I read the news today, oh boy…
In case you missed it, Microsoft announced that the availability of Windows XP Home will be extended worldwide in support of “an emerging, new class of mobile personal computers commonly known as ultra-low-cost PCs, or ULCPCs.”
This will Windows XP Home for ULCPCs will be available until the later of June 30, 2010, or one year after general availability of the next version of Windows.
Tags: Microsoft, Windows XP, ULCPC, Windows.
So, the controversy is nothing new, and nearly as old as the as Apple 1984 commercial. I’ve posted previously at Mac and PC Security and noted that — no matter what connected platform you use — there’s no immunity from security vulnerabilities. And there is certainly no shortage of news on Macintosh vs. Windows vulnerabilities.
This week it appears that the efforts to improve security over the last few years had paid a dividend: Computerworld notes the Swiss research that examines which company patches zero-day vulnerabilities faster. And the answer isn’t likely to show up in an Apple ad any time soon…
Apple’s teasing commercials that imply its software is safer than Microsoft’s may not quite match the facts, according to new research revealed at the Black Hat conference on Thursday.
Researchers from the Swiss Federal Institute of Technology looked at how many times over the past six years the two vendors were able to have a patch available on the day a vulnerability became publicly known, which they call the 0day (zero-day) patch rate.
They analyzed 658 vulnerabilities affecting Microsoft products and 738 affecting Apple. They looked at only high- and medium-risk bugs, according to the classification used by the National Vulnerability Database, said Stefan Frei, one of the researchers involved in the study. [Click here for the paper in PDF format.]
What they found is that, contrary to popular belief that Apple makes more secure products, Apple lags behind in patching.
Frei is with the Computer Engineering and Networks Laboratory (TIK) at the Swiss Federal Institute of Technology, ETH Zurich. The paper is “0-Day Patch – Exposing Vendors (In)security Performance, 2008” in which the researchers look at the “0-day patch rate as a new metric to measure and compare the performance of the vulnerability handling and patch development processes of major software vendors.”
I hear the Swiss are traditionally neutral. 😉
More at http://www.techzoom.net/risk/ and the Computerworld article at Microsoft vs. Apple: Who patches zero-days faster?
Tags: Microsoft, security, Macintosh, Stefan Frei, 0 Day, vulnerability.
Earlier this week, I provided a couple of glimpses at how product groups listen and respond to customers and partners. In the seven plus years I’ve been at Microsoft, I’ve seen lots of different ways how product teams listen and respond to customers. Previously, I worked along side the Engineering Excellence group, working on CPE across the product groups; now, I’m back in the Windows group… but I still work across product groups as they concentrate on improving customer satisfaction.
And core to the effort in most teams is the product and machine telemetry we get from millions and millions of customers through Microsoft Windows Error Reporting, the Customer Experience Improvement Program and software quality metrics (aka SQM, or ‘squim’). For more on SQM, see this prior post.
Windows Error Reporting (WER) is based on the technology that was originally known as Dr. Watson, the Windows program error debugger tool included in previous versions of Windows, as far back as Windows 3.0, and was included in Windows 98, Me, and XP.(Check out Raymond’s blog to understand why Windows Error Reporting is nicknamed “Dr. Watson”.)
WER captures software crash and hang data from end-users who agree to report it. You can access the data that is related to your applications online at https://winqual.microsoft.com. Gregg offers an overview on his blog on developers can use WER to debug what went wrong. In Windows, WER feedback technology is part of Microsoft Windows XP, Windows Vista, and Microsoft Windows Server 2003 and 2008 operating systems.
We know that the effort makes an impact: as outlined in the above article, our analysis shows that across all the issues that exist on the affected Windows platforms and the number of incidents received:
Considering the hundreds of millions of customers around the world, that’s a considerable impact.
Steve Ballmer outlined the effort in his 2002 letter on “Connecting to customers,” when he discussed how Microsoft can do a better job of serving our customers, and ultimately improve the customer experience through better communications and connections…
“The process of finding and fixing software problems has been hindered by a lack of reliable data on the precise nature of the problems customers encounter in the real world. Freeze-ups and crashes can be incredibly irritating, but rarely do customers contact technical support about them; instead, they close the program. Even when customers do call support and we resolve a problem, we often do not glean enough detail to trace its cause or prevent it from recurring.
“To give us better feedback, a small team in our Office group built a system that helps us gather real-world data about the causes of customers’ problems–in particular, about crashes. This system is now built into Office, Windows, and most of our other major products, including our forthcoming Windows .NET Servers. It enables customers to send us an error report, if they choose, whenever anything goes wrong.”
With WER, product groups get information that helps them identify the most common issues that our customers encounter on their computers, along with details that can help the teams debug the problem. If you’ve every run into a problem or application crash on your computer, chances are that you’ve seen the prompt to provide more information to Microsoft on the failure.
We also provide WER for Independent Software Vendors (ISVs) and Hardware Vendors (IHVs) on the MSDN forums, helping them find and correct issues with their application, ultimately leading to improvements in their products. These companies access our error reports database and discussion forums to address the errors and incompatibilities that creep up in their equipment drivers, software utilities and applications. (As noted on our sites, WER data is available to ISVs, IHVs and OEM and ODMs.)
Bill Gates said at PDC 2003…
“We allow anyone who has an application that runs on Windows to sign up and get the reports that relate to their application, and we’ve got winqual.microsoft.com where people can do that.
“Today we’ve seen a lot of that activity from the driver manufacturers, but we want to see even more at the application level so it gets us working together on anything where a user is not having a great experience.”
Coupled with the telemetry from WER is the feedback we get through the Microsoft Customer Experience Improvement Program (CEIP). Through these programs, hundreds of millions of customers help Microsoft improve upon the design, quality and features of our products and services. Participation in the CEIP is anonymous: when you sign up for the CEIP, information about how you use certain products is automatically sent to Microsoft, collected in the aggregate with CEIP data from other computers. Microsoft doesn’t use your collected CEIP data for any product marketing or promotions. (More details are provided in the Customer Experience Improvement Program Privacy Policy.)
According to the CEIP site…
CEIP collects information about how you use Microsoft programs and about some of the problems you encounter. Microsoft uses this information to improve the products and features you use most often and to help solve problems. Participation in the program is strictly voluntary, and the end results are software improvements to better meet your needs.
The Windows Server team uses the CEIP for their products, include Windows Server 2008. The team uses CEIP to improve the product in the following ways:
As John Song notes on the Dynamics CRM team blog, the team gathers information on how our customers are using the customization tool and how much they are customizing the out-of-the-box CRM.
“Through SQM/CEIP data, now we know that the Account is the most updated form in the CRM 3.0 (Well, that wasn’t a surprise for us, but the number of changes made was). A quarter of the CRM customers are adding good amount of new fields in the Account and other “main” forms.
It’s all about providing feedback to the products teams.
[Update: you can see the WSYP video here on YouTube: https://youtu.be/D28FkfJiauk]
When I’m asked about how this data is used, I often point people to my post “TwC’s site on Product Reliability… and WSYP” that has has a link to the WSYP Project, looking at how we leverage customer feedback in near real-time to improve software quality. (You can find this and other clips on the TechNet UK Spotlight page.)
And yes, Mauro is a real Microsoft employee. ; )
You can take advantage of WER to investigate the most frequently reported software crashes, resolve the problems, and inform your customers of the fixes, establishing a strong feedback loop with your customers.
Also available via http://bit.ly/AxnhyW
Link: How Windows Error Reporting Helps Customers
Tags: Microsoft, Watson, customer feedback, WER, Windows Error Reporting, SQM, CEIP, Video.
It’s fitting: Japan has Doraemon for anime and Microsoft Oz has a whimsical cartoon character to help citizens prepare for the upcoming end to daylight saving time in Australia.
Another example of listening and responding to customers…
No sooner had the Japanese selected Doraemon as the official anime ambassador that the folks at Microsoft in Oz brought out a cartoon character to help usher customers through the system updates for daylight saving time changes in Australia. Visit the Microsoft Australian home page for daylight saving time for more information…
This year New South Wales, Victoria, Australian Capital Territory, Tasmania and South Australia are extending Daylight Saving. Daylight Saving will end 1 week later, on Sunday 6th April and recommence 3 weeks earlier on Sunday 5th October.
Your Microsoft Windows PCs, servers and mobile devices will need to be updated so that they automatically adjust their internal clocks on the new Daylight Saving start and end dates. You may also need to adjust some appointments in your Microsoft Office Outlook calendar.
But does this new character have a name? My money’s on “Iain the IT Pro”. 😉
This site was launched in response to the customer requests in Australia to help make sense of the changes last year to daylight saving time that affect customers around the world. At corporate, we launched a DST and Time Zone informational website (http://www.microsoft.com/time in case the hyperlink fails) providing links to key documents and articles on updates and changes for Microsoft products.
Tags: Microsoft, Daylight Saving Time, Daylight Savings Time, DST, Time Zones, Australia.
A popular question over the last few days…
“What is going on in Iraq next week on daylight saving time?”
As I noted earlier, it looks like Iraq will not observe daylight saving time this year. The change is currently scheduled to take effect on April 1, 2008. To this point, we haven’t has not been able to officially verify this change, but we’ve spun up resources over the last few weeks to provide guidance, updates and documentation for customers and partners, initially here on the DST & TZ blog and now on a permanent page, Iraq Daylight Saving Time changes, off of the Microsoft DST & TZ site.
What should you do?
In most cases, for consumers and small businesses, probably nothing.
Unless you live in the affected region and actively use Iraq’s Baghdad (Arabic) time zone on your Windows desktop and server operating systems, you probably won’t see or feel any impact.
If you do use the Baghdad time zone, we recommend that you read the recommended steps on the Iraq Daylight Saving Time changes page. And please don’t manually adjust the machine’s clock if you do use the Baghdad time zone. This will cause adverse effects on your environment and it is not supported by Microsoft. (To read more about why this is a bad idea, see “For DST, do I just adjust my clock in the control panel?”)
Enterprise and multinational customers with a presence in Iraq (or if you schedule meetings via Outlook with customers in the region using the time zone) should review the Iraq Daylight Saving Time changes page, and follow the product group guidance provided – on the page you’ll find a summary of the current status of impacted products and estimated dates when hotfixes will be available.
For details on setting up RSS feeds for these pages, see my post on getting RSS feed updates.
At Microsoft, product teams are moving to a semi-annual update cadence, following the Windows regular cadence for publishing newly legislated DST rules and time zone updates. Annual “Cumulative DST and Time Zone Updates” will be released in November/ December for the coming calendar year, and we’ll also provide for a semi-annual update in the July/August timeframe when needed. For each, the window closes for additional updates a few months (generally four to six) prior to the release date. Our goal is that sysadmins and IT Pros can plan on rolling out and installing/ deploying these cumulative update roll-ups as they are published.
<soapbox>
I have to recommend that in order to achieve more seamless transitions to new DST rules and time zones, governments should provide 1) official confirmations of planned changes to DST and time zones, and 2) provide ample advance notice and concentrated efforts on promoting the change to the affected citizens is a requirement. If you look at how Australia approached their upcoming change in April (more details are available here), the national government allowed eight months or so between the announcement and the actual change. And as noted on the Australia Eastern & Central 2008 Daylight Saving Changes page (managed by the irrepressible Hugh Jones), the Aussies set up the official Australian Government Time web site to educate end users.
</soapbox>
Tags: Microsoft, Daylight Saving Time, Daylight Savings Time, RSS, DST, Iraq.
Also available at http://bit.ly/bipS8Y.
