visit, even if it means being at ATL at 0600 Sunday morning.

Acuitus was kind enough to give us all two weeks of extra vacation at year’s end, thus my visit. When I return home, I’ll spend Christmas with the boys, then we’re heading north to visit friends in Seattle for a few days.

After that, it’s back to the grindstone. I expect to be really busy for the next few weeks, mostly with activities that don’t involve being near a computer (except, of course, for work). I also need to upgrade the blogging software I use, and I’m not sure how long that’s going to take.

Bottom line: don’t expect to see much from me here until early February or so.

Until then: Merry Christmas and Happy New Year!

Comments Off on Light blogging for the next few weeks

Filed under Friends & Family

Thursday Trivia #29

Sorry for the lack of updates. I have been dealing with a wide variety of challenges, including a very busy work schedule and all the normal holiday uproar that comes this time each year. Right now it’s around 6am and I am blogging while running two loads of laundry (one in the washer, one in the dryer) and patching a mail server at work. That should tell you something.

  • Remember, kiddies, when you’re installing an Exchange rollup, always run it elevated. If you don’t, it won’t work, and it won’t give you a meaningful error message. (Not that I’m bitter.)
  • The more I use Windows Phone 7, the better I like it, but it’s still not quite a 100% replacement for everything I need my mobile device to do.
  • I am super excited about going to Alexandria this weekend to see my family! It won’t hurt that the Saints will be playing on TV while I’m there, either. Plus, there’s a good prospect for me to do a little home improvement while I’m down there.
  • Boy Scout rechartering is about as big a paperwork hassle as I’ve ever seen. I’ll be so glad when it’s finally done.
  • We had a fantastic office party yesterday, with a hilarious “white elephant” gift exchange. I got a lovely set of Star Trek glasses that the boys have immediately adopted. (They are very like, but not exactly, like these.)
  • My travel year will end with just over 75,000 MQMs on Delta, making me Platinum Medallion again for next year. I already have my first trip of 2011 planned– Redmond (again) for Microsoft Certified Master Exchange rotation 7 (or 8? I lose track.
  • I have three solid non-fiction book ideas: two technical, one not. However, I only have time to write one of them. Decisions, decisions.
  • We just dropped an update to LDS Tools that features a ton of work that I did. There are two more updates right around the corner, too– one that’s already in the pipeline and another that should drop in early January. If you’re LDS and have an iPhone, iPad, or iPod Touch, you’d probably like this app.
  • David starts driving school next week. Yikes!

Comments Off on Thursday Trivia #29

Filed under Friends & Family