My latest blog item is from inhabitat. A little bit about inhabitat.

 Inhabitat.com is a weblog devoted to the future of design, tracking the innovations in technology, practices and materials that are pushing architecture and home design towards a smarter and more sustainable future.

They did a whole article in a Thai Temple built from recycled bottles. It was great to see. I hope you enhoy it as much as I did.

Thai Temple Built From One Million Recycled Bottles

Posted by Michael Corey CEO & Founder Ntirety

www.ntirety.com

My latest blog entry is from Craig Mullins. He is a frequent contributor to Database Trends and Applications. He is also a twitter fiend. The last time I looked he was in Vegas at a Casino. I have always enjoyed his many article. I feel he has a very common sense approach to the DBA and how he writes about it.. Craig is a DB2 DBA but the lessons learn always carry across.

DB2PORTAL Blog

Monday, October 20, 2008

DBA Rules of Thumb, by Craig Mullens

Database administration is a very technical discipline, but it is also a discipline in which the practitioner is very visible politically within the organization. As such, DBAs should be armed with the proper attitude and knowledge before attempting to practice the discipline of database administration.

Just as important as technical acumen, though, is the ability to carry oneself properly and to embrace the job appropriately. With this in mind, I wrote a series of blog entries on DBA Rules of Thumb over at my Data Management Today blog... and I thought the information I wrote there may be helpful to my DB2 and mainframe readership here, so I'm sharing the eight rules of thumb (with links) here on my DB2 Portal blog:

1. Document Everything!
2. Automate Ingelligently
3. Share
4. Don't Panic!
5. Focus Your Efforts
6. Invest In Yourself
7. Diversify
8. Develop Business Acumen

What do you think? Did I miss anything important?

P.S. Just a reminder that I will be presenting a webinar on assuring DB2 recoverability with my colleague, Michael Figaro, this Thursday, October 23, 2008 at 10:30 Central time. If you are at all interested in the topic, be sure to register today - and attend this Thursday!

My favorite on this list is "Dont Panic". Amen ! ! ! !

I followed the link on this one, I could not resist...

DBA Rules of Thumb, Part 4 - Don't Panic

A calm disposition and the ability to remain cool under strenuous conditions are essential components of the makeup of a good DBA. So number four in our series of DBA rules of thumb is "Don’t Panic!"

I used to have a big orange button with the words "Don't Panic!" on it hanging up in my office. Fans of Hitchhiker's Guide to the Galaxy will recognize the phrase, and I think I got the button in a software game based on those books back in the 1980s. I gave it away a long time ago to a friend when I left one of the company's I was working at as a DBA. He needed it more than I did at the time! But I always kept that mantra in the back of my head as I continued along my journey as a DBA.

Problems will occur – there is nothing you can do to eliminate every possible problem or error. Part of your job as a DBA is to be able to react to problems with a calm demeanor and analytical disposition. When a database is down and applications are unavailable your environment will become hectic and frazzled. The best things you can do when problem occur is to remain calm and go about your job using your knowledge and training.

As the DBA you will be the focus of the company (or at least the business units affected) until the database and applications are brought back online. It can be a harrowing experience to recover a database with your boss and your users hovering behind your computer terminal and looking over your back. Be prepared for such events because eventually they will happen. Panicking can cause manual errors – the last thing you want to have happen when you are trying to recover from an error.

The better you perform up-front planning and the better your procedures, the faster you will be able to resolve problems. And if you are sure of your procedures you will remain much calmer.

Following these basic maxims will make database administration a much more manageable task within your organization.

To read the entire posting...... DBA Rules of Thumb

http://www.db2portal.com/blog.html

DBA Rules of Thumb

I loved the list he came out with. He is so right, dont Panic. I recently write an article for Database Trends and Applications. When Atlas Stumbles - Lessons for Preventing DBA Burnout. The job of a DBA is hard enough, imagine how easily it is to Panic when your database goes down and you know your company is depending on you the Lone DBA to get it back up and running. 

A great way to help prevent DBA Panic, is to get the DBA some help. A relationship with a good remote DBA firm, would be a way to get your organization some additional DBA bandwidth in a cost effective manner. It would get your DBA their nights and weekends back. It would significantly reduce DBA stress, helping prevent DBA panic from happening.

Posted by Michael Corey CEO & Founder Ntirety

www.ntirety.com

When you take a hard look at John McCain you can’t help but realize you are dealing with a man of high integrity.  The latest article is on Bin Laden’s Al Qaeda who endorses John McCain. An endorsement I am sure he wished never happened.

This latest article appeared in The New York Times. 

The Endorsement From Hell

John McCain isn’t boasting about a new endorsement, one of the very, very few he has received from overseas. It came a few days ago:

“Al Qaeda will have to support McCain in the coming election,” read a commentary on a password-protected Islamist Web site that is closely linked to Al Qaeda and often disseminates the group’s propaganda.

The endorsement left the McCain campaign sputtering, and noting helplessly that Hamas appears to prefer Barack Obama. Al Qaeda’s apparent enthusiasm for Mr. McCain is manifestly not reciprocated.

“The transcendent challenge of our time [is] the threat of radical Islamic terrorism,” Senator McCain said in a major foreign policy speech this year, adding, “Any president who does not regard this threat as transcending all others does not deserve to sit in the White House.”

That’s a widespread conservative belief. Mitt Romney compared the threat of militant Islam to that from Nazi Germany or the Soviet Union. Some conservative groups even marked “Islamofascism Awareness Week” earlier this month.

Yet the endorsement of Mr. McCain by a Qaeda-affiliated Web site isn’t a surprise to security specialists. Richard Clarke, the former White House counterterrorism director, and Joseph Nye, the former chairman of the National Intelligence Council, have both suggested that Al Qaeda prefers Mr. McCain and might even try to use terror attacks in the coming days to tip the election to him.

“From their perspective, a continuation of Bush policies is best for recruiting,” said Professor Nye, adding that Mr. McCain is far more likely to continue those policies.

An American president who keeps troops in Iraq indefinitely, fulminates about Islamic terrorism, inclines toward military solutions and antagonizes other nations is an excellent recruiting tool. In contrast, an African-American president with a Muslim grandfather and a penchant for building bridges rather than blowing them up would give Al Qaeda recruiters fits.

To read the entire article.... The Endorsement From Hell

Posted by Michael Corey CEO & Founder Ntirety

www.ntirety.com

World Economic Crisis. A Pakistani Prespective.

Monday, October 13 2008 @ 11:18 PM GMT+6

Contributed by: karachiwala

I cannot forget the day when my cousin was leaving for United Kingdom (read England) almost 2 decades back. She was flying British Airways. I could not have been more proud as a child. Flying British Airways was the absolute experience. Impeccable British services and a symbol of Life style that only few were able to enjoy. British Airways was benchmark.

As for myself i had failed to see an aircraft up close and person for many years after that, let alone had the opportunity to be in one.

Many many years after that when air travel was comoditized and i was working in United States i got a call from a friend who was on forced leave at KPMG and was in Pakistan. He had suddenly been called to the USA and was arriving the next day. It was around same time when Enron was about to collapse. The next day was a shocker as my friend got fired from KPMG.

Mind you KPMG was the kind of the company that the public used to look up to as the keep and builder of public trust. People after all only brought Enron shares when they knew that there was on "honorable and integrable" company was going to guard against any corruption in the giant.

However we all saw how KPMG which was The audit firm had fallen from grace only because of greed and financial corruption. Same was the case for British Airways which was found guilty of Dirty Tricks Campaign against Virgin Atlantic years back only to ensure its corrupt survival. What was revealed in the court battle was that Virgin Atlantic's (a private airline) CEO Richard Brannson pursued against British Airways was plain fact that British Airways had only built its integrity by looting, poaching and threatening competition.

Had any of this been done in Nigeria, Pakistan, India, Philippines, Malaysia they would have be declared corrupt countries. Their credit ratings would have gone down and big news clippings would have crippled these nation. But in the above two case it was the United States of America and the Kingdom of Englishmen.

Coming to the present day. I was again shocked to see that today Half of UK's bank are nationalized. Fannie Mae and Freddiemae in USA are nationalized. They only have private management the companies are now effectively controlled and owned by the governments. On an interesting note financial system in Iceland has completely and fully crumbled.

In the minds of the these 3rd world nations it has been drilled that the USA, UK and other European nations are some how above the mortal realm of morality, corruption, negligence, due diligence and enforcement of the law.

We are only finding out now that these countries were doing only bigger and better corruption. Only their scale was large and that they took the third world for a ride for a very long time. Enforcing privatization, skimming their foreign currency reserves, held back support in case they failed to do so, even helping enforce dictatorship as in case of 50% of Pakistan's history. And indirectly created circumstances where billions of people suffered.

To read the entire article.... World Economic Crisis. A Pakistani Prespective

Posted by Michael Corey CEO & Founder Ntirety

www.ntirety.com

We all keep hearing about cloud computing. The opinions are all over the map. From time to time I have commented in cloud computing in my Blog. A few of my favorite quotes…

Cloud computing is a trap, warns GNU founder Richard Stallman. 

This was covered in detail in my blog entry Richard Stallman - "Cloud Computing is a Trap!

Larry Ellison said that the computer industry is more fashion-driven than women's fashion and cloud computing is simply the latest fashion.

This was covered in detail in my blog Why Cloud Computing Is Like The Fashion Industry

In some ways I think of cloud computing akin to timeshare computing in the 1970’s. What is clear to me is where there is smoke there is fire. When companies like AMAZON and Microsoft are making big bets on it. There is something there that will effect how Technology is delivered.  My latest blog entry is from  O’Reilly Radar

Here is a little bit of Information on Tim O'Reilly..

Tim O'Reilly is the founder and CEO of O'Reilly Media, Inc., thought by many to be the best computer book publisher in the world. O'Reilly Media also hosts conferences on technology topics, including the Web 2.0 Summit, the Web 2.0 Expo, the O'Reilly Open Source Convention, and the O'Reilly Emerging Technology Conference. Tim's blog, the O'Reilly Radar, "watches the alpha geeks" to determine emerging technology trends, and serves as a platform for advocacy about issues of importance to the technical community. Tim is an activist for open source and open standards, and an opponent of software patents and other incursions of new intellectual property laws into the public domain. Tim's long-term vision for his company is to change the world by spreading the knowledge of innovators. 

It’s a very well written piece on cloud computing I want to share.

Web 2.0 and Cloud Computing

by Tim O'Reilly 

A couple of months ago, Hugh Macleod created a bit of buzz with his blog post The Cloud's Best Kept Secret. Hugh's argument: that cloud computing will lead to a huge monopoly. Of course, a couple of weeks ago, Larry Ellison made the opposite point, arguing that salesforce.com is "barely profitable", and that no one will make much money in cloud computing.

In this post, I'm going to explain why Ellison is right, and yet, for the strategic future of Oracle, he is dangerously wrong.

First, let's take a look at Hugh Macleod's argument:

...nobody seems to be talking about Power Laws. Nobody's saying that one day a single company may possibly emerge to dominate The Cloud, the way Google came to dominate Search, the way Microsoft came to dominate Software.

Monopoly issues aside, could you imagine such a company? We wouldn't be talking about a multi-billion dollar business like today's Microsoft or Google. We're talking about something that could feasibly dwarf them. We're potentially talking about a multi-trillion dollar company. Possibly the largest company to have ever existed.

I imagine many of my friends who work for the aforementioned companies know all about this, and know how VAST the stakes are.

Windows vs Apple? Who cares? Kid's stuff. There's a much bigger game going on... And for some reason, its utter enormity seems to be a very well-kept secret, at least to non-combatants like myself.

The problem with this analysis is that it doesn't take into account what causes power laws in online activity. Understanding the dynamics of increasing returns on the web is the essence of what I called Web 2.0. Ultimately, on the network, applications win if they get better the more people use them. As I pointed out back in 2005, Google, Amazon, ebay, craigslist, wikipedia, and all other other Web 2.0 superstar applications have this in common.

Cloud computing, at least in the sense that Hugh seems to be using the term, as a synonym for the infrastructure level of the cloud as best exemplified by Amazon S3 and EC2, doesn't have this kind of dynamic. (More on different types of cloud computing later.)

Of course, it is true that the bigger players will have economies of scale in the cost of equipment, and especially in the cost of power, that are not available to smaller players. But there are quite a few big players -- Google, Microsoft, Amazon -- to name a few, that are already at that scale, with or without a cloud computing play. What's more, economies of scale are not the same as increasing returns from user network effects. They may be characteristic of a commoditizing marketplace that does not actually give outsize economic leverage to the winners.

I can't vouch for the authenticity of the following remark, since I heard it secondhand, but it was from a thoughtful, informed source: Jeff Bezos is reported to have said that he welcomes cloud competition from Google and Microsoft, because they'll subsidize their cloud services with profits from other part of their business, while Amazon will always have to make it pay. "We're good at commodity businesses," Jeff is reported to have said, and the facts bear him out.

If cloud computing is a commodity business, then the outsize profits that Hugh envisioned are not going to be there. This is a business that will be huge, but it may be more similar to the web hosting and ISP markets, which are also huge, but not hugely profitable. (See Rackspace's numbers for a taste.)

But because one of my goals at Radar is to help people think about the future, I wanted to spend some time on the possible futures and strategies that could turn cloud computing into the kind of massive monopoly that Hugh envisioned.

Types of Cloud Computing

Since "cloud" seems to mean a lot of different things, let me start with some definitions of what I see as three very distinct types of cloud computing:

1. Utility computing. Amazon's success in providing virtual machine instances, storage, and computation at pay-as-you-go utility pricing was the breakthrough in this category, and now everyone wants to play. Developers, not end-users, are the target of this kind of cloud computing.

   This is the layer at which I don't presently see any strong network effect benefits (yet). Other than a rise in Amazon's commitment to the business, neither early adopter Smugmug nor any of its users get any benefit from the fact that thousands of other application developers have their work now hosted on AWS. If anything, they may be competing for the same resources.

   That being said, to the extent that developers become committed to the platform, there is the possibility of the kind of developer ecosystem advantages that once accrued to Microsoft. More developers have the skills to build AWS applications, so more talent is available. But take note: Microsoft took charge of this developer ecosystem by building tools that both created a revenue stream for Microsoft and made developers more reliant on them. In addition, they built a deep -- very deep -- well of complex APIs that bound developers ever-tighter to their platform.

   So far, most of the tools and higher level APIs for AWS are being developed by third-parties. In the offerings of companies like Heroku, Rightscale, and EngineYard (not based on AWS, but on their own hosting platform, while sharing the RoR approach to managing cloud infrastructure), we see the beginnings of one significant toolchain. And you can already see that many of these companies are building into their promise the idea of independence from any cloud infrastructure vendor.

   In short, if Amazon intends to gain lock-in and true competitive advantage (other than the aforementioned advantage of being the low-cost provider), expect to see them roll out their own more advanced APIs and developer tools, or acquire promising startups building such tools. Alternatively, if current trends continue, I expect to see Amazon as a kind of foundation for a Linux-like aggregation of applications, tools and services not controlled by Amazon, rather than for a Microsoft Windows-like API and tools play. There will be many providers of commodity infrastructure, and a constellation of competing, but largely compatible, tools vendors. Given the momentum towards open source and cloud computing, this is a likely future.

    

2. Platform as a Service. One step up from pure utility computing are platforms like Google AppEngine and Salesforce's force.com, which hide machine instances behind higher-level APIs. Porting an application from one of these platforms to another is more like porting from Mac to Windows than from one Linux distribution to another.

   The key question at this level remains: are there advantages to developers in one of these platforms from other developers being on the same platform? force.com seems to me to have some ecosystem benefits, which means that the more developers are there, the better it is for both Salesforce and other application developers. I don't see that with AppEngine. What's more, many of the applications being deployed there seem trivial compared to the substantial applications being deployed on the Amazon and force.com platforms. One question is whether that's because developers are afraid of Google, or because the APIs that Google has provided don't give enough control and ownership for serious applications. I'd love your thoughts on this subject.

    

3. Cloud-based end-user applications. Any web application is a cloud application in the sense that it resides in the cloud. Google, Amazon, Facebook, twitter, flickr, and virtually every other Web 2.0 application is a cloud application in this sense. However, it seems to me that people use the term "cloud" more specifically in describing web applications that were formerly delivered locally on a PC, like spreadsheets, word processing, databases, and even email. Thus even though they may reside on the same server farm, people tend to think of gmail or Google docs and spreadsheets as "cloud applications" in a way that they don't think of Google search or Google maps.

   This common usage points up a meaningful difference: people tend to think differently about cloud applications when they host individual user data. The prospect of "my" data disappearing or being unavailable is far more alarming than, for example, the disappearance of a service that merely hosts an aggregated view of data that is available elsewhere (say Yahoo! search or Microsoft live maps.) And that, of course, points us squarely back into the center of the Web 2.0 proposition: that users add value to the application by their use of it. Take that away, and you're a step back in the direction of commodity computing.

   Ideally, the user's data becomes more valuable because it is in the same space as other users' data. This is why a listing on craigslist or ebay is more powerful than a listing on an individual blog, why a listing on amazon is more powerful than a listing on Joe's bookstore, why a listing on the first results page of Google's search engine, or an ad placed into the Google ad auction, is more valuable than similar placement on Microsoft or Yahoo!. This is also why every social network is competing to build its own social graph rather than relying on a shared social graph utility.

   This top level of cloud computing definitely has network effects. If I had to place a bet, it would be that the application-level developer ecosystems eventually work their way back down the stack towards the infrastructure level, and the two meet in the middle. In fact, you can argue that that's what force.com has already done, and thus represents the shape of things. It's a platform I have a strong feeling I (and anyone else interested in the evolution of the cloud platform) ought to be paying more attention to.

4. The Law of Conservation of Attractive Profits

   A lot of my thinking about web 2.0 grew directly out of my thinking about open source. My argument in The Open Source Paradigm Shift was that what we learned from the history of the IBM personal computer -- a commodity platform built from off-the-shelf parts -- was that it drained value out of the hardware ecosystem, turning it into a low-margin business. But profits didn't go away. Instead, through something that Clayton Christensen calls "the law of conservation of attractive profits," value migrated elsewhere, from hardware to software, from IBM to Microsoft. Christensen:

To read the entire article.... Web 2.0 and Cloud Computing

Posted by Michael Corey CEO & Founder Ntirety

www.ntirety.com

Its Amazing what people think of. Here are 10 Gadgets that will bring you pleasure and guess what they are not X-Rated. My favorite was the Hug Machine….

GIZMODO

10 Gadgets That Provide Perpetual Pleasure

By Sean Fallon

Hug Machine: Everyone needs a hug now and then. Unfortunately, not everyone knows someone willing to fulfill that need. The Hug Machine (or Squeeze Box) is designed to help hypersensitive people (usually autistic) relax by applying deep pressure. The users lies, or squats between the boards and controls an air compressor that "applys deep pressure stimulation evenly across the lateral parts of the body." [Wikipedia]

The Hug Vest: Basically, the Hug Vest is a portable, wearable version of the hug machine. Users can inflate air bladders within the vest at a push of a button to simulate the feeling of a hug. [Theraputicsystems]

Endless Banana: Do you find the act of peeling a banana pleasurable? Me neither, but the Japanese do apparently. That is why they created a toy that simulates the experience—right down to the sound. That's right...the SOUND. Actress Saki Fujita was assigned with the daunting task of recording what a peeling banana sounds like. [kilian-nakamura via Link]

Yes Bubble wrap was on the list. This was a great article. To see the entire article on GOZMODO....

10 Gadgets That Provide Perpetual Pleasure 10 Gadgets That Provide Perpetual Pleasure

Posted by Michael Corey, Founder & CEO

www.ntirety.com

As you are well aware if you read my previous blog entry, Microsoft has just released a new crtical patch Microsoft Security Bulletin MS08-067 

Here are some FAQ's

What is the scope of the vulnerability?

This is a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system remotely. On Microsoft Windows 2000, Windows XP, and Windows Server 2003 systems, an attacker could exploit this vulnerability over RPC without authentication to run arbitrary code. It is possible that this vulnerability could be used in the crafting of a wormable exploit. If successfully exploited, an attacker could then install programs or view, change, or delete data; or create new accounts with full user rights.

What causes the vulnerability? 

The vulnerability is caused by the Windows Server service not properly handling specially crafted RPC requests.

What is the Server service? 

The Server service provides RPC support, file and print support, and named pipe sharing over the network. The Server service allows the sharing of your local resources (such as disks and printers) so that other users on the network can access them. It also allows named pipe communication between applications running on other computers and your computer, which is used for RPC.

What is RPC? 

Remote Procedure Call (RPC) is a protocol that a program can use to request a service from a program located on another computer in a network. RPC helps with interoperability because the program using RPC does not have to understand the network protocols that are supporting communication. In RPC, the requesting program is the client and the service-providing program is the server.

What might an attacker use the vulnerability to do? 

 An attacker who successfully exploited this vulnerability could take complete control of the affected system.

How could an attacker exploit the vulnerability? 

An attacker could try to exploit the vulnerability by sending a specially crafted message to an affected system. On Microsoft Windows 2000, Windows XP, and Windows Server 2003 systems, any anonymous user with access to the target network could deliver a specially crafted network packet to the affected system in order to exploit this vulnerability. On Windows Vista and Windows Server 2008 systems, however, only an authenticated user with access to the target network could deliver a specially crafted network packet to the affected system in order to exploit this vulnerability.

What systems are primarily at risk from the vulnerability?

While all workstations and servers are at risk regarding this issue, systems running Microsoft Windows 2000, Windows XP, or Windows Server 2003 are primarily at risk due to the unique characteristics of the vulnerability and affected code path.

What does the update do? 

The update addresses the vulnerability by correcting the manner in which the Server service handles RPC requests.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 

Yes. Microsoft is aware of limited, targeted attacks attempting to exploit the vulnerability. However, when the security bulletin was released, Microsoft had not seen any examples of proof of concept code published.

Does applying this security update help protect customers from the code that attempts to exploit this vulnerability? 

Yes. This security update addresses the vulnerability that is currently being exploited. The vulnerability that has been addressed has been assigned the Common Vulnerability and Exposure number. CVE-2008-4250

Here are some additional resources you should be aware of.......

Full bulletin for MS08-067 is available at

File information details can be found in

Microsoft Knowledge Base Article 958644

 ******

Security Updates Are Available from...

Office Update

Microsoft Update

Windows Update
 

Microsoft TechNet Security TechCenter as a source of security information:

Security updates are also available from

the Microsoft Download Center

Microsoft Baseline Security Analyzer

Microsoft Baseline Security Analyzer

Note this was updated from original Post

Posted by Michael Corey, Founder & CEO

www.ntirety.com

Vulnerability in Server Service Could Allow Remote Code Execution (958644)

Version: 1.0

General Information

Executive Summary

Thissecurity update resolves a privately reported vulnerability in theServer service. The vulnerability could allow remote code execution ifan affected system received a specially crafted RPC request. OnMicrosoft Windows 2000, Windows XP, and Windows Server 2003 systems, anattacker could exploit this vulnerability without authentication to runarbitrary code. It is possible that this vulnerability could be used inthe crafting of a wormable exploit. Firewall best practices andstandard default firewall configurations can help protect networkresources from attacks that originate outside the enterprise perimeter.

Thissecurity update is rated Critical for all supported editions ofMicrosoft Windows 2000, Windows XP, Windows Server 2003, and ratedImportant for all supported editions of Windows Vista and WindowsServer 2008. For more information, see the subsection, Affected and Non-Affected Software, in this section.

Thesecurity update addresses the vulnerability by correcting the way thatthe Server service handles RPC requests. For more information about thevulnerability, see the Frequently Asked Questions (FAQ) subsection forthe specific vulnerability entry under the next section, Vulnerability Information.

Recommendation. Microsoft recommends that customers apply the update immediately.

Known Issues. None

Top of section

Affected and Non-Affected Software

Thefollowing software have been tested to determine which versions oreditions are affected. Other versions or editions are either past theirsupport life cycle or are not affected. To determine the support lifecycle for your software version or edition, visit Microsoft Support Lifecycle.

Affected Software

Operating System	Maximum Security Impact	Aggregate Severity Rating	Bulletins Replaced by this Update
Microsoft Windows 2000 Service Pack 4	Remote Code Execution	Critical	MS06-040
Windows XP Service Pack 2	Remote Code Execution	Critical	MS06-040
Windows XP Service Pack 3	Remote Code Execution	Critical	None
Windows XP Professional x64 Edition	Remote Code Execution	Critical	MS06-040
Windows XP Professional x64 Edition Service Pack 2	Remote Code Execution	Critical	None
Windows Server 2003 Service Pack 1	Remote Code Execution	Critical	MS06-040
Windows Server 2003 Service Pack 2	Remote Code Execution	Critical	None
Windows Server 2003 x64 Edition	Remote Code Execution	Critical	MS06-040
Windows Server 2003 x64 Edition Service Pack 2	Remote Code Execution	Critical	None
Windows Server 2003 with SP1 for Itanium-based Systems	Remote Code Execution	Critical	MS06-040
Windows Server 2003 with SP2 for Itanium-based Systems	Remote Code Execution	Critical	None
Windows Vista and Windows Vista Service Pack 1	Remote Code Execution	Important	None
Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1	Remote Code Execution	Important	None
Windows Server 2008 for 32-bit Systems*	Remote Code Execution	Important	None
Windows Server 2008 for x64-based Systems*	Remote Code Execution	Important	None
Windows Server 2008 for Itanium-based Systems	Remote Code Execution	Important	None

*Windows Server 2008 server core installation affected.For supported editions of Windows Server 2008, this update applies,with the same severity rating, whether or not Windows Server 2008 wasinstalled using the Server Core installation option. For moreinformation on this installation option, see Server Core. Note that the Server Core installation option does not apply to certain editions of Windows Server 2008; see Compare Server Core Installation Options.

Top of section

Frequently Asked Questions (FAQ) Related to This Security Update

Where are the file information details? 
The file information details can be found in Microsoft Knowledge Base Article 958644.

Is the Windows 7 Pre-Beta release affected by this vulnerability?
Yes.This vulnerability was reported after the release of Windows 7Pre-Beta. Customers running Windows 7 Pre-Beta are encouraged todownload and apply the update to their systems. On Windows 7 Pre-Betasystems, the vulnerable code path is only accessible to authenticatedusers. This vulnerability is not liable to be triggered if the attackeris not authenticated, and therefore would be rated Important.

Security updates are available from Microsoft Update, Windows Update, and Office Update. Security updates are also available from the Microsoft Download Center. You can find them most easily by doing a keyword search for "security update."

I am using an older release of the software discussed in this security bulletin. What should I do? 
Theaffected software listed in this bulletin have been tested to determinewhich releases are affected. Other releases are past their support lifecycle. To determine the support life cycle for your software release,visit Microsoft Support Lifecycle.

Itshould be a priority for customers who have older releases of thesoftware to migrate to supported releases to prevent potential exposureto vulnerabilities. For more information about the Windows ProductLifecycle, visit Microsoft Support Lifecycle. For more information about the extended security update support period for these software versions or editions, visit Microsoft Product Support Services.

Customerswho require custom support for older releases must contact theirMicrosoft account team representative, their Technical Account Manager,or the appropriate Microsoft partner representative for custom supportoptions. Customers without an Alliance, Premier, or Authorized Contractcan contact their local Microsoft sales office. For contactinformation, visit Microsoft Worldwide Information, select the country, and then click Goto see a list of telephone numbers. When you call, ask to speak withthe local Premier Support sales manager. For more information, see the Windows Operating System Product Support Lifecycle FAQ.

Top of section

Vulnerability Information

Severity Ratings and Vulnerability Identifiers

Vulnerability Severity Rating and Maximum Security Impact by Affected Software
Affected Software	Server Service Vulnerability - CVE-2008-4250	Aggregate Severity Rating
Microsoft Windows 2000 Service Pack 4	Critical Remote Code Execution	Critical
Windows XP Service Pack 2 and Windows XP Service Pack 3	Critical Remote Code Execution	Critical
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2	Critical Remote Code Execution	Critical
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2	Critical Remote Code Execution	Critical
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2	Critical Remote Code Execution	Critical
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems	Critical Remote Code Execution	Critical
Windows Vista and Windows Vista Service Pack 1	Important Remote Code Execution	Important
Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1	Important Remote Code Execution	Important
Windows Server 2008 for 32-bit Systems*	Important Remote Code Execution	Important
Windows Server 2008 for x64-based Systems*	Important Remote Code Execution	Important
Windows Server 2008 for Itanium-based Systems	Important Remote Code Execution	Important

*Windows Server 2008 server core installation affected.For supported editions of Windows Server 2008, this update applies,with the same severity rating, whether or not Windows Server 2008 wasinstalled using the Server Core installation option. For moreinformation on this installation option, see Server Core. Note that the Server Core installation option does not apply to certain editions of Windows Server 2008; see Compare Server Core Installation Options.

Top of section

Server Service Vulnerability - CVE-2008-4250

Aremote code execution vulnerability exists in the Server service onWindows systems. The vulnerability is due to the service not properlyhandling specially crafted RPC requests. An attacker who successfullyexploited this vulnerability could take complete control of an affectedsystem.

To view this vulnerability as a standard entry in the Common Vulnerabilities and Exposures list, see CVE-2008-4250.

Mitigating Factors for Server Service Vulnerability - CVE-2008-4250

Mitigationrefers to a setting, common configuration, or general best-practice,existing in a default state, that could reduce the severity ofexploitation of a vulnerability. The following mitigating factors maybe helpful in your situation:

•	Firewallbest practices and standard default firewall configurations can helpprotect network resources from attacks that originate outside theenterprise perimeter. Best practices recommend that systems that areconnected to the Internet have a minimal number of ports exposed.
•	OnWindows Vista and Windows Server 2008, the vulnerable code path is onlyaccessible to authenticated users. This vulnerability is not liable tobe triggered if the attacker is not authenticated.

Top of section

Workarounds for Server Service Vulnerability - CVE-2008-4250

Workaroundrefers to a setting or configuration change that does not correct theunderlying vulnerability but would help block known attack vectorsbefore you apply the update. Microsoft has tested the followingworkarounds and states in the discussion whether a workaround reducesfunctionality:

•

Disable the Server and Computer Browser services Disablingthe Computer Browser and Server service on the affected systems willhelp protect systems from remote attempts to exploit this vulnerability. You can disable these services by using the following steps: 1. Click Start, and then click Control Panel (or point to Settings and then click Control Panel). 2. Double-click Administrative Tools. 3. Double-click Services. 4. Double-click Computer Browser Service. 5. In the Startup type list, click Disabled. 6. Click Stop, and then click OK. 7. Repeat steps 4-6 for the Server service Impact of Workaround.If the Computer Browser service is disabled, any services thatexplicitly depend on the Computer Browser service may log an errormessage in the system event log. For more information about theComputer Browser service, see Microsoft Knowledge Base Article 188001.If the Server service is disabled, you will not be able to share filesor printers from your computer. However, you will still be able to viewand use file shares and printer resources on other systems. How to undo the workaround. You can enable these services by using the following steps: 1. Click Start, and then click Control Panel (or point to Settings, and then click Control Panel). 2. Double-click Administrative Tools. 3. Double-click Services. 4. Double-click Computer Browser Service. 5. In the Startup type list, click Automatic. 6. Click Start, and then click OK. 7. Repeat steps 4-6 for the Server service

•	On Windows Vista and Windows Server 2008, filter the affected RPC identifier Inaddition to blocking ports with the Windows Firewall, the Windows Vistaand Windows Server 2008 editions can selectively filter RPC UniversallyUnique Identifiers (UUID). To prevent this vulnerability, add a rulethat blocks all RPC requests with the UUID equal to4b324fc8-1670-01d3-1278-5a47bf6ee188. This is accomplished through thenetwork shell. To access the network shell, run the following commandfrom an elevated command prompt: netsh Once in the netsh environment, enter the following commands: netsh>rpcnetsh rpc>filternetsh rpc filter>add rule layer=um actiontype=blocknetsh rpc filter>add condition field=if_uuid matchtype=equal data=4b324fc8-1670-01d3-1278-5a47bf6ee188netsh rpc filter>add filternetsh rpc filter>quit The Filter Key is a randomly generated UUID specific to eachsystem. To confirm the filter is in place, run the following commandfrom an elevated command prompt: netsh rpc filter show filter If the commands are successful, the system displays the following information: Listing all RPC Filters.---------------------------------filterKey: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxdisplayData.name: RPCFilterdisplayData.description: RPC FilterfilterId: 0x12f79layerKey: umweight: Type: FWP_EMPTY Value: Emptyaction.type: blocknumFilterConditions: 1 Where filterKey: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx equates to the randomly generated UUID relevant to your system. Impact of workaround.Certain applications that rely on the Microsoft Server Message Block(SMB) Protocol may not function as intended. However, you will still beable to view and use file shares and printer resources on other systems. How to undo the workaround. Run the following command from an elevated command prompt: netsh rpc filter delete filter xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Where filterKey: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx equates to the randomly generated UUID relevant to your system.
•	Block TCP ports 139 and 445 at the firewall Theseports are used to initiate a connection with the affected component.Blocking TCP ports 139 and 445 at the firewall will help protectsystems that are behind that firewall from attempts to exploit thisvulnerability. Microsoft recommends that you block all unsolicitedinbound communication from the Internet to help prevent attacks thatmay use other ports. For more information about ports, see TCP and UDP Port Assignments. Impact of workaround.Several Windows services use the affected ports. Blocking connectivityto the ports may cause various applications or services to notfunction. Some of the applications or services that could be impactedare listed below: • Applications that use SMB (CIFS) • Applications that use mailslots or named pipes (RPC over SMB) • Server (File and Print Sharing) • Group Policy • Net Logon • Distributed File System (DFS) • Terminal Server Licensing • Print Spooler • Computer Browser • Remote Procedure Call Locator • Fax Service • Indexing Service • Performance Logs and Alerts • Systems Management Server • License Logging Service
•	Tohelp protect from network-based attempts to exploit this vulnerability,use a personal firewall, such as the Internet Connection Firewall All supported editions of Windows Vista come with Windows Firewall, a two-way firewall that is automatically enabled. Forall supported editions of Windows XP and Windows Server 2003, use theInternet Connection Firewall feature to help protect your Internetconnection by blocking unsolicited incoming traffic. Microsoftrecommends that you block all unsolicited incoming communication fromthe Internet. In Windows XP Service Pack 2 and Windows XP Service Pack3, this feature is called the Windows Firewall. By default, theWindows Firewall feature in Windows XP helps protect your Internetconnection by blocking unsolicited incoming traffic. We recommend thatyou block all unsolicited incoming communication from the Internet. To enable the Windows Firewall feature by using the Network Setup Wizard, follow these steps: 1. Click Start, and then click Control Panel. 2. Double-click Network Connections and then click Change Windows Firewall Settings. 3. On the General tab, ensure that the On (recommended) value is selected. This will enable the Windows Firewall. 4. Once the Windows Firewall is enabled, select Don’t allow exceptions to prohibit all incoming traffic. For Windows Server 2003 systems, configure Internet Connection Firewall manually for a connection using the following steps: 1. Click Start, and then click Control Panel. 2. In the default Category View, click Networking and Internet Connections, and then click Network Connections. 3. Right-click the connection on which you want to enable Internet Connection Firewall, and then click Properties. 4. Click the Advanced tab. 5. Click to select the Protect my computer or network by limiting or preventing access to this computer from the Internet check box, and then click OK. Note If you want to enable certain programs and services to communicate through the firewall, click Settings on the Advanced tab, and then select the programs, the protocols, and the services that are required.

Top of section

FAQ for Server Service Vulnerability - CVE-2008-4250

What is the scope of the vulnerability? 
Thisis a remote code execution vulnerability. An attacker who successfullyexploited this vulnerability could take complete control of an affectedsystem remotely. On Microsoft Windows 2000, Windows XP, and WindowsServer 2003 systems, an attacker could exploit this vulnerability overRPC without authentication to run arbitrary code. It is possible thatthis vulnerability could be used in the crafting of a wormable exploit.If successfully exploited, an attacker could then install programs orview, change, or delete data; or create new accounts with full userrights.

What causes the vulnerability? 
The vulnerability is caused by the Windows Server service not properly handling specially crafted RPC requests.

What is the Server service? 
TheServer service provides RPC support, file and print support, and namedpipe sharing over the network. The Server service allows the sharing ofyour local resources (such as disks and printers) so that other userson the network can access them. It also allows named pipe communicationbetween applications running on other computers and your computer,which is used for RPC.

What is RPC? 
Remote ProcedureCall (RPC) is a protocol that a program can use to request a servicefrom a program located on another computer in a network. RPC helps withinteroperability because the program using RPC does not have tounderstand the network protocols that are supporting communication. InRPC, the requesting program is the client and the service-providingprogram is the server.

What might an attacker use the vulnerability to do? 
An attacker who successfully exploited this vulnerability could take complete control of the affected system.

How could an attacker exploit the vulnerability? 
Anattacker could try to exploit the vulnerability by sending a speciallycrafted message to an affected system. On Microsoft Windows 2000,Windows XP, and Windows Server 2003 systems, any anonymous user withaccess to the target network could deliver a specially crafted networkpacket to the affected system in order to exploit this vulnerability.On Windows Vista and Windows Server 2008 systems, however, only anauthenticated user with access to the target network could deliver aspecially crafted network packet to the affected system in order toexploit this vulnerability.

What systems are primarily at risk from the vulnerability? 
Whileall workstations and servers are at risk regarding this issue, systemsrunning Microsoft Windows 2000, Windows XP, or Windows Server 2003 areprimarily at risk due to the unique characteristics of thevulnerability and affected code path.

What does the update do? 
The update addresses the vulnerability by correcting the manner in which the Server service handles RPC requests.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
Yes.Microsoft is aware of limited, targeted attacks attempting to exploitthe vulnerability. However, when the security bulletin was released,Microsoft had not seen any examples of proof of concept code published.

Does applying this security update help protect customers from the code that attempts to exploit this vulnerability? 
Yes.This security update addresses the vulnerability that is currentlybeing exploited. The vulnerability that has been addressed has beenassigned the Common Vulnerability and Exposure number CVE-2008-4250.

Top of section

Top of section

Update Information

Detection and Deployment Tools and Guidance

Managethe software and security updates you need to deploy to the servers,desktop, and mobile systems in your organization. For more informationsee the TechNet Update Management Center. The Microsoft TechNet Security Web site provides additional information about security in Microsoft products.

Security updates are available from Microsoft Update, Windows Update, and Office Update. Security updates are also available from the Microsoft Download Center. You can find them most easily by doing a keyword search for "security update."

Finally, security updates can be downloaded from the Microsoft Update Catalog.The Microsoft Update Catalog provides a searchable catalog of contentmade available through Windows Update and Microsoft Update, includingsecurity updates, drivers and service packs. By searching using thesecurity bulletin number (such as, “MS07-036”), you can add all of theapplicable updates to your basket (including different languages for anupdate), and download to the folder of your choosing. For moreinformation about the Microsoft Update Catalog, see the Microsoft Update Catalog FAQ.

Detection and Deployment Guidance

Microsofthas provided detection and deployment guidance for this month’ssecurity updates. This guidance will also help IT professionalsunderstand how they can use various tools to help deploy the securityupdate, such as Windows Update, Microsoft Update, Office Update, theMicrosoft Baseline Security Analyzer (MBSA), the Office Detection Tool,Microsoft Systems Management Server (SMS), and the Extended SecurityUpdate Inventory Tool. For more information, see Microsoft Knowledge Base Article 910723.

Microsoft Baseline Security Analyzer

MicrosoftBaseline Security Analyzer (MBSA) allows administrators to scan localand remote systems for missing security updates as well as commonsecurity misconfigurations. For more information about MBSA, visit Microsoft Baseline Security Analyzer.

The following table provides the MBSA detection summary for this security update.

Software	MBSA 2.1
Microsoft Windows 2000 Service Pack 4	Yes
Windows XP Service Pack 2 and Windows XP Service Pack 3	Yes
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2	Yes
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2	Yes
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2	Yes
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems	Yes
Windows Vista and Windows Vista Service Pack 1	Yes
Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1	Yes
Windows Server 2008 for 32-bit Systems	Yes
Windows Server 2008 for x64-based Systems	Yes
Windows Server 2008 for Itanium-based Systems	Yes

For more information about MBSA 2.1, see MBSA 2.1 Frequently Asked Questions.

Windows Server Update Services

Byusing Windows Server Update Services (WSUS), administrators can deploythe latest critical updates and security updates for Microsoft Windows2000 operating systems and later, Office XP and later, Exchange Server2003, and SQL Server 2000. For more information about how to deploythis security update using Windows Server Update Services, visit the Windows Server Update Services Web site.

Systems Management Server

The following table provides the SMS detection and deployment summary for this security update.

Software	SMS 2.0	SMS 2003 with SUSFP	SMS 2003 with ITMU	Configuration Manager 2007
Microsoft Windows 2000 Service Pack 4	Yes	Yes	Yes	Yes
Windows XP Service Pack 2 and Windows XP Service Pack 3	Yes	Yes	Yes	Yes
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2	No	No	Yes	Yes
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2	Yes	Yes	Yes	Yes
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2	No	No	Yes	Yes
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems	No	No	Yes	Yes
Windows Vista and Windows Vista Service Pack 1	No	No	See Note for Windows Vista and Windows Server 2008 below	Yes
Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1	No	No	See Note for Windows Vista and Windows Server 2008 below	Yes
Windows Server 2008 for 32-bit Systems	No	No	See Note for Windows Vista and Windows Server 2008 below	Yes
Windows Server 2008 for x64-based Systems	No	No	See Note for Windows Vista and Windows Server 2008 below	Yes
Windows Server 2008 for Itanium-based Systems	No	No	See Note for Windows Vista and Windows Server 2008 below	Yes

ForSMS 2.0 and SMS 2003, the SMS SUS Feature Pack (SUSFP), which includesthe Security Update Inventory Tool (SUIT), can be used by SMS to detectsecurity updates. See also Downloads for Systems Management Server 2.0.

ForSMS 2003, the SMS 2003 Inventory Tool for Microsoft Updates (ITMU) canbe used by SMS to detect security updates that are offered by Microsoft Update and that are supported by Windows Server Update Services. For more information about the SMS 2003 ITMU, see SMS 2003 Inventory Tool for Microsoft Updates.SMS 2003 can also use the Microsoft Office Inventory Tool to detectrequired updates for Microsoft Office applications. For moreinformation about the Office Inventory Tool and other scanning tools,see SMS 2003 Software Update Scanning Tools. See also Downloads for Systems Management Server 2003.

SystemCenter Configuration Manager 2007 uses WSUS 3.0 for detection ofupdates. For more information about Configuration Manager 2007 SoftwareUpdate Management, visit System Center Configuration Manager 2007.

Note for Windows Vista and Windows Server 2008 MicrosoftSystems Management Server 2003 with Service Pack 3 includes support forWindows Vista and Windows Server 2008 manageability.

For more information about SMS, visit the SMS Web site.

For more detailed information, see Microsoft Knowledge Base Article 910723: Summary list of monthly detection and deployment guidance articles.

Update Compatibility Evaluator and Application Compatibility Toolkit

Updatesoften write to the same files and registry settings required for yourapplications to run. This can trigger incompatibilities and increasethe time it takes to deploy security updates. You can streamlinetesting and validating Windows updates against installed applicationswith the Update Compatibility Evaluator components included with Application Compatibility Toolkit 5.0.

TheApplication Compatibility Toolkit (ACT) contains the necessary toolsand documentation to evaluate and mitigate application compatibilityissues before deploying Microsoft Windows Vista, a Windows Update, aMicrosoft Security Update, or a new version of Windows InternetExplorer in your environment.

Top of section

Security Update Deployment

Affected Software

For information about the specific security update for your affected software, click the appropriate link:

Windows 2000 (all editions)

Reference Table

Thefollowing table contains the security update information for thissoftware. You can find additional information in the subsection, Deployment Information, in this section.

Inclusion in Future Service Packs	The update for this issue may be included in a future update rollup
Deployment
Installing without user intervention	Microsoft Windows 2000 Service Pack 4: Windows2000-kb958644-x86-enu /quiet
Installing without restarting	Microsoft Windows 2000 Service Pack 4: Windows2000-kb958644-x86-enu /norestart
Update log file	Microsoft Windows 2000 Service Pack 4: kb958644.log
Further information	See the subsection, Detection and Deployment Tools and Guidance
Restart Requirement
Restart required?	Yes, you must restart your system after you apply this security update
HotPatching	Not applicable
Removal Information	Microsoft Windows 2000 Service Pack 4: UseAdd or Remove Programs tool in Control Panel or the Spuninst.exeutility located in the %Windir%\$NTUninstallKB958644$\Spuninst folder
File Information	See Microsoft Knowledge Base Article 958644
Registry Key Verification	Microsoft Windows 2000 Service Pack 4:  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows 2000\SP5\KB958644\Filelist

Deployment Information

Installing the Update

Whenyou install this security update, the installer checks whether one ormore of the files that are being updated on your system have previouslybeen updated by a Microsoft hotfix.

If you have previouslyinstalled a hotfix to update one of these files, the installer copiesthe RTMQFE, SP1QFE, or SP2QFE files to your system. Otherwise, theinstaller copies the RTMGDR, SP1GDR, or SP2GDR files to your system.Security updates may not contain all variations of these files. Formore information about this behavior, see Microsoft Knowledge Base Article 824994.

For more information about the installer, visit the Microsoft TechNet Web site.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Supported Security Update Installation Switches
Switch	Description
/help	Displays the command-line options.
Setup Modes
/passive	UnattendedSetup mode. No user interaction is required, but installation status isdisplayed. If a restart is required at the end of Setup, a dialog boxwill be presented to the user with a timer warning that the computerwill restart in 30 seconds.
/quiet	Quiet mode. This is the same as unattended mode, but no status or error messages are displayed.
Restart Options
/norestart	Does not restart when installation has completed.
/forcerestart	Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x]	Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart	Displays a dialog box prompting the local user to allow a restart.
Special Options
/overwriteoem	Overwrites OEM files without prompting.
/nobackup	Does not back up files needed for uninstall.
/forceappsclose	Forces other programs to close when the computer shuts down.
/log:path	Allows the redirection of installation log files.
/extract[:path]	Extracts files without starting the Setup program.
/ER	Enables extended error reporting.
/verbose	Enablesverbose logging. During installation, creates %Windir%\CabBuild.log.This log details the files that are copied. Using this switch may causethe installation to proceed more slowly.

Note Youcan combine these switches into one command. For backwardcompatibility, the security update also supports the setup switchesthat the earlier version of the Setup program uses. For moreinformation about the supported installation switches, see Microsoft Knowledge Base Article 262841.

Removing the Update

This security update supports the following setup switches.

Supported Spuninst.exe Switches
Switch	Description
/help	Displays the command-line options.
Setup Modes
/passive	UnattendedSetup mode. No user interaction is required, but installation status isdisplayed. If a restart is required at the end of Setup, a dialog boxwill be presented to the user with a timer warning that the computerwill restart in 30 seconds.
/quiet	Quiet mode. This is the same as unattended mode, but no status or error messages are displayed.
Restart Options
/norestart	Does not restart when installation has completed.
/forcerestart	Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x]	Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart	Displays a dialog box prompting the local user to allow a restart.
Special Options
/forceappsclose	Forces other programs to close when the computer shuts down.
/log:path	Allows the redirection of installation log files.

Verifying That the Update Has Been Applied

•

Microsoft Baseline Security Analyzer Toverify that a security update has been applied to an affected system,you may be able to use the Microsoft Baseline Security Analyzer (MBSA)tool. See the section, Detection and Deployment Tools and Guidance, earlier in this bulletin for more information.

•

File Version Verification Becausethere are several editions of Microsoft Windows, the following stepsmay be different on your system. If they are, see your productdocumentation to complete these steps. 1. Click Start, and then click Search. 2. In the Search Results pane, click All files and folders under Search Companion. 3. In the All or part of the file name box, type a file name from the appropriate file information table, and then click Search. 4. In the list of files, right-click a file name from the appropriate file information table, and then click Properties. NoteDepending on the edition of the operating system, or the programs thatare installed on your system, some of the files that are listed in thefile information table may not be installed. 5. On the Versiontab, determine the version of the file that is installed on your systemby comparing it to the version that is documented in the appropriatefile information table. Note Attributes other than thefile version may change during installation. Comparing other fileattributes to the information in the file information table is not asupported method of verifying that the update has been applied. Also,in certain cases, files may be renamed during installation. If the fileor version information is not present, use one of the other availablemethods to verify update installation.

•

Registry Key Verification You may also be able to verify the files that this security update has installed by reviewing the registry keys listed in the Reference Table in this section. Theseregistry keys may not contain a complete list of installed files. Also,these registry keys may not be created correctly when an administratoror an OEM integrates or slipstreams this security update into theWindows installation source files.

Top of section

Top of section

Windows XP (all editions)

Reference Table

Thefollowing table contains the security update information for thissoftware. You can find additional information in the subsection, Deployment Information, in this section.

Inclusion in Future Service Packs	The update for this issue will be included in a future service pack or update rollup
Deployment
Installing without user intervention	Windows XP Service Pack 2 and Windows XP Service Pack 3: Windowsxp-kb958644-x86-enu /quiet
	Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2: WindowsServer2003.WindowsXP-kb958644-x64-enu /quiet
Installing without restarting	Windows XP Service Pack 2 and Windows XP Service Pack 3: Windowsxp-kb958644-x86-enu /norestart
	Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2: WindowsServer2003.WindowsXP-kb958644-x64-enu /norestart
Update log file	KB958644.log
Further information	See the subsection, Detection and Deployment Tools and Guidance
Restart Requirement
Restart required?	Yes, you must restart your system after you apply this security update
HotPatching	Not applicable
Removal Information	UseAdd or Remove Programs tool in Control Panel or the Spuninst.exeutility located in the %Windir%\$NTUninstallKB958644$\Spuninst folder
File Information	See Microsoft Knowledge Base Article 958644
Registry Key Verification	Windows XP Service Pack 2 and Windows XP Service Pack 3: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP4\KB958644\Filelist
	Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP Version 2003\SP3\KB958644\Filelist

NoteFor supported versions of Windows XP Professional x64 Edition, thissecurity update is the same as supported versions of the Windows Server2003 x64 Edition security update.

Deployment Information

Installing the Update

Whenyou install this security update, the installer checks whether one ormore of the files that are being updated on your system have previouslybeen updated by a Microsoft hotfix.

If you have previouslyinstalled a hotfix to update one of these files, the installer copiesthe RTMQFE, SP1QFE, or SP2QFE files to your system. Otherwise, theinstaller copies the RTMGDR, SP1GDR, or SP2GDR files to your system.Security updates may not contain all variations of these files. Formore information about this behavior, see Microsoft Knowledge Base Article 824994.

For more information about the installer, visit the Microsoft TechNet Web site.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Supported Security Update Installation Switches
Switch	Description
/help	Displays the command-line options.
Setup Modes
/passive	UnattendedSetup mode. No user interaction is required, but installation status isdisplayed. If a restart is required at the end of Setup, a dialog boxwill be presented to the user with a timer warning that the computerwill restart in 30 seconds.
/quiet	Quiet mode. This is the same as unattended mode, but no status or error messages are displayed.
Restart Options
/norestart	Does not restart when installation has completed.
/forcerestart	Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x]	Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart	Displays a dialog box prompting the local user to allow a restart.
Special Options
/overwriteoem	Overwrites OEM files without prompting.
/nobackup	Does not back up files needed for uninstall.
/forceappsclose	Forces other programs to close when the computer shuts down.
/log:path	Allows the redirection of installation log files.
/integrate:path	Integrates the update into the Windows source files. These files are located at the path that is specified in the switch.
/extract[:path]	Extracts files without starting the Setup program.
/ER	Enables extended error reporting.
/verbose	Enablesverbose logging. During installation, creates %Windir%\CabBuild.log.This log details the files that are copied. Using this switch may causethe installation to proceed more slowly.

Note Youcan combine these switches into one command. For backwardcompatibility, the security update also supports the setup switchesthat the earlier version of the Setup program uses. For moreinformation about the supported installation switches, see Microsoft Knowledge Base Article 262841.

Removing the Update

This security update supports the following setup switches.

Supported Spuninst.exe Switches
Switch	Description
/help	Displays the command-line options.
Setup Modes
/passive	UnattendedSetup mode. No user interaction is required, but installation status isdisplayed. If a restart is required at the end of Setup, a dialog boxwill be presented to the user with a timer warning that the computerwill restart in 30 seconds.
/quiet	Quiet mode. This is the same as unattended mode, but no status or error messages are displayed.
Restart Options
/norestart	Does not restart when installation has completed
/forcerestart	Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x]	Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart	Displays a dialog box prompting the local user to allow a restart.
Special Options
/forceappsclose	Forces other programs to close when the computer shuts down.
/log:path	Allows the redirection of installation log files.

Verifying That the Update Has Been Applied

•

Microsoft Baseline Security Analyzer Toverify that a security update has been applied to an affected system,you may be able to use the Microsoft Baseline Security Analyzer (MBSA)tool. See the section, Detection and Deployment Tools and Guidance, earlier in this bulletin for more information.

•

File Version Verification Becausethere are several editions of Microsoft Windows, the following stepsmay be different on your system. If they are, see your productdocumentation to complete these steps. 1. Click Start, and then click Search. 2. In the Search Results pane, click All files and folders under Search Companion. 3. In the All or part of the file name box, type a file name from the appropriate file information table, and then click Search. 4. In the list of files, right-click a file name from the appropriate file information table, and then click Properties. NoteDepending on the edition of the operating system, or the programs thatare installed on your system, some of the files that are listed in thefile information table may not be installed. 5. On the Versiontab, determine the version of the file that is installed on your systemby comparing it to the version that is documented in the appropriatefile information table. Note Attributes other than thefile version may change during installation. Comparing other fileattributes to the information in the file information table is not asupported method of verifying that the update has been applied. Also,in certain cases, files may be renamed during installation. If the fileor version information is not present, use one of the other availablemethods to verify update installation.

•

Registry Key Verification You may also be able to verify the files that this security update has installed by reviewing the registry keys listed in the Reference Table in this section. Theseregistry keys may not contain a complete list of installed files. Also,these registry keys may not be created correctly when an administratoror an OEM integrates or slipstreams this security update into theWindows installation source files.

Top of section

Top of section

Windows Server 2003 (all editions)

Reference Table

Thefollowing table contains the security update information for thissoftware. You can find additional information in the subsection, Deployment Information, in this section.

Inclusion in Future Service Packs	The update for this issue will be included in a future service pack or update rollup
Deployment
Installing without user intervention	For all supported 32-bit editions of Windows Server 2003: Windowsserver2003-kb958644-x86-enu /quiet
	For all supported x64-based editions of Windows Server 2003: Windowsserver2003.WindowsXP-KB958644-x64-enu /quiet
	For all supported Itanium-based editions of Windows Server 2003: Windowsserver2003-KB958644-ia64-enu /quiet
Installing without restarting	For all supported 32-bit editions of Windows Server 2003: Windowsserver2003-kb958644-x86-enu /norestart
	For all supported x64-based editions of Windows Server 2003: Windowsserver2003.WindowsXP-KB958644-x64-enu /norestart
	For all supported Itanium-based editions of Windows Server 2003: Windowsserver2003-KB958644-ia64-enu /norestart
Update log file	KB958644.log
Further information	See the subsection, Detection and Deployment Tools and Guidance
Restart Requirement
Restart required?	Yes, you must restart your system after you apply this security update.
HotPatching	This security update does not support HotPatching. For more information about HotPatching, see Microsoft Knowledge Base Article 897341.
Removal Information	Use Add or Remove Programs tool in Control Panel or the Spuninst.exe utility located in the %Windir%\$NTUninstallKB958644$\Spuninst folder
File Information	See Microsoft Knowledge Base Article 958644
Registry Key Verification	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Server 2003\SP3\KB958644\Filelist

Deployment Information

Installing the Update

Whenyou install this security update, the installer checks to see if one ormore of the files that are being updated on your system have previouslybeen updated by a Microsoft hotfix.

If you have previouslyinstalled a hotfix to update one of these files, the installer copiesthe RTMQFE, SP1QFE, or SP2QFE files to your system. Otherwise, theinstaller copies the RTMGDR, SP1GDR, or SP2GDR files to your system.Security updates may not contain all variations of these files. Formore information about this behavior, see Microsoft Knowledge Base Article 824994.

For more information about the installer, visit the Microsoft TechNet Web site.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Supported Security Update Installation Switches
Switch	Description
/help	Displays the command-line options.
Setup Modes
/passive	UnattendedSetup mode. No user interaction is required, but installation status isdisplayed. If a restart is required at the end of Setup, a dialog boxwill be presented to the user with a timer warning that the computerwill restart in 30 seconds.
/quiet	Quiet mode. This is the same as unattended mode, but no status or error messages are displayed.
Restart Options
/norestart	Does not restart when installation has completed.
/forcerestart	Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x]	Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart	Displays a dialog box prompting the local user to allow a restart.
Special Options
/overwriteoem	Overwrites OEM files without prompting.
/nobackup	Does not back up files needed for uninstall.
/forceappsclose	Forces other programs to close when the computer shuts down.
/log:path	Allows the redirection of installation log files.
/integrate:path	Integrates the update into the Windows source files. These files are located at the path that is specified in the switch.
/extract[:path]	Extracts files without starting the Setup program.
/ER	Enables extended error reporting.
/verbose	Enablesverbose logging. During installation, creates %Windir%\CabBuild.log.This log details the files that are copied. Using this switch may causethe installation to proceed more slowly.

Note Youcan combine these switches into one command. For backwardcompatibility, the security update also supports many of the setupswitches that the earlier version of the Setup program uses. For moreinformation about the supported installation switches, see Microsoft Knowledge Base Article 262841.

Removing the Update

This security update supports the following setup switches.

Supported Spuninst.exe Switches
Switch	Description
/help	Displays the command-line options.
Setup Modes
/passive	UnattendedSetup mode. No user interaction is required, but installation status isdisplayed. If a restart is required at the end of Setup, a dialog boxwill be presented to the user with a timer warning that the computerwill restart in 30 seconds.
/quiet	Quiet mode. This is the same as unattended mode, but no status or error messages are displayed.
Restart Options
/norestart	Does not restart when installation has completed.
/forcerestart	Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x]	Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart	Displays a dialog box prompting the local user to allow a restart.
Special Options
/forceappsclose	Forces other programs to close when the computer shuts down.
/log:path	Allows the redirection of installation log files.

Verifying that the Update Has Been Applied

•

Microsoft Baseline Security Analyzer Toverify that a security update has been applied to an affected system,you may be able to use the Microsoft Baseline Security Analyzer (MBSA)tool. See the section, Detection and Deployment Tools and Guidance,earlier in this bulletin for more information.

•

File Version Verification Becausethere are several editions of Microsoft Windows, the following stepsmay be different on your system. If they are, see your productdocumentation to complete these steps. 1. Click Start, and then click Search. 2. In the Search Results pane, click All files and folders under Search Companion. 3. In the All or part of the file name box, type a file name from the appropriate file information table, and then click Search. 4. In the list of files, right-click a file name from the appropriate file information table, and then click Properties. NoteDepending on the edition of the operating system, or the programs thatare installed on your system, some of the files that are listed in thefile information table may not be installed. 5. On the Versiontab, determine the version of the file that is installed on your systemby comparing it to the version that is documented in the appropriatefile information table. Note Attributes other than thefile version may change during installation. Comparing other fileattributes to the information in the file information table is not asupported method of verifying that the update has been applied. Also,in certain cases, files may be renamed during installation. If the fileor version information is not present, use one of the other availablemethods to verify update installation.

•

Registry Key Verification You may also be able to verify the files that this security update has installed by reviewing the registry keys listed in the Reference Table in this section. Theseregistry keys may not contain a complete list of installed files. Also,these registry keys may not be created correctly when an administratoror an OEM integrates or slipstreams this security update into theWindows installation source files.

Top of section

Top of section

Windows Vista (all editions)

Reference Table

Thefollowing table contains the security update information for thissoftware. You can find additional information in the subsection, Deployment Information, in this section.

Inclusion in Future Service Packs	The update for this issue will be included in a future service pack or update rollup
Deployment
Installing without user intervention	For all supported 32-bit editions of Windows Vista: Windows6.0-KB958644-x86 /quiet For all supported x64-based editions of Windows Vista: Windows6.0-KB958644-x64 /quiet
Installing without restarting	For all supported 32-bit editions of Windows Vista: Windows6.0-KB958644-x86 /quiet /norestart For all supported x64-based editions of Windows Vista: Windows6.0-KB958644-x64 /quiet /norestart
Further information	See the subsection, Detection and Deployment Tools and Guidance
Restart Requirement
Restart required?	Yes, you must restart your system after you apply this security update
HotPatching	Not applicable
Removal Information	WUSA.exe does not support uninstall of updates. To uninstall an update installed by WUSA, click Control Panel, and then click Security. Under Windows Update, click View installed updates and select from the list of updates.
File Information	See Microsoft Knowledge Base Article 958644
Registry Key Verification	Note A registry key does not exist to validate the presence of this update.

Deployment Information

Installing the Update

Whenyou install this security update, the installer checks whether one ormore of the files that are being updated on your system have previouslybeen updated by a Microsoft hotfix.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Supported Security Update Installation Switches
Switch	Description
/?, /h, /help	Displays help on supported switches.
/quiet	Suppresses the display of status or error messages.
/norestart	When combined with /quiet, the system will not be restarted after installation even if a restart is required to complete installation.

Note For more information about the wusa.exe installer, see Microsoft Knowledge Base Article 934307.

Verifying That the Update Has Been Applied

•

Microsoft Baseline Security Analyzer Toverify that a security update has been applied to an affected system,you may be able to use the Microsoft Baseline Security Analyzer (MBSA)tool. See the section, Detection and Deployment Tools and Guidance, earlier in this bulletin for more information.

•

File Version Verification Becausethere are several editions of Microsoft Windows, the following stepsmay be different on your system. If they are, see your productdocumentation to complete these steps. 1. Click Start and then enter an update file name in Start Search. 2. When the file appears under Programs, right-click on the file name and click Properties. 3. Under the General tab, compare the file size with the file information tables provided in the bulletin KB article. 4. You may also click on the Detailstab and compare information, such as file version and date modified,with the file information tables provided in the bulletin KB article. 5. Finally, you may also click on the Previous Versionstab and compare file information for the previous version of the filewith the file information for the new, or updated, version of the file.

Top of section

Top of section

Windows Server 2008 (all editions)

Reference Table

Thefollowing table contains the security update information for thissoftware. You can find additional information in the subsection, Deployment Information, in this section.

Inclusion in Future Service Packs	The update for this issue will be included in a future service pack or update rollup
Deployment
Installing without user intervention	For all supported 32-bit editions of Windows Server 2008: Windows6.0-KB958644-x86 /quiet For all supported x64-based editions of Windows Server 2008: Windows6.0-KB958644-x64 /quiet For all supported Itanium-based editions of Windows Server 2008: Windows6.0-KB958644-ia64 /quiet
Installing without restarting	For all supported 32-bit editions of Windows Server 2008: Windows6.0-KB958644-x86 /quiet /norestart For all supported x64-based editions of Windows Server 2008: Windows6.0-KB958644-x64 /quiet /norestart For all supported Itanium-based editions of Windows Server 2008: Windows6.0-KB958644-ia64 /quiet /norestart
Further information	See the subsection, Detection and Deployment Tools and Guidance
Restart Requirement
Restart required?	Yes, you must restart your system after you apply this security update
HotPatching	Not applicable
Removal Information	WUSA.exe does not support uninstall of updates. To uninstall an update installed by WUSA, click Control Panel, and then click Security. Under Windows Update, click View installed updates and select from the list of updates.
File Information	See Microsoft Knowledge Base Article 958644
Registry Key Verification	Note A registry key does not exist to validate the presence of this update.

Deployment Information

Installing the Update

Whenyou install this security update, the installer checks whether one ormore of the files that are being updated on your system have previouslybeen updated by a Microsoft hotfix.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Supported Security Update Installation Switches
Switch	Description
/?, /h, /help	Displays help on supported switches.
/quiet	Suppresses the display of status or error messages.
/norestart	When combined with /quiet, the system will not be restarted after installation even if a restart is required to complete installation.

Note For more information about the wusa.exe installer, see Microsoft Knowledge Base Article 934307.

Verifying That the Update Has Been Applied

•

Microsoft Baseline Security Analyzer Toverify that a security update has been applied to an affected system,you may be able to use the Microsoft Baseline Security Analyzer (MBSA)tool. See the section, Detection and Deployment Tools and Guidance, earlier in this bulletin for more information.

•

File Version Verification Becausethere are several editions of Microsoft Windows, the following stepsmay be different on your system. If they are, see your productdocumentation to complete these steps. 1. Click Start and then enter an update file name in Start Search. 2. When the file appears under Programs, right-click on the file name and click Properties. 3. Under the General tab, compare the file size with the file information tables provided in the bulletin KB article. 4. You may also click on the Detailstab and compare information, such as file version and date modified,with the file information tables provided in the bulletin KB article. 5. Finally, you may also click on the Previous Versionstab and compare file information for the previous version of the filewith the file information for the new, or updated, version of the file.

Top of section

Top of section

Top of section

Other Information

Support

•	Customers in the U.S. and Canada can receive technical support from Microsoft Product Support Services at 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates.
•	Internationalcustomers can receive support from their local Microsoft subsidiaries.There is no charge for support that is associated with securityupdates. For more information about how to contact Microsoft forsupport issues, visit the International Support Web site.

Top of section

Disclaimer

Theinformation provided in the Microsoft Knowledge Base is provided "asis" without warranty of any kind. Microsoft disclaims all warranties,either express or implied, including the warranties of merchantabilityand fitness for a particular purpose. In no event shall MicrosoftCorporation or its suppliers be liable for any damages whatsoeverincluding direct, indirect, incidental, consequential, loss of businessprofits or special damages, even if Microsoft Corporation or itssuppliers have been advised of the possibility of such damages. Somestates do not allow the exclusion or limitation of liability forconsequential or incidental damages so the foregoing limitation may notapply.

Top of section

Revisions

•	V1.0 (October 23, 2008): Bulletin published.

Top of section

Here are some FAQ's 

What is the scope of the vulnerability?

This is a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system remotely. On Microsoft Windows 2000, Windows XP, and Windows Server 2003 systems, an attacker could exploit this vulnerability over RPC without authentication to run arbitrary code. It is possible that this vulnerability could be used in the crafting of a wormable exploit. If successfully exploited, an attacker could then install programs or view, change, or delete data; or create new accounts with full user rights.

What causes the vulnerability? 

The vulnerability is caused by the Windows Server service not properly handling specially crafted RPC requests.

What is the Server service? 

The Server service provides RPC support, file and print support, and named pipe sharing over the network. The Server service allows the sharing of your local resources (such as disks and printers) so that other users on the network can access them. It also allows named pipe communication between applications running on other computers and your computer, which is used for RPC.

What is RPC? 

Remote Procedure Call (RPC) is a protocol that a program can use to request a service from a program located on another computer in a network. RPC helps with interoperability because the program using RPC does not have to understand the network protocols that are supporting communication. In RPC, the requesting program is the client and the service-providing program is the server.

What might an attacker use the vulnerability to do? 

 An attacker who successfully exploited this vulnerability could take complete control of the affected system.

How could an attacker exploit the vulnerability? 

An attacker could try to exploit the vulnerability by sending a specially crafted message to an affected system. On Microsoft Windows 2000, Windows XP, and Windows Server 2003 systems, any anonymous user with access to the target network could deliver a specially crafted network packet to the affected system in order to exploit this vulnerability. On Windows Vista and Windows Server 2008 systems, however, only an authenticated user with access to the target network could deliver a specially crafted network packet to the affected system in order to exploit this vulnerability.

What systems are primarily at risk from the vulnerability?

While all workstations and servers are at risk regarding this issue, systems running Microsoft Windows 2000, Windows XP, or Windows Server 2003 are primarily at risk due to the unique characteristics of the vulnerability and affected code path.

 

What does the update do? 

The update addresses the vulnerability by correcting the manner in which the Server service handles RPC requests.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 

Yes. Microsoft is aware of limited, targeted attacks attempting to exploit the vulnerability. However, when the security bulletin was released, Microsoft had not seen any examples of proof of concept code published.

Does applying this security update help protect customers from the code that attempts to exploit this vulnerability? 

Yes. This security update addresses the vulnerability that is currently being exploited. The vulnerability that has been addressed has been assigned the Common Vulnerability and Exposure number. CVE-2008-4250 

Here are some additional resources you should be aware of.......

Full bulletin for MS08-067 is available at

Full bulletin for MS08-067

File information details can be found in

Microsoft Knowledge Base Article 958644

 ******

Security Updates Are Available from...

Office Update

Microsoft Update

Windows Update
  

Microsoft TechNet Security TechCenter as a source of security information:

http://technet.microsoft.com/security

Security updates are also available from 

the Microsoft Download Center

Microsoft Baseline Security Analyzer 

Microsoft Baseline Security Analyzer

  

The latest blog entry comes all the way from Computerworld UK. It talks about how Microsoft unveiled details of its 2 year Road Map for SQL Server.

Ovum: Microsoft unveils 'brave and bold' BI strategy

SQL Server Roadmap to be delivered over next two years

By Jack Loo, MIS Asia

Microsoft has unveiled details of its SQL Server roadmap that it aims to deliver over two years. Dubbed a "brave and bold move" by research firm Ovum, the software giant has been open about its upcoming offering compared to other cautious competitors.

Central to the next release of SQL Server 2008 are three project components each relating to different functions. The first, code-named Kilimanjaro, will introduce self-service reporting capabilities. The second, Project Gemini, offers new managed self-service analysis capabilities, while the last, codenamed Madison, provides advanced data warehousing functionality.

Kilimanjaro will include a new version of Report Builder, first introduced within SQL Server 2005, which helps simplify the development, deployment and maintenance of reports, and supports data delivery into Microsoft Word and Excel.

Project Gemini itself constitutes a number of different client and server business intelligence components. It has three main elements: an update to the Analysis Services engine; an Excel add-in client component for in-memory, on-the-fly sorting, filtering and slicing & dicing of large data sets; and deeper integration with Sharepoint.

"Project Gemini is clearly targeted at the power users that require the familiarity of Excel but with the scale and power of a heavy-duty multidimensional tool -- SQL Server Analysis Services," pointed out Helena Schwenk, Senior Analyst at Ovum.

The Excel add-in component plays a central part in Microsoft's 'bring business intelligence to the masses' strategy, said Schwenk. The new function has been designed to overcome some of the technical limits to crunching data within Excel and allows users to download millions of rows of data from disparate sources and present and compare data within its interface.

The add-in component also alleviates the need for users to understand and become proficient with the design, build and population of a multidimensional structure. "It can, for instance, automatically infer relationships between data sets brought into the spreadsheet and join using Analysis Services behind the scenes," said Schwenk.

Furthermore users can model, build and test their own BI applications without impacting on live BI systems. If users want to share the multidimensional model, Gemini integrates with SharePoint for sharing, collaboration and management of the application, said Schwenk.

"However, Excel isn't the only client application Microsoft plans to leverage; users will be also able to access business intelligence data from Microsoft's Dynamics 2009," she added.

To read the entire article......

Ovum: Microsoft unveils 'brave and bold' BI strategy

This article does a really good job of laying out what to expect for the next 2 years. Its very clear that Microsoft is bringing data warehousing to the masses. Its a great story. One vendor, one platform, great price points and it works. 

Posted by Michael Corey, Founder & CEO

www.ntirety.com

Everyone loves a good cat fight lets face it. Oracle announcement of the new Database Machine was met with mixed reviews. Oracle announced it as “The World’s Fastest Database Machine”. Companies like  www.netezza.com have a very different opinion.  Lets not forget my freinds at  www.dataupia.com.

Kevin Closson at Oracle is the expert on the topic of the Oracle Database Machine. Well EMC has it’s own concerns over the Oracle Exedata Machine. Chuck Hollis VP – Global Marketing CTO EMC Corporation is in a Catfight with Kevin Closson at Oracle. I for one am enjoying the banter between the two. I am finding it very educational  Judge for yourself…

I Annoy Kevin Closson at Oracle

What's This All About?

Well, it's about Oracle getting into the storage business, for one thing.  And perhaps a continual problem they've been having with DW performance: losing market share to more specialized players.

Rather than focusing solely on software, they've got the route of offering a pre-configured behemoth from HP running (according to Kevin) a customized version of Oracle you can't run anywhere else, making like-for-like comparisons somewhat difficult.

In his last post, it's pretty obvious that -- based on his condescending and somewhat nasty tone -- that I got under his skin a bit.  I've usually found that the vitriol in a response is in direct correlation to the sensitivity of the issue I've raised.

So it must have been a very sensitive issue indeed.

Rather than back off, I now (somewhat strangely) feel compelled to bore in a bit, and explore this in more depth. 

Come, join me on a an interesting journey here ...

So, Let's Dig In

My first general argument was -- what does this particular hardware bring to the picture, other than a cosy marketing relationship?

From a purely hardware perspective, we've got "storage nodes" (ostensibly generic HP x64 server kit with a $449 P400 RAID controller) running in a 12 SAS disks to 1 server ratio.  The disk is mirrored, no support of any space-saving RAID options -- strange, for such a large machine.

The "storage nodes" are interconnected to "database nodes" via Infiniband, and I questioned (based on our work in this environment) whether this was actually a bottleneck being addressed, or whether it was a bit of marketing flash in a world where multiple 1Gb ethernet ports seem to do as well.

Kevin seemed to take issue with my characterization of the storage subsystem as JBOD, and not "smart".  He's right about that, technically speaking that would make it a DAS (direct attached storage) configuration, as opposed to SAN, NAS or other topologies.

However, I don't think too many storage people would look at a $449 SAS RAID controller with 512MB of RAM and an "optional battery backup unit for cache" as excessively "smart".

Kevin seemed to agree (it's not clear, though) that the Infiniband didn't bring much to the party.  We'll leave that one open for now, pending further clarification by Kevin.

And, with regards to disk hardware, he didn't try to justify the RAID 1 on either performance or availability grounds (debatable, though), but did seem to state that I had a certain lack of imagination as to what might be possible in the future. 

Being a storage guy, I know that the real issue isn't the disk, it's being able to get to your data if one of the "storage nodes" fails.  And since this type of architecture doesn't know how to share storage, you're forced with putting all of your data in two places, in case one node fails.  Unlikely that we'll see something more space efficient in the forseeable future.

And Then There's The Open Software Question

Not "open" in the sense of open source code et. al., but open in the sense of "I can run this software on any reasonable choice of server and storage". 

Kevin is pretty clear that this particular version of Oracle is available in one place and one place only -- the hardware that Oracle sells.

Now, we could debate the pros and cons of this (as I'm sure will be debated in the future), but it's a clear departure from past Oracle "runs on anything" strategy. 

And you just have to ask yourself the question -- why is this?

I'm guessing that all Oracle sees is a version of Linux.  Probably not Oracle's version, since I understand that HP has its own versions that it prefers, but I could be incorrect on this.  It doesn't see the "smart" RAID controller.  It doesn't see the Infiniband, that's abstracted as well.

So it appears to be a "business choice", rather than a technical requirement.

From a purely customer perspective, it makes it hard to see how much value comes from the hardware, and how much comes from the software.  We'll never see side-by-side comparisons of this particular software running on potentially faster/cheaper/better servers and storage, will we?

Alternative Approaches To Scale-Out

Scaling out a DW environment horizontally is nothing really new, not even for Oracle environments.  Indeed, EMC and Oracle (along with Dell) have done scale-outs with moderate-sized arrays (not big honkin' ones as Kevin suggests), moderate processors and standard-grade 1Gb ethernet connections.

We get pretty good cost-effective DW performance this way, not only with Oracle, but with DATAllegro, Vertica, SQLserver, UDB and a bunch of others.  And, taking this approach, there are great answers for things like backup, business continuity, security, storage management and every other joy that comes along with having dozens of terabytes of important data in a DW/BI environment.

From what we can tell about Oracle's standard pricing (exclusive of the steep discounts they're currently offering to get people to try this stuff), it looks like a very, very expensive solution by comparison.  [Warning: the power that these machines consume is not free ... if I get a moment, I'll get someone to run a power usage comparison.  I'm guessing it'll be eye-opening, given what they're doing on the hardware architecture]

If it ran faster than other alternatives, at least we'd have a basis for comparison. 

But we're not going to get that anytime soon, are we?

And, An Apology, Sort Of

Thoughout his post, Kevin takes me to task for not researching white papers, his previous posts, etc.  and thus came to some incorrect conclusions, particularly in regards to the nature of the software that Oracle is promoting as part of this bundle.

Sorry, Kevin, I could have done a bit more homework in this regard -- thanks for clarifying.

This Should Be Interesting

To read the rest of the article.....

For now we all have a ring side seat as Kevin and Chuck go at it. 

Posted by Michael Corey, Founder & CEO

www.ntirety.com

Watching the markets these days is like watching the EKG: Is the heart rate going up or down, and will it ever flatline?

The tech departments in all businesses are going to be asked to squeeze savings from budgets, if they haven't been already.  Once again, we'll be asked to do more with less.  At Ntirety, we have a lot of experience remotely managing databases, but we also serve as technology advisors to many of our clients who value our expertise and experience.

So I thought today I'd offer all of Ntirety's clients and anyone else reading this blog some of the simple steps for squeezing savings out of IT budgets.  As a career DBA and founder of two managed service companies, I have witnessed the hidden waste that goes unnoticed in IT budgets.  It's there, but no one looks for it in flush times.  But cutting this waste can free up valuable resources.

The good news for IT departments is there are more choices than ever before on how a company provides technology infrastructure it needs to stay competitive.  In the spirit of helping you all manage this economic downturn and keep the edge on your competition, I humbly suggest the following:

1. Cut unneeded software licenses

Check your licenses and make sure you are not paying for ones you don't use.  If you have eight licenses to salesforce.com, but only need five, that is waste hidden in the technology budget.  It's worse if you have 50 antivirus subscriptions, but only needed 35.  Given the various software licenses companies require, unused licenses can waste tens of thousands of dollars annually.

Cutting out unused licenses can reduce costs without negatively impacting the business. And if your company unfortunately has layoffs, remember to reduce licenses as head count drops.

2.  Use your technology or lose it

Many companies purchase technology with the best intentions, but never actually deploy it. Where it makes sense, brush the dust off and start using it.  For example, many businesses have Microsoft SharePoint – it came with the server license – but they don't use it to its fullest potential.  You might be able to get more efficiency from the dollars already spent by using it fully.

If you bought technology and deploying it no longer makes sense, double check that you are not paying support fees on it.  Often, companies acquire technology that is packaged with free additional software.  What a deal! The catch is you may be paying for ongoing maintenance of the so-called free software, which you may not even be using because you never really wanted it in the first place.

3. Do you need a support group?

There can be such a thing as too much help.  It's time to review your support network and ask these questions:
−    Are you paying for 24-7 support when you can get by with support during normal business hours?
−    Do you need to hire a new database administrator when you can get a team of DBAs to remotely manage the database at a fraction of the cost of a new employee?  You should ask the same question about support for desktop environments.  Is remote support more efficient than in-house?
−    Does it make sense to maintain an in-house email infrastructure when it can be bought by the head, at a fraction of the cost, from a third-party?

4. Invest now or later?

If you have the option to upgrade your database, ask yourself whether you really need to?  Would it be better to manage with your current version and wait until a game-changing upgrade comes along?  Maybe you can get a few more miles out of that old clunker.

You should also ask whether the upgrade requires new hardware, a potentially hidden expense that may be a budget buster. (New technology projects are notorious for rising budgets because of unforeseen expenses, so make sure you fully vet project plans for all costs.)  

You will also want to reconsider other technology upgrades, such as:
−    Is now the right time to invest in that new VOIP phone system?
−    Is now the right time to build customized technology for specific business needs, or can you live with a cheaper, off-the-shelf product that is workable, but not perfect?

Posted Michael Corey, Ntirety

www.ntirety.com

The next article is straight from Business Week.....

The Short List for U.S. Chief Technology Officer

Barack Obama has pledged to name a cabinet-level CTO to oversee a job-creating national broadband buildout if he's elected. Big names abound

By Tom Lowry

Barack Obama says that the U.S. is not doing nearly enough to create jobs through technology. Shortly after he launched his campaign, the Illinois Senator promised that if elected, he would create the first-ever Cabinet-level post of chief technology officer. The economic crisis has since made it certain that a White House CTO would become one of Obama's most important advisers, should he triumph in November. "Obama sees greater broadband penetration as an enormous economic engine, much like the railroads were a century ago," says Andrew D. Lipman, a veteran communications lawyer in Washington. "That is why the CTO will play such a critical role in any recovery plan."

Among the candidates who would be considered for the job, say Washington insiders, are Vint Cerf, Google's (GOOG) "chief internet evangelist," who is often cited as one of the fathers of the Internet; Microsoft (MSFT) chief executive officer Steve Ballmer; Amazon (AMZN) CEO Jeffrey Bezos; and Ed Felten, a prominent professor of computer science and public affairs at Princeton University. An Obama campaign spokesman did not return phone calls seeking comment about potential CTO candidates.

Obama—who has effectively used the Internet and social networks throughout his campaign to raise funds, engage voters, and put forward policy positions—has long criticized the Bush administration for not doing more to increase broadband penetration in the U.S., particularly in rural areas. The country ranked 15th among industrial nations in penetration, with a mere 23 out of 100 Americans having access to broadband service, according to a report released earlier this year by the Organization for Economic Cooperation and Development.

A White House CTO would be expected to help create incentive programs to expand broadband's reach, particularly tax credits for smaller carriers. But the tech czar would almost certainly be deeply involved in overseeing a federally-backed $50 billion venture capital fund that Obama has proposed to develop more environmentally friendly technology.

CTO vs. FCC?

What is less clear is how a CTO would interact with the Federal Communications Commission. While the FCC chairman does not belong to the Cabinet, the person filling that role has traditionally been a leading voice on issues of media, telecommunications, and technology. It is widely expected that President Bush's appointed FCC chair, Kevin Martin, would step down if Obama were elected. Sources say Obama might then consider appointing his former Harvard Law School classmate and current campaign adviser, Julius Genachowski, to the chairman's post. A former adviser to FCC chairs Reed Hundt and Bill Kennard, Genachowski won plaudits for his work as top executive at Barry Diller's IAC/InterActiveCorp (IACI). More recently, Genachowski has been running his own venture capital firm, Rock Creek Ventures.

To read the entire article.....

The Short List for U.S. Chief Technology Officer

Barack Obama has done a wonderful job of tapping into social networks for his campaign. To put it in perspective. I just checked my Digg account. One of the Social Networks I use. Today is October 20, 2008. The Last time John McCain used his digg account was August 29, 2008. Barack Obama checked his Digg account November 19th, 1 day ago. Its clear that Barack Obama is more in tune with the Internet or at least his staff his.

I love the idea of a presidential Cabinet position of a Chief Technology Officer. I think it’s long overdue. To quote the Business Week Article " The economic crisis has since made it certain that a White House CTO would become one of Obama's most important advisers, should he triumph in November.".

Given the importance of technology in the United States Economy, I think a presidential cabinet post of Chief Technology Officer is long overdue. I am not crazy about the initial focus for this position. Based upon the business week comments.

    * Barack Obama says that the U.S. is not doing nearly enough to create jobs through technology.
    * "Obama sees greater broadband penetration as an enormous economic engine, much like the railroads were a century ago," says Andrew D. Lipman, a veteran communications lawyer in Washington. "That is why the CTO will play such a critical role in any recovery plan."

I do not see that as the issue today and I hope this is just political rhetoric to make people feel good. We are well on our way in this country to building greater broadband penetration. Every time I turn around the Internet capability is being doubled around me. That may not be the case in Rural America, but every major city I have traveled to, has no shortage of broadband penetration and it just keeps getting better and better. I think the railroad is already here. We just keep updating it.

The key is to make sure we keep our competitive edge with Technology. For example of greater concern for me is the shortage of students entering STEM Fields. STEM = Science Technology Engineering and Mathematics. In the United State we have less kids every year entering these fields. This is a national problem of critical importance. We need these skills if we are to stay competitive. We can have the greatest technology infrastructure in the world, but if no one is here who knows how to use it to give us a competitive advantage, what good will it be.

Its great that we have this wonderful Service industry in the U.S. but the next great invention that changes our lives will come from the STEM fields, not the service industry.
In Massachusetts I am a member of the Robert H. Goddard Council on Science Technology Engineering and Mathematics. 

We are trying to understand why kids no longer pursue STEM fields.  Today we do graduate enough students in the STEM fields to meet our needs as a Nation. Think of the long term National Security issues, think of the long term issue to our ability to compete in the global economy.

To make the matter worse, we are tightening down our ability to bring people from outside the U.S.  who have these skills and more importantly let them live and work in the U.S.  These policies are forcing many U.S. companies to build technology centers outside the U.S. since they cant get the skills they need here in the United States.

I commend Barack Obama for creating A Cabinet position of Chief Technology Officer. If he gets elected, lets hope we get past the political rhetoric and let this new CTO work on the real issues. Making sure we leverage technology to keep the U.S. competitive and that we have an advocate who understands that long term the U.S. needs the next generate of kids to enter the Stem fields, graduate and find jobs in the U.S.

Posted Michael Corey, Ntirety

www.ntirety.com

I found this story in the...

 A technology that could help driver avoid accidents.

Motor vehicle "accidents" are the leading cause of "death by injury" in the world today and are recognized as a major and growing global health burden.

According to World Health Organization (WHO) estimates, in 2002 nearly 1.2 million people died in road crashes worldwide and between 20 and 50 million were injured.

In 2004, more than 40,600 people were killed in traffic accidents in the United States alone.
So when new technology is developed that promises to lower traffic death rates, it attracts serious attention.

A computer chip and a tiny camera not much bigger than a dime installed on the windshield behind your car's rear-view mirror may now make the difference between life and death.

The Netherlands-based Mobileye Vision Technologies has developed an inexpensive hi-tech driver assistance system called Mobileye AWS (advance warning system), which can provide drivers with early warnings of potential road hazards.

Founded by an Israeli, with its R&D based in Israel, the company says the system has the potential to lower accident rates and teach people how to be "smarter" drivers.

The images generated from a front-facing camera are analyzed by the system's computer chip, which has been "taught" to recognize potential hazards such as cars, buses, trucks, motorcycles and pedestrians, and uses audio warnings to aid the driver in recognizing and maintaining safe distances from these threats.

The chip, roughly the size of a Zippo lighter, has the processing capability of two Pentium computers but comes at a much lower price.

The aftermarket product line works day, night and in inclement weather, and features Forward Collision Warning that prevents collision with vehicles ahead by alerting drivers to both moving and stationary vehicles while filtering out cars in adjacent lanes that pose no threats.
Alerts are provided up to 2.7 seconds before collision - enough time to safely stop and avoid an accident.

It also features Headway Monitoring and Warning, providing distance indication to drivers and Lane Departure Warning that alerts drivers when they inadvertently drift from their lane due to drowsiness or other factors.

Other technologies in different stages of development include lane change assist that monitors the speed and distance of overtaking vehicles and tells you when it is safe to switch lanes, and pedestrian protection that identifies people in the vehicle's path as well as those on the sidewalk who may enter the roadway.

For example, the system detects the distance to the vehicle immediately ahead - generally targeted as posing the primary threat. As the driver nears the vehicle in front of him, an image on the display panel changes progressively from green to orange to red.

Upon advancing beyond a minimal safe following distance, the driver will hear an audio warning announcing that he or she must reduce speed and fall back. The audio caution will cease the moment the driver steps on the brakes.

Though there is a small display panel mounted on the vehicle's dashboard, most of the warnings are audible and the driver need not remove his or her eyes from the road in order to make use of the system.

"Studies by auto makers, government and non-government organizations have shown that giving sufficient warning can prevent up to 80 percent of all traffic accidents," Iftah Amit, VP for Sales and Aftermarket Products for Mobileye Vision Technologies told The Media Line.
"Mobileye is the only technology developer that provides the broadest range of accident prevention alerts in a single system," he said. 

Mobileye develops a third eye for your car

Posted Michael Corey, Ntirety

www.ntirety.com

This just came out.....

A collection of 26 free stand-alone tools, components and frameworks has been released. This collection is designed to enhance using and developing for SQL Server 2008 as well as other versions of SQL Server.

The Feature Pack consists of the following:

Microsoft SQL Server 2008 Reporting Services Add-in for Microsoft SharePoint Technologies

Allows you to take advantage of SQL Server 2008 report processing and management capabilities in SharePoint integrated mode. This version also includes data-driven subscriptions. The download provides a Report Viewer Web part, Web application pages, and support for using standard Windows SharePoint Services or Microsoft Office SharePoint Services.

Report Builder 2.0 supports the full capabilities of SQL Server 2008 Reporting Services including flexible data layout, data visualizations, and richly formatted text features.   It also delivers an even more intuitive report authoring environment for business and power users with a Microsoft Office look and feel, plus:

· Easy to use wizards for creating table, matrix and chart data regions

· Support for directly opening and editing reports stored on the report server

· Support for using server resources such as shared data sources

· Query designer for Microsoft SQL Server data sources

· Ability to read from all SQL Server Reporting Services data sources

Click here to download SQL Server 2008 Feature Pack

Posted Michael Corey, Ntirety

www.ntirety.com

Lets face it, with a stock market that keeps going down and down, things will start to get tough. Companies will be looking at ways to save money. At the same time in our household we should be looking at ways to tighten our belts. I recently found a well written article on 9 web sites that can help with household budgeting. I found it on Yahoo finance and it was from smart money....

9 Sites That Help With Everyday Budgeting

by Kelli B. Grant

Most consumers could use a little financial handholding these days.

Nearly half of the workers recently surveyed by CareerBuilder.com said they live paycheck to paycheck. Even those who do have cash left after paying the bills are struggling -- 52% reported they have less than $100 per month to put into savings.

One silver lining to these tough economic times: a slew of new free online tools and services that help consumers save money and manage it wisely. Whether you're looking to track your credit score, find a better savings rate or finally balance that monthly budget, these nine sites can help:

BillShrink

Worried you're paying more than you need to for your wireless plan? BillShrink searches various cell phone plans to find you the best deal. Answer five simple questions about your usage (or better yet, upload your latest bill), and this service searches plan and add-on service combinations at all providers. It even factors in call quality and the cost to switch. The site offers a similar tool for credit cards that tallies the cash you'd save -- in terms of interest rates and fees -- by switching to another card.

Credit Karma

Thanks to the credit crunch, your credit score carries a lot more weight than it used to, especially when you want to land a loan or open a credit card. Credit Karma offers free daily access to your credit score from partner credit reporting bureau TransUnion. Most lenders use a different formula -- the so-called FICO from Fair Isaac Corp. -- but it's still an effective tool for keeping track of any score fluctuations. (Other sites charge $8.99 and up a month for continuous monitoring of your FICO score, or require you to sign up for other subscription services.) Credit Karma also offers a Credit Simulator that gauges the affect of such actions as opening a new credit card or paying your bills on time.

FiLife

This site offers information on thousands of financial accounts, ranging from credit cards and checking accounts to 529 college savings plans. Search for the best balance transfer rates on credit cards or which CDs pay the most in interest. Also, find out about other consumers' experiences through the customer reviews and ratings. (Dow Jones owns half of FiLife, which launched in June; SmartMoney.com is a joint venture of Hearst and Dow Jones.)

Mint

Mint provides one-stop shopping for consumers who want to get a better handle on all of their household finances. Not only does it allow users to track their 401(k), but it also lets them customize their budget for specific expenses, including groceries and gas. One downside: the "Ways to Save" section only includes offers from partner credit card issuers.

MoneyAisle

Want to get the best rates on a CD, money market or high-yield savings account? MoneyAisle will pit participating financial institutions (mostly small community banks and credit unions) against one another in a real-time auction to compete for your business. The auctions take just a few minutes, and users can decline deals they don't like. For peace of mind, MoneyAisle only deals with FDIC-insured institutions that carry favorable safety ratings from industry experts.

Quicken Online

The web-based version of the popular desktop software ditched its $2.99-a-month fee. Now users have access to an overview of all of their accounts, as well as a 10-day outlook that projects how upcoming expenses will impact account balances. Quicken also assesses user's risk level for incurring overdraft fees and will send text-message alerts when they're overspending.

To read the entire article.....

9 Sites That Help With Everyday Budgeting

Posted Michael Corey, Ntirety

www.ntirety.com

This story takes place in Iran of all places. Where an attempt was made to build the worlds largest sandwich. Not a place where I ever would have expected the worlds largest sandwich to be built. I found this story  on a web site in the U.K. called Mail Online.

Bid to create world's largest sandwich in Iran fails after crowd eats it before it can be measured

The meat had been cooked, the sandwich almost assembled and assorted Guinness Book of Records dignitaries were patiently waiting by to give it their official stamp of approval.

But cooks in Iran were left in despair after their bid to create the world's longest sandwich failed when the crowd started eating it before it could be measured.

Event organisers had planned to stuff the 1,500-metre-long sandwich with 700 kg  of ostrich meat and 700 kg of chicken, and display it in a park in the capital Tehran.

To read the entire article and see a picture of the actual sandwich.....

Worlds Largest Sandwich in Iran

What I was able to do was find a picture of the worlds largest baked Potato and a picture of the worlds largest sandwich that did not get eaten.

P

Posted Michael Corey, Ntirety

www.ntirety.com

In the New York Times, Warren E. Buffett published an article Buy American, I am. Warren is probably the greatest investor of our times. How many of us wish we had bought stock in Berkshire Hathaway.

Here is a portion of the article….

The financial world is a mess, both in the United States and abroad. Its problems, moreover, have been leaking into the general economy, and the leaks are now turning into a gusher. In the near term, unemployment will rise, business activity will falter and headlines will continue to be scary.

So ... I’ve been buying American stocks. This is my personal account I’m talking about, in which I previously owned nothing but United States government bonds. (This description leaves aside my Berkshire Hathaway holdings, which are all committed to philanthropy.) If prices keep looking attractive, my non-Berkshire net worth will soon be 100 percent in United States equities.

Why?

A simple rule dictates my buying: Be fearful when others are greedy, and be greedy when others are fearful. And most certainly, fear is now widespread, gripping even seasoned investors. To be sure, investors are right to be wary of highly leveraged entities or businesses in weak competitive positions. But fears regarding the long-term prosperity of the nation’s many sound companies make no sense. These businesses will indeed suffer earnings hiccups, as they always have. But most major companies will be setting new profit records 5, 10 and 20 years from now.

To read the entire article….

Buy American I AM by Warren E. Buffett

Posted Michael Corey, Ntirety

www.ntirety.com

Those of you, who are regular readers of my blog, know I am always willing to share an opinion on something. Right or wrong, I have an opinion and I am willing to share it.My latest entry is my lessons learned on how to prevent DBA Burn out. I published this in Database Trends and Applications October 2008 Issue. Here is a sample of the article…

Many a company did not take security serious enough and has paid the price. The problem is not only did they pay the price, but so did there customers. Too many times in the past few years, have I had to request new credit cards to protect myself.

My oldest child who was  attending college even had his identity stolen. I wrote a blog entry with lots of useful information....

Identity Theft Hits Home - Lessons Learned

•  Why backend database testing is just as vital as front end testing

•  How to avoid backend database malfunctions that cause things like: system deadlock, data corruption, poor database performance, and data loss

•  An overview of backend database testing (functional vs. structural)

•  An overview of high profile database attacks in the past few years

By attending this event you will walk away with an understanding of the overall benefits of a database vulnerability assessment (or database penetration test) and some basic ideas on how to structure your own database security testing policies.

To learn more and sign up to attend the Webinar .......

Posted Michael Corey, Ntirety

www.ntirety.com

I just saw this article and it caught my attention immediately.

Italian Prime Minister Silvio Berlusconi said the economic crisis is becoming so pronounced that world leaders will possibly close financial markets while they “rewrite the rules of international finance.” If a new Bretton Woods agreement is being discussed, as Berlusconi says it is, the dollar is in serious trouble. 

The Bretton Woods agreement tied the Western democratic economies to America, established the U.S. dollar as the world’s reserve currency.  This has serious consequences for everyone. 

This article in the Trumpet.com is worth taking a closer look at...

Posted by Michael Corey 

www.ntirety.com

I recently did a podcats with Mike Vizard at Eweek. We talked about quite a few things. We touched up Database Virtualization, Database consolodation and a lot more. Here is is...

Consolidating Database Servers

By Michael Vizard

In this IT Link podcast hosted by Mike Vizard, Ntirety CEO Michael Corey explains how the next generation of databases and virtualization technologies will combine to drive a new wave of database server consolidation and related infrastructure investments.

Here is a link to get there.....

Consolidating Database Servers, Mike Vizard (Eweek)

Posted by Michael Corey 

www.ntirety.com

 I recently came across a blog entry by Brad McGehee that went into a lot of detail on SQL Server 2008 data types. Here is a partion copy of his blog entry...

SQL Server 2008: The New Data Types

by Brad McGehee

We'll take a look at SQL Server 2008's  new data types:

• Date and Time: Four new date and time data types have been added, making working with time much easier than it ever has in the past. They include: DATE, TIME, DATETIME2, and DATETIMEOFFSET.

• Spatial: Two new spatial data types have been added--GEOMETRY and GEOGRAPHY--which you can use to natively store and manipulate location-based information, such as Global Positioning System (GPS) data.

• HIERARCHYID: The HIERARCHYID data type is used to enable database applications to model hierarchical tree structures, such as the organization chart of a business.

• FILESTREAM: FILESTREAM is not a data type as such, but is a variation of the VARBINARY(MAX) data type that allows unstructured data to be stored in the file system instead of inside the SQL Server database. Because this option requires a lot of involvement from both the DBA administration and development side, I will spend more time on this topic than the rest.

Each of these data types are available in all editions of SQL Server 2008. Let’s look at each of these, one at a time.

Date and Time

In SQL Server 2005 and earlier, SQL Server only offered two date and time data types: DATETIME and SMALLDATETIME. While they were useful in many cases, they had a lot of limitations, including:

• Both the date value and the time value are part of both of these data types, and you can’t choose to store one or the other. This often causes a lot of wasted storage (because you store data you don’t need or want); adds unwanted complexity to many queries because the data types often had to be converted to a different form to be useful; and often reduces performance because WHERE clauses with these data and time data types often had to include functions to convert them to a more useful form, preventing these queries from using indexes.

• They are not time-zone aware, which often requires extra coding for time-aware applications.

• Precision is only .333 seconds, which is often not granular enough for some applications.

• The range of supported dates is not adequate for some applications, and the range does not match the range of .NET CLR DATETIME data type, which requires additional conversion code.

To overcome these problems, SQL Server 2008 introduces four new date and time data types, which include:

• DATE: As you can imagine, the DATE data type only stores a date in the format of YYYY-MM-DD. It has a range of 0001-01-01 through 9999-12-32, which should be adequate for most business and scientific applications. The accuracy is 1 day, and it only takes 3 bytes to store the date.

• TIME: TIME is stored in the format: hh:mm:ss.nnnnnnn, with a range of 00:00:00.0000000 through 23:59:59:9999999 and is accurate to 100 nanoseconds. Storage depends on the precision and scale selected, and runs from 3 to 5 bytes.

• DATETIME2: DATETIME2 is very similar to the older DATETIME data type, but has a greater range and precision. The format is YYYY-MM-DD hh:mm:ss:nnnnnnnm with a range of 0001-01-01 00:00:00.0000000 through 9999-12-31 23:59:59.9999999, and an accuracy of 100 nanoseconds. Storage depends on the precision and scale selected, and runs from 6 to 8 bytes.

• DATETIMEOFFSET: DATETIMEOFFSET is similar to DATETIME2, but includes additional information to track the time zone. The format is YYYY-MM-DD hh:mm:ss[.nnnnnnn] [+|-]hh:mm with a range of 0001-01-01 00:00:00.0000000 through 0001-01-01 00:00:00.0000000 through 9999-12-31 23:59:59.9999999 (in UTC), and an accuracy of 100 nanoseconds. Storage depends on the precision and scale selected, and runs from 8 to 10 bytes.

All of these new date and time data types work with SQL Server 2008 date and time functions, which have been enhanced in order to properly understand the new formats. In addition, some new date and time functions have been added to take advantage of the new capabilities of these four new data types.

Spatial

While spatial data has been stored in many SQL Server databases for many years (using conventional data types) SQL Server 2008 includes the introduction of two specific spatial data types which can make it easier for developers to integrate spatial data in their SQL Server-based applications. In addition, by storing spatial data in relational tables, it becomes much easier to combine spatial data with other kinds of business data. For example, by combining spatial data (such as longitude and latitude) with the physical address of a business, applications can be created to map business locations on a map.

They include:

• GEOMETRY: The GEOMETRY data type is used to store planar (flat-earth) data. It is generally used to store XY coordinates that represent points, lines, and polygons in a two-dimensional space. For example storing XY coordinates in the GEOMETRY data type can be used to map the exterior of a building.

• GEOGRAPHY: The GEOGRAPHY data type is used to store ellipsoidal (round-earth) data. It is used to store latitude and longitude coordinates that represent points, lines, and polygons on the earth’s surface. For example, GPS data that represents the lay of the land is one example of data that can be stored in the GEOGRAPHY data type.

GEOMETRY and GEOGRAPHY data types are implemented as .NET CLR data types, which means they can support various properties and methods specific to the data. For example, a method can be used to calculate the distance between two GEOMETRY XY coordinates, or the distance between two GEOGRAPHY latitude and longitude coordinates. Another example is a method to see if two spatial objects intersect or not. Methods defined by the Open Geospatial Consortium standard, and Microsoft extensions to that standard, can be used. To take full advantage of these methods, you will have to be an expert in spatial data, a topic that well beyond the scope of this chapter.

Another feature of spatial data types is that they support special spatial indexes. Unlike conventional indexes, spatial indexes consist of a grid-based hierarchy in which each level of the index subdivides the grid sector that is defined in the level above. But like conventional indexes, the SQL Server query optimizer can use spatial indexes to speed up the performance of queries that return spatial data.

Spatial data is an area unfamiliar to most DBAs. If this is a topic you want to learn more about, you will need a good math background, otherwise you will get lost very quickly.

HIERARCHYID

While hierarchical tree structures are commonly used in many applications, SQL Server has not made it easy to represent and store them in relational tables. In SQL Server 2008, the HIERARCHYID data type has been added to help resolve this problem. It is designed to store values that represent the position of nodes of a hierarchal tree structure.

For example, the HIERARCHYID data type makes it easier to express these types of relationships without requiring multiple parent/child tables and complex joins.

• Organizational structures

• A set of tasks that make up a larger projects (like a GANTT chart)

• File systems (folders and their sub-folders)
• A classification of language terms
• A bill of materials to assemble or build a product
• A graphical representation of links between web pages

Unlike standard data types, the HIERARCHYID data type is a CLR user-defined type, and it exposes many methods that allow you to manipulate the date stored within it. For example, there are methods to get the current hierarchy level, get the previous level, get the next level, and many more. In fact, the HIERARCHYID data type is only used to store hierarchical data; it does not automatically represent a hierarchical structure. It is the responsibility of the application to create and assign HIERARCHYID values in a way that represents the desired relationship. Think of a HIERARCHYID data type as a place to store positional nodes of a tree structure, not as a way to create the tree structure.

To read the entire article by Brad Click Here .......

There is a lot more useful information in brads article, for anyone that want to de a deep dive on these new datatypes. It is written in a very clear style.

If you want to learn more about SQL Server 2008, check out the Ntirety Video Gallery.  We have lots of Videos we did in cooperation with Microsoft that talk about SQL Server 2008. Here is a link to the Video Gallery...

Posted by Michael Corey

www.ntirety.com

The other day I had the privilege of sharing my thoughts with Mike Vizard.  Mike is one of the people in the Media who get it. For those of you who do not know mike....

Michael Vizard Editor in Chief Michael joined InfoWorld Media Group in 1995. He has been covering computer technology for more than 14 years. As Editor In Chief, Michael is responsible for the day-to-day management of InfoWorld’s editorial department, in addition to leading the content of InfoWorld Online and managing strategic editorial partnerships. Michael is also a member of the senior leadership team, which provides the strategic vision for InfoWorld Media Group.

Mike understands technology and understands what it all means and where it is taking the Industry. Mike was way ahead of the curve when it came to Managed Services and has been writing on the Managed Service space for a very long time. The first time I talked with Mike Vizard was a few years ago, when I saw an article he had written on Manage Services. I thought it was so dead on I sent him a note, to share my thoughts.

When Mike Recently called me to ask my opinion on some items, I was happy to share it.  As I told Mike Vizard, Right or Wrong I always have an opinion.

One of the things I don’t like about being in the Managed Service Space is the name of the space. Many people who hear it have no idea what it means.

Ntirety is 100% focused on being the premier provider of Remote Database Administration services around the globe.  Ntirety is the largest provider of Remote DBA services today for SQL Server Databases. We are also considered a Managed Service Provider. Those most Managed Service providers do not touch the database.

Given my roots as a DBA/Developer go back to Oracle version 3, I never thought you would hear me say that, yet today I am proud to say it. SQL Server is an awesome database to run your business on and Ntirety does more of that Remotely then anyone else.  The mission of Ntirety is to set the standard by which other providers of Remote database administration services will follow.

What I don’t like is being called a Managed Service Provider. Its not that it a bad thing, its just not an understood term in the marketplace. There is even an alliance of vendors like Ntirety, trying to raise the standard by which  all Managed Service Providers operate. To learn more about Managed Services check out the Managed Service Alliance. Managed Service Alliance  Ntirety is a member of the Managed Service Alliance a of a group of MSP’s who take it very seriously.

The problem I have is that when companies are looking for Remote Database Administration services; they don’t think to search google for  Managed services. For my friends at Microsoft, they don’t think to use Live Search with the key words "managed services". So managed term not a market term that helps my business be found.  I am hoping the marketplace better understands the term some day. Perhaps Mike Vizard will coin a better term for what Managed Services is.

Mike Vizard and I started to talk about Gremlins of all things.  The fact that gremlins impact my clients ability to service their clients and Ntirety’s ability as a provider of remote DBA services to service my clients.  We recognized early on that to deal with these gremlins meant having strong processes, tools in place and the right people. That the combination of the three is what it will take to keep the Gremlins away.

Ntirety realized that home grown tools will never compete with a commercial solution like Precise suite. The combination of very seasoned DBAs, Precise Software Solution, strong processes has enabled Ntirety to have near perfect Client satisfaction from the inception of the company. The Precise solutuion has also enabled Ntirety DBA's to be so production, that we can keep prices very affordable.

As technologies virtualization take hold, the effect of gremlins will only get worse. Mike Vizard Latest  article is titled “How to Avoid Being Driven Mad by Managed Services”.

Here is a sample of the article..
When it comes to anything related to information technology, it’s always the little things that ultimately kill you. And nothing can kill a managed service business faster than all the costs associated with tracking down some intermittent performance issue that cannot be easily replicated.

Anybody running a managed service, or for that matter anybody in IT, has seen their share of gremlins, otherwise known as those inexplicable issues that adversely affect the performance of an application. There’s always a rational explanation. But how much time it will take to ultimately determine the cause and then fix it is anybody’s guess.

I think the article is posted on Eweek Channel Insider and is worth a complete read…..
How to Avoid Being Driven Mad by Managed Services

Posted by Michael Corey

www.ntirety.com

The latest article comes from the U.K. An interview was done with Steve Wozniak. They asked him his opinions on Apple, the Iphone, the Ipod and so much more. It also did a wonderful job of giving you a sense of who Steve is. A bit of his history. I enjoyed and and would like to share it with you....

Steve Wozniak interview: iconic co-founder on the iPod, iPhone, and future for Apple

In an exclusive interview with the Telegraph, Apple co-founder Steve Wozniak wonders how long the iPod can stay on top spot, laments the limitations of the iPhone 3G, agrees with the downgrade on Apple shares and believes that Web 2.0 revolution has been over-financed and could lead to mini-crash in technology stocks.

By Rupert Neate 

Steve Wozniak was such a chronically shy teenager he could barely summon the courage to speak to other kids, instead he would spend his evenings tinkering with calculators and dreaming of super computers.

He's a different man today. Mr Wozniak, or Woz to use one of his many nicknames, has just had a roomful of high-powered businessmen in stitches as he recounted the rocky beginnings of one of the world's most loved companies.

Mr Wozniak is the electronic engineering genius who co-founded Apple with marketing ace and teenage friend Steve Jobs.

His first love was an Iraqi super computer, a poster of which he had pinned to his bedroom wall. "I told my dad I wanted to buy one, he said it would cost as much as our house. I replied: 'That's OK I'll live in an apartment'".

During his years studying, but not completing until decades later, electrical engineering and computer sciences at the University of California (Berkeley) he started down the road to professional technology development by taking on freelance commissions to design software for established companies.

When he was given his first commission to design a computer game for Atari he could barely contain his excitement. "I thought 'Oh my god, It would be the highlight of my life to design a game that kids would actually use. Steve and I didn't sleep for two days to get it done on time." His enthusiasm and creativity is clearly undiminished to this day: he still lies in bed at night imagining the next world changing "killer app".

The two Steve's were polar opposites but their differences made the company they founded, which now has market capitalisation of $92bn, work. "Steve was into everything hippy, he ran around shouting 'free love man' and eating seeds" as he embraced the flower power set. While "the second Steve", as Mr Wozniak became known, was still unable to overcome his nerves.

Even when he landed his dream job at Hewlett Packard developing calculators he was "still the sort of person who would never have a wife or a family" so he would go home watch a little Star Trek and then work on projects all night.

Indeed Apple may never have seen the light of day if Hewlett Packard (HP) had recognised the 58-year-old Californian's flair and creativity. His idea for the Apple I computer, which would transform the future of personal computing, was turned down by his employer no less than five times. "Oh my god, I wanted it so badly," he recalls.

Bill Hewlett, co-founder of HP with Dave Packard, later simply said "you win some, you lose some".

Despite the constant knock backs, Mr Wozniak was "almost too ethical" to leave HP when "the angel" Mike Markkula offered 'the Steves' $250,000 to set-up their own company. "I thought I owed it to HP to stay. But Steve [Jobs] got at all my family and they convinced me I had to do it".

Although he has been "basically retired" from Apple since 1987, it is clear his love for the company will never be diminished. He was never in it for the money, as his surprisingly frank and honest comments on the future of the company and the technology industry testify.

Last week Apple's shares tumbled nearly 20pc after two analysts downgraded the stock on fears that the consumer spending slowdown could seriously hit future profits.

While many company founders would steer well clear of commenting on valuations, Mr Wozniak says the downgrade was "correct": an admission which could wipe further millions of the shares which have fallen by from a high of $179 in August to just over $100 on the close last week.

In fact he believes: "It is time for the whole computer industry to maybe have a bit of a slowdown. For twenty years we have been in this replacement and upgrade market," he says. "It is very easy to postpone that when there are financial irregularities."

He says investment houses' over-valuation of web 2.0 and social networking websites could even lead to a minor version of the dotcom crash which saw $5 trillion wiped of the market values of technology companies between March 2000 and October 2002.

I begin to wonder whether he was even briefed by the Apple press office when he predicts the imminent death of the company's most popular product, the iPod.

"The iPod has sort of lived a long life at number one," he says. "Things like, that if you look back to transistor radios and Walkmans, they kind of die out after a while.

"It's kind of like everyone has got one or two or three. You get to a point when they are on display everywhere, they get real cheap and they are not selling as much."

Mr Wozniak even speaks out against the iPhone 3G, Apple's latest cult product which caused pandemonium in the West End when it was launched in Apple's Regent Street store this summer.

To read more about what steve had to say.......

I enjoyed learning more about Steve. I found his comments on the IPOD, dead on. I love my IPOD, I use it every day. But I do agree its just a matter of time before its displaced. His comments on the IPHONE, for those who clicked on the entire article. I am sure apple was not too happy about.

Posted by Michael Corey

www.ntirety.com

A number of annoucements have come over the wire today. They all talk about Microsoft SQL Server add-on code-named Kilimanjaro that is due to be released in 2010. Annoucement after annoucement kept coming out. I was planning on ignoring it. I thought to myself, SQL Server 2008 just came out this year. Why are we hearing about Kilimanjaoro. It reminded me of when IBM would launch a press release on a fututre product and the world would stop and wait till the IBM version came out.

Then it struck me yes, I want to hear about  Microsoft SQL Server Kilimanjaoro now. With Databases growing 3-5 times there size every 3 years. I need to know Microsoft SQL Server will be able to handle  hundreds of terabytes or even a petabyte of data in the next few years. I need to know It will have that capabilty, becase every day I look at my SQL Server databases and they keep getting bigger and bigger. 

So with that in mind let me share with you the information week article. Since it talks about  Microsoft's first data warehouse appliance, code-named Madison. Given the Oracle Exadata annoucment its only fitting we talk about the Microsoft data warehouse appliance. 

Microsoft Reveals Plans For 'Kilimanjaro' SQL Server

I know this is a bit off topic, but that has never stopped me before. When I saw this I wanted to share it with you. This just came accross CNN news. Here it is.....

Bank of America to slash mortgage payments

The foreclosure prevention program is the most aggressive initiative undertaken yet to help stem the housing crisis.

NEW YORK (CNNMoney.com) -- A plan announced today by Bank of America will be the most aggressive foreclosure prevention effort ever undertaken by a U.S. bank.

The program, scheduled to start in December, will be open to distressed borrowers who signed up with Countrywide Financial between January 1, 2004 and December 31, 2007. Countrywide was acquired by Bank of America (BAC, Fortune 500) in July.

It came in a legal settlement that the company entered into with the attorney general offices of 11 states, who had sued Countrywide over predatory lending practices, but the company stated that borrowers in all 50 states will be eligible to participate in the program.

"The Countrywide settlement is a watershed moment for loan modification programs," said Mark Pearce, North Carolina's Deputy Commissioner of Banks and a member of the State Foreclosure Prevention Working Group. "This is, by far, the best [program ever], even better than the FDIC program with IndyMac Bank."

As part of the initiative, Bank of America will cut monthly housing payments, including mortgage, property taxes and insurance, to no more than 34% of gross income. The move is expected to help keep as many as 400,000 troubled borrowers in their homes.

Click here to read the entire article....

Bank of America to slash mortgage payments

 

This is a breath of fresh air. If the average joe were going to loose their house. The typical bank would say, pay up or get out. When a corporation is about to default on a 10 Million dollar note, the conversation is lets see if we can work something out. 

 

There are a lot of people out there who if they could have been given a little help, would still be in their homes. I am glad to see this.

Posted by Michael Corey

www.ntirety.com

 

Bank of America to slash mortgage payments

 

Since SQL Server 2005, Microsoft has had an awesome database platform to run your business on. SQL Server just keeps getting better and better. With 2008 we are seeing some wonderful refinements. They have also overtaken Oracle on a number of fronts. I think Security is clearly an area where Microsoft SQL Server has leapfrog ahead of Oracle with the latest release. I also feel Business Intelligence is another strong point of SQL Server. I saw an article recently that caught my attention; I thought I would share with you.

This is from DEVX.  

by Ty Anderson

"Let the Truth Ring Forth"

Gather 'round fellow database disciples and let us examine the truth concerning Microsoft® SQL Server® 2008. Let us gather together today and consider that SQL Server 2008 is the database platform of choice; a database that meets your enterprise data and software application needs. I speak especially to those of you who believe in another database. To you especially, I ask that you move to the front row as I speak words of wisdom and truth to you today.

Apologies for the evangelical tone, but the truth is, so much of the discussion around which database to use seems rooted more in emotion and belief than in fact. So let me take the tact of presenting you with facts to make your database decision that much easier.

No doubt Oracle® was the first to bring a high-performing relational database to market. First-movers always have an advantage initially. But over the years, Microsoft has steadily improved SQL Server to the product it is today. A product with a robust feature set that can meet the needs of almost any set of requirements.

There are more than a few of you who doubt this claim. You may even hold to some of the most common misconceptions regarding SQL Server. Misconceptions that might have been true in the past, but are no longer based upon facts. Here is just a sample of the more common SQL Server myths:

·         Market Leadership: Oracle® receives a lot of attention as the leading database vendor. The reason for this is because they lead in terms of revenue produced. Given that a typical Oracle® license costs more than a SQL Server license, using revenue to measure market leadership can be misleading. A better yardstick might be the number of licenses sold as it sheds light into the actual number of installations.

·         Enterprise Readiness: The phrase "Enterprise-Readiness" can include many factors. In this case, I refer to the scalability and availability of a database. Regarding scalability, SQL Server has proven to be highly scalable as evidenced by the results of testing done by the Transaction Processing Performance Council Their results show SQL Server to dominate the council's TPC-E Benchmark that tests performance using a representative customer workload (i.e. complex database schemas, referential integrity, RAID, etc).[1] Also, SQL Server 2008 provides a rich feature set of "Always On" technologies to increase data availability. With enhanced database mirroring, failover clustering, peer-to-peer replication, and backup compression (to reduce back and restore times), you have a rich set of tools to help ensure data is always available.

·         Security: SQL Server has included role-based security, security auditing, security-event tracking, encryption (file and network), and more for several releases now. SQL Server 2008 goes further to include a security-policy management system. This system will allow you to create database security policies and then propagate them across all database servers. SQL Server also includes features to help secure data against privileged users (i.e. DBAs). This feature prevents privileged users from accessing sensitive data (i.e. credit card numbers) that would normally only be accessible via the applications that own the data.

·         Business Intelligence Analysis: Anyone who believes Microsoft is not a key vendor in Business Intelligence doesn't know the facts. Gartner placed Microsoft in the Leader Quadrant for Business Intelligence Platforms.[2] Microsoft's BI platform includes data warehousing capabilities, analytics, reporting, and score carding (to name only a few). Additionally, SQL Server BI is tightly interoperable with other Microsoft technologies like Microsoft Office and Visual Studio. This tight compatibility provides efficiencies when looking to customize BI-related offerings. All these features are part of Microsoft's base product offering. Oracle®, on the other hand, does not include BI features in their base product; opting instead to offer BI features as a separate add-on product.

There is a lot more to this article. click here to see the rest....

Top 5 Reasons to Adopt SQL Server 2008

One of my favorite new features is the abilty to Govern resources. You can decide how much CPU, etc a particular resource is given. This lends itself to environments that want to do server consolation. A way to save money and yes even energy in todays "GO Green" world.  

Posted by Michael Corey

www.ntirety.com

As I was researching an article, I came upon an article at INFOQ. This was not a site I was familar with.The tageline of Infoq is Tracking change and innovation in the enterprise software development community. 

It had an interesting article that talked about how SQL Server 2008 had two page formats. It was clearly written by someone that seem to understand the inner workings of compression. It also talked about the roots of compression going back to SQL Server 2005. Let me share with you some of that article....

New Compression Features in SQL Server 2008

Posted by Jonathan Allen on Nov 15, 2007

The SQL Server compression story actually starts with SQL Server 2005. The Enterprise and Developer editions added a new storage format called vardecimal. This table-level option affects decimal and numeric fields. Values that require a lower precision than the field allows, for example storing 1.5 in a decimal(18,9), the storage needs are correspondingly reduced. In effect, it is a numeric version of varchar.

SQL Server 2008 goes far beyond this comparably simple trick. Chad Boyd writes,

However, Sql Server 2008's data compression is vastly different from this (though it still supports/includes the vardecimal format as well) - so different in fact, that if you enable data compression on a given table/index, the underlying row/page format is different - yes, that's right, you heard correctly - if you use compression (ROW or PAGE), the row/page format for Sql 2008 will be DIFFERENT from the existing row/page format (only for the table/index(es) you are using compression for). So, in Sql 2008, there are 2, yes 2, row/page formats for data. You may now be wondering "well, if the row/page format changed, how in the world did you have enough time to re-engineer every component in Sql Server that is aware of the format in such a small amount of time? The answer is that we didn't - the Storage Engine is the ONLY component in Sql 2008 that is aware of the new row/page format.

Row level compression drastically reduces the meta-data needed for variable length columns. Instead of storing the length of each field in 2 bytes, it now takes a mere 3 bits. Fields themselves are also smaller. Storing a 1 in an int field now only takes a single byte, though of course larger values may use up to 4 bytes.

If you are interested in learning more here is a link the entire article....

New Compression Features in SQL Server 2008

Kimberly L. Tripp m commented on how nothing is free. That with all new functionality comes tradeoffs. Kimberly is so right. All database tuning is about trade-offs. I also added Kimberly to my blogroll. Her blog entries are well worth reading. She is wealth odf knowledge when it comes to SQL Server. To not steal Kimberly' thunder here is what she posted...

Posted by Michael Corey

www.ntirety.com

One of the new capabilties of SQL Server 2008 is backup compression. This is a feature that has been much needed. The difference between SQL Server 2000 and SQL Server 2005 was like night and day. Now with SQL Server 2008, we are seeing some nice refinements. Backup Compression is a great example of this. Before this release if you wanted the benefits of backup compression you had to use a third party tool. I like that you now get this in the newest release. 

This new feature is incredibly easy to use....

BACKUP DATABASE Sales

TO SalesBackup

WITH COMPRESSION

Yes its that easy to use. At Ntirety we are in the business of Remote Database Administration.  When we bring in new triage people, we start off by teaching them SQL Server basics. They think to themselves, this is easy. When we start teaching them how to do the similar commands in Oracle, that when we get the deer in the headlight look.

How much compression you will see depends on the structure of your particular database. One of things I really liked was how easy it was in SQL Server 2008 was how easy it was to make compression the default behavior for all backups.

If you want to learn more about SQL Server 2008, check out the Ntirety Video Gallery.  We have lots of Videos we did in cooperation with Microsoft that talk about SQL Server 2008. Here is a link to the Video Gallery...

Posted by Michael Corey

www.ntirety.com

 In my life I have learned there are always two sides to every story. Why am I not surprised that vendors like www.netezza.com  have a very different opinion of the new Oracle Database Machine Exadata. On September 29, 2008  Internetnews published such an article in their web site.I miss the days of computerworld, when they were a paid publication and would take everyone on.

Oracle's Rivals Dismiss Hardware Foray

Where the beef? is the operative phrase

By Richard Adhikar

Oracle's competition is rejoicing over the company's announcement of the HP Oracle Database Machine, unveiled with much fanfare at Oracle OpenWorld 2008 in San Francisco earlier this week.

In announcing the product, Oracle (NASDAQ: ORCL) CEO LarryEllison told a packed hall that the rapid proliferation of data hasforced his company to go beyond software for a way to move data offdisks into the database server fast enough to cope.

He positioned it against offerings from Netezza(NYSE: NZ), which he said uses B-Tree, "which is old, I learned when Iwas in college," and from Teradata (NYSE: TDC). Both Netezza andTeradata, however, contend their products are superior to the HP (NYSE:HPQ) Oracle Database Machine.

"Our largest machine has 860 processors, so when we talk aboutmassively parallel, it's considerably more massive than Oracle's," TimYoung, vice president of marketing at Netezza, told InternetNews.com. Netezza offers an applianceconsisting of an SQL database stored on the disk rather than on theserver, and up to 860 snippet processing units, each consisting of afield programmable gate array (FPGA) and an IBM (NYSE: IBM) PowerPCchip running Linux.

"Whilst Larry says nasty things about us, the level of interest inNetezza since his keynote has skyrocketed," Young added. "On Wednesdaymorning most people on the planet had never heard of Netezza and onThursday morning thousands of people had heard of us." 

To read the entire article......

Posted by Michael Corey

www.ntirety.com

Before I get into days topic. Common mistakes People make when working out. I wanted to do a quick historical walk, if there is such a thing.

When I started this blog it was my intention to stick to pure technical topics. I planned to fill this blog up with lots of useful information on how manage your Oracle and Microsoft SQL Server databases. That information is here if you take the time to read through the many blog submissions. For example.....

Oracle and Microsoft SQL Server Database Administration Information

7 Deadly Sins Of Microsoft SQL Server Database Management (Sin 1)

7 Deadly Sins Of Oracle Database Management (Sin 2)

Pandemic Flu And Your Oracle or Microsoft SQL Server Database 

What I realized was variety is the spice of life. 

That to have this only be about technical information would be no fun for me to write and no fun for you to read. So over time, I have picked some pretty diverse topics. Here are some examples..

Pretty Diverse Topics

Internet Outage Hits India, Middle East Again!!!!!!

Space Exploration Technologies Launches First Rocket

Get Just The Facts And Only The Political facts

 The 2nd New Mafia (The Record "RIAA" Industry)

 Along the way, I have had some fun. Here are some examples of article that I really enjoyed posting....

Having Some Fun 

Go slow and see the Imangination of a Painter

Very Funny - A Human Mirror On The N.Y. Subway

Well my latest article is on working out. The common things people do wrong when they execise. 

Common Workout Mistakes People Make

For this I turn to an article I saw on Theiflife. It caught my attention. It was titled....

The Biggest Workout Mistakes People Make

 I see it in every gym, people giving 110% doing some of the craziest things. People spending hours and hours in there daily for 7x a week, yet they look the same month after month. Clients spending $1000/month on private training yet their trainer has them doing stuff that is not even related to what their goals are. What is going on? There are more people working out nowadays, belonging to gyms, hiring personal trainers, buying supplements, on so called “diets”, and yet the results are not showing! Sadly it seems most people are making so many mistakes when it comes to training, yet they just keep right on trying. If we can see what we need to be doing, and more importantly what we don’t need to be doing….then maybe the results will start to finally show! These are the biggest workout mistakes that I see today:

 I will tease with a few that resonated with me quite a bit.....

Focused on How Many Calories are Burned Working Out: Honestly what does this matter in the overall scheme of the whole day and fat burning? Assuming that fat burning is your goal, does that mean doing more and more exercise just burns more and more fat? NO! Who said you are even burning fat in the first place? What about stored glycogen? What about breaking down muscle? What about that subway sandwich you had an hour ago? Really this mentality is what is keeping most people from focusing on what matters, your eating! Diet/Nutrition is where 85% of your results come from and will even tell the body hormonally when to burn fat, and when to NOT burn fat. Forget how many calories you are spinning away, you don’t know what is really going on inside of you. Prime your body for all day fat burning and use your workouts as the right hormonal trigger for it.

Having No Real Set Plan (aka “Winging It”): While you don’t need anything overly complicated, you do need to have a plan. Whatever it may be, you need to know if you are progressing in your workouts and not just doing whatever exercises you “feel” like doing. That and you need to keep your rest periods short to get through your workout in 30min (40max). If you can’t get a workout done in 30min, you need a new plan! Most people at the gym are socializing and trading facebook profiles, and they also stay there for hours and look the same month after month. Do your workout, have a plan, get out of the gym and get on with your life……as life should be more than just working out.

• Mentality that You Need a Gym to Get in a Good Workout: This is probably the worse mental mistake people are making. Say you don’t have time to get to the gym, or are on the road travelling, or whatever other excuse you want to use…..so does that mean you can’t workout? NO. But many people will not because the gym is seen as the only place that they can workout. The gym industry is a tragedy in the sense that they make most their money off the 90% of people who sign up, show up for a week or two and then come back like 3x in the next year….yet get billed monthly. If you knew the break even point on membership for gyms you would probably laugh (as a small gym may need 500-1000 members, and a bigger gym 10,000+). You don’t need a gym to go run a trail, do some pushups on your living room floor, lunge across the kitchen, take the stairs at work, do some pullups at the park on the kid’s monkeybars, or whatever. No more thinking you need the gym….the gym may need you, but you don’t need it!
• Keep Your Main Workouts Short and Intense: It doesn’t matter how many calories you burn during a workout, what does matter is how much fat you can burn all day! Short and intense workouts are not only great to stimulate fast twitch muscle fibers but to also get the right hormones going (such as GH) to burn fat and build muscles. Keep your rest short (30 sec) between your sets if you are lifting weight and add intervals before any cardio session. Doing that along with proper eating will get amazing results.

This article was loaded with great information. I would encourage you to read the entire article. Here is a link to it....

The Biggest Workout Mistakes People Make

As I read this article, it struck me as advice we could all use. We can all find 30 minutes to make ourselves healthier. We need to find time to take care of ourselves. 

As I went to the home page of Theiflife. They have have a picture of Jack Lalanee. I want to share the picture with you. and a quick snipit from the article. 

Jack LaLanne Speaks…We Should Listen

I think most of us have heard of Jack LaLanee before, he is amazing. As he turns the ripe young age of 94 tomorrow,  he is still active, working out, swimming and mentally sharp as a tack (which is rare nowadays with the aging population). It’s amazing to see someone not only that old, although he may not like being called old so I’ll say “aged” instead, but more importantly functional, strong and smart as ever. Jack has been around a long time preaching the benefits of exercise and proper nutrition and a true motivator at heart. He’s a walking lesson for everything he preaches, so let’s see some more from him below.

Jack is an amazing guy to say the least. If you asked be a year ago when I started this blog would I be writing about Jack Lalanee, I would have said no. 

Posted by Michael Corey

www.ntirety.com

Today was the Microsoft Northeast Partner Briefing.  Ntirety because of its strong relationship with Microsoft was invited. I always take the time to attend if I can. I have been to a number of these. With my strong Oracle Pedigree I always get a charge out of attending. I don’t know too many people who can claim to have worked on Oracle Version 3.0. On top of that have written a number of Oracle books. So I guess I have a right to say I have a strong Oracle Pedigree.

So here I am an Oracle guy attending the Microsoft Northeast Partner Briefing. One of the things that got mentioned numerous times in the meeting, was how Partnering was part of Microsoft’s DNA. Early on Bill Gates recognized the power of partners and made it part of how Microsoft does business. As I reflect on my interactions with different companies over the years, I have to agree with this statement. Partnering is part of Microsoft’s DNA.  In my many years of trying to partner with Oracle, it has always been tough. They would talk partnering but then would do anything but. Each new manager would come in and talk about the New Oracle that was partner friendly, put a new program in place and then within a few months revert back to its old ways.To partner with Oracle meant pulling your own wagon. It’s only been recently that I have seen any change.

So when I first started partnering with Microsoft it was a breath of fresh air. They make it easy to do business with them. I love working with the New England office. They are a dedicated group of people that work hard to do right by the client and right by the partner. Everyone benefits with this approach. What I came to realize today is Partnering is part of Microsoft’s DNA, that is the difference.  It started from day one at the company’s inception and has been nurtured ever since.  

At Ntirety we are very proud of our relationship with Microsoft. At Ntirety we only do 1 thing. We are the Database Administration Experts. We do this for Oracle and Microsoft SQL Server databases. Microsoft SQL Server Databases are half our business. We believe we are the largest provider of remote database administrators in the world for Microsoft SQL Server databases.

The Keynote Speaker at today’s event was Kevin Turner, Chief Operating Officer at Microsoft. Kevin Turner came to Microsoft from Wal-Mart. One of his claims to fame was he has worked for both Bill Gates and Sam Walton. Kevin was a really great speaker.  He shared with us Microsoft’s vision. It talked about creating an experience that combined the magic of software with the power of the Internet with the power of Internet services across a wide array of devices.

He talked about how Microsoft was committed to writing every piece of important software.

At one point there was a discussion about why we need nerds (STEM). I was so impressed on how well versed Kevin Turner was on this issue.  The lack of people entering Science, Technology, Engineering and mathematics fields in this country is a huge problem.  When this was brought up, Kevin Turner was all over this issue.

In my home state Massachusetts; I was appointed to the Robert H. Goddard Council of Science Technology Engineering and Mathematics.  This council was established in the 2006 Economic Stimulus legislation, the Robert H. Goddard Council is comprised of 27 high-level representatives from business and industry, state government, and K-12 and higher education in the Commonwealth. The Council was created to advise the Board of Higher Education and the legislature on STEM workforce development programs and policy.

The Council is named for Robert H. Goddard, who is credited with being the first to construct and successfully launch a liquid-propelled rocket in Auburn, Massachusetts, in 1926.

To learn more…..
 Massachusetts Robert H. Goddard Council on Stem

This country and our way of life is at risk. We no longer turn out very many people in the STEM fields. The combination of this, and the fact that our immigration policies are making it hard to bring this skill set in from other country is putting our country at risk. In Massachusettes we are trying to do something about it. 

Kevin Turner shared with us many of the things Microsoft was doing.  It was great to see that a company like Microsoft understood the issue and was trying to make a difference. He talked about an offer of free microsoft software for college students. He also talked about how much Microsoft was investing in R & D. 

Kevin also talked about the Turbulent financial times and what this means. He shared with us advice Sam Walton had given him. The gist was we  have a choice of what we do in times. We allow ourselves to be swept away or we step up to the plate and choose not to participate. We as business can thrive if we take the right steps.
As I think about this, I think its so right. I always say to my kids. There are winners and looses. You can choose to be a winner, or you can choose to be a looser. Its about choice and the actions you take.  Kevin shared with us this quote..

Winning is not a sometime thing; it's an all time thing. You don't win once in a while, you don't do things right once in a while, you do them right all the time. Winning is habit. Unfortunately, so is losing.

Vince Lombardi

Its so true. Winning is a habit. 

We then had a nice Q & A session. I walked away feeling better than ever in my choice to partner with Microsoft. They are easy to work with. There is a class-act group of people in the New England office. They are committed to making sure, the customer and the partner are successful.

I attended a break out session on upgrading to Microsoft SQL Server 2008. Notes from early adopters and best practices. I walked away with some great information. When SQL Server 2005 came out, I thought it was an awesome release. I thought to myself watch-out Oracle. They gave us a great product.

The latest version of SQL Server 2008 is yet another major improvement.

If you would like to so see some Video Clips on SQL Server 2008 go  to the Ntirety Website Video Galley. Tony Piltzecker, Technology Specialist with Microsoft corporation talks about SQL Server 2008 quite a bit.
 

Ntirety Video Gallery.

Two capabilities that came out loud and clear. Was just what a great job they did on security this release. They have clearly over taken Oracle on the security front. This is huge.  The other thing is the advancements they have made that will make server consolidation so much easier.

I also attended a break out session on Performance Point. When I look at the Microsoft BI suite and capabilities and integration, I don’t thing anyone else comes close.  Its just such a power suite of capabilities.  Seeing it all was like drinking out of a fire hose I just could not write it all down fast enough.

Posted by Michael Corey

www.ntirety.com