With this release, Windows Live Photo Gallery becomes more of a full-fledged consumer photo editing tool/organizer on a par with the Apple’s iPhoto ($79 Direct, 4 stars), Google’s Picasa (Free, 4 stars); it even matches some of Adobe Photoshop Elements’ power ($99.99 direct, 4 stars). The new big-ticket features in Windows Live Photo Gallery 2011 are face recognition and geotagging, but the application as a whole feels more polished and powerful than earlier incarnations.
View Slideshow See all (19) slides
Windows Live Photo Gallery Images : Installation Choices
Windows Live Photo Gallery Images : Start Importing
Windows Live Photo Gallery Images : Import Groups
Windows Live Photo Gallery Images : Home View

Best online Microsoft MCTS Training, Microsoft MCITP Training at certkingdom.com

Interface
Windows Live Photo Gallery’s new release now feels more like a full-blown image editing application than it has in any previous version, yet manages to maintain its ease of use for general consumers. The main window is now adorned with an Office-like ribbon toolbar across the top; and the new Find tab lets you filter by keyword, rating, date, face, and more. Below the ribbon is a three-panel interface, showing your folders on the left, the images in the middle, and actions like tagging and editing in a right pane.

As in more advanced photo apps like Lightroom, double-clicking an image in Windows Live Photo Gallery brings it up, and doing so again returns you to gallery view. At the bottom right, there are rotate image arrows, next and previous buttons, and a zoom slider that lets you size both thumbnails and single image view to whatever zoom level you want (the mouse wheel can also be used for zooming). Holding the left mouse button lets you pan around the photo, which I found to be a very fluid way of navigating images.
Specifications

Type
Personal, Professional
Free
Yes
OS Compatibility
Windows Vista, Windows 7

More

I do wish the left panel offered a Last Import option the way iPhoto does. The Find tab, however, can fill this role; it lets you limit the gallery view by date, month, or year taken, as well as by the people in the pictures, star ratings, and flagged status. You can also click the binocular icon to search within those results. If the default interface doesn’t suit you, you can customize it by adding or subtracting options from a quick access toolbar located either below the ribbon or up in the window border to save viewing space.

Photo Importing
The import experience is just what you’d want. As you import, you can group photos by date and time, add tags, add the date to filenames, and now set a base file name. Raw camera files are supported, but only if you’ve installed your camera manufacturer’s codec in Windows. Fortunately, gallery tells you if you need to do this, and it even takes you to the camera manufacturer’s download site.

I found working with large raw files slower in Windows Live Photo Gallery than in pro-level apps like Adobe Photoshop Lightroom 3 ($299 Street, ), and unlike iPhoto and Picasa image adjustments didn’t work with raw images.

Photo Editing
All the expected photo adjustments are on offer: cropping, red-eye fixing, straightening, exposure, color correction, and even noise reduction. Buttons let you apply fixes automatically, but a “Fine tune” button offers deeper control (such as an adjustable histogram, highlights, shadows, sharpness, and color temperature). This version adds a new tool: Blemish removal, which worked excellently in my testing, as did the red-eye fix.

An Auto-adjust option lets you configure what you want fixed—any combination of exposure, color, NR, and straightening. It did a mostly good job on my test images, never drastically exaggerating brightness or other factors, as some editors occasionally do. The editing is non-destructive, so, at any point, you can revert to the original. A new batch edit lets you apply fixes to a bunch of selected images at once, but it only works with the auto-fixes—color, exposure, straightening, and noise reduction—not with the fine-tuning.

Jazzing Up Photos
Gallery doesn’t offer frivolous frames, doodads, or wild effects to embellish your pictures the way some tools like Roxio do. Instead, it gives you a few tools for tasteful effects: Sepia, cyan, and black and white. The app’s panorama-stitching feature has long been impressive for a free tool; iPhoto or Picasa still don’t offer an equivalent ability.

An innovative new Photo Fuse option lets you get everyone’s best look in group photo composited from multiple shots. It’s sort of a companion to the application’s panoramic stitch tool, and comparable to what you find in Adobe Photoshop Elements. My results were intriguing but not perfect—some people ended up with big hair, or worse, two ears on one side of the head.

Photo Gallery now joins Elements, iPhoto, and Picasa in offering a retouching tool for blemishes. It worked beautifully at correcting skin discolorations in my tests, and more simply than Picasa’s, which requires you to select a source and target area.

We’ve been big fans of Google’s Picasa photo software for years—it’s been our Editor’s Choice for entry-level photo organizing and editing since version 2. Version 3.8 adds even more polish, with “Face Movies” (more on this later), batch uploading, integrated editing with Picnik, and an extended Info panel. These join Picasa’s already astounding face-recognition, geo-tagging, leading ease-of-use, and integration with Picasa Web Albums. So no matter what your computer’s operating system, Picasa is the best choice for digital photo fans who want the best way to organize, improve, and share their digital photos.

Interface
Picasa has one of the most innovative, intuitive, and usable interfaces around. Instead of using a standard scrollbar to move through your photo sets, you get a “shuttle”-type control that accelerates you through the galleries. This makes a lot of sense, especially after you’ve built up a good size library of galleries. The interface view is of the three-panel ilk, with source organization on the left—albums, people, dated folders, the thumbnail or full image in the center, and options and info on a left panel for things like tags, people places and camera EXIF metadata. A further metadata improvement in version 3.8 is the ability to display standard Adobe XMP info, which includes info like titles and descriptions.
View Slideshow See all (18) slides
Google Picasa 3.8: People and Places
Picasa 3.8: Importing Gets Easier
Picasa 3.8: Unnamed People Album
Picasa 3.8: Naming the Unnamed

More

Best online Microsoft MCTS Training, Microsoft MCITP Training at certkingdom.com

Updating Picasa to version 3.8 is an automatic snap, once you check in the Help menu for updates. This downloads, closes, and installs the new version without requiring any futher intervention on your part. And it didn’t require long reprocessing of the images as the Apple iPhoto ’11 update did. If you’re installing for the first time, you’ll get a choice of having the app scan your hard disk or just My Documents, My Pictures, and the desktop for image files. The scan is fast, and a small gray bar on the right-hand side of your screen shows its progress. From then on, any photos added to those folders will be imported automatically into Picasa. This automation beats that of enthusiast-level app Photoshop Elements, in which you have to specify the exact folder of images to manage.
Specifications

Type
Personal
Free
Yes
OS Compatibility
Windows Vista, Windows XP

More

Next, a dialog proposes that you use Picasa’s Photo Viewer as a replacement for Windows’ Preview, the default app launched when you double-click an image file’s entry in Windows Explorer. The viewer gives easy access to editing, uploading, and slideshow playing, and on a fast system its startup delay won’t be significant. Picasa’s viewer also takes an interesting approach to displaying an image by centering it with no border, graying out the rest of your screen.

You don’t get Apple iPhoto’s slick thumbnail skimming, but you get a couple more important abilities, like being able to zoom or rename a photo whether you’re in library or edit view. There’s also Picasa’s handy hand tool that lets you drag around large, zoomed in images, rather than just using iPhoto’s thumbnail navigator. On Windows, Picasa can match iPhoto’s full-screen view, but the Mac version can’t, and the darker iPhoto interface does give more prominence to your images.

As you’d expect from a Google product, Picasa’s search feature is top-notch, including searching by tags, captions, date, and camera. Convenient buttons let you limit the library view to show just movies or photos that you’ve starred, uploaded photos, or those containing people or geo-tags. iPhoto has a powerful search box, but it lacks the quick filtering buttons, while Windows Live Photo Gallery 2011 offers a Find tab with comprehensive searching options.

Import and Organize
When it comes to importing and organizing your pictures, Picasa is alone in its class. Even before importing, it organizes photos by time groups, and you can view, rotate, and star photos. To its credit, Windows Live Photo Gallery adds the ability to add tags during import, though it can’t rotate and star.

It also had no trouble with camera RAW files in my tests, to which it could apply all its fixes and enhancements. iPhoto, too, works fully with RAW files, but Windows Live Photo Gallery can only import and display them—no editing. Picasa helpfully shows a text overlay saying “Rendering” when the image hasn’t displayed to full resolution; with iPhoto, by contrast, you have to eyeball and guess when the image has reached full res.

As with iPhoto, Picasa’s photos are automatically organized by date, you can create your own albums with pictures from any folders; adding photos from anywhere within Picasa is easier than in Apple’s iPhoto ’11, though, with a simple right-click option. Photo Gallery only uses folders, rather than albums.

But the one organizational tool that makes Picasa shine brighter than the rest is in its face recognition. All three major entry-level photo apps have gotten really good that this, but Picasa does the best job of identifying your photo subjects’ visages. The program automatically scans images for faces, and creates an Unnamed folder under People in the source list. After you identify some people, the program suggests more potential photos with likely faces to match the names.

In my tests, I found Picasa’s People feature and Windows Live Photo Gallery’s, similar feature both made good guesses about people’s identity earlier than iPhoto did. Picasa’s process of confirming faces was slightly quicker. In iPhoto and Windows Live Photo Gallery, I was presented with inanimate objects that looked like faces. All three let me play slideshows of just pictures containing a selected face, but Picasa was the only that could create a “Face Movie” of images zoomed in to show just the faces.

I do like iPhoto’s full-window Place’s map that can show all the places in the world your photos were taken, but Picasa did just as good a job finding specific locations for your photos using a search box, and more importantly, it preserves face and geo-tags for photos uploaded to its Web Albums. Neither iPhoto nor Windows Live Photo Gallery offer maps on their Web galleries. A separate Geotagging feature also lets you place your Photos on the Google Earth globe.

Edit and Enhance
Picasa makes it dead simple to get your photos looking good, even if you didn’t have all the settings right when you took the shot. Its “I’m Feeling Lucky” button did at least as good a job at one-click photo fixing as iPhoto. In most cases, Picasa did better than Windows Live Photo Gallery, though I liked how the latter’s autofix straightened pictures as well as attempting to fix lighting and color. Picasa actually trails those two in that it doesn’t let you manipulate a photo’s histogram.

Picasa’s red-eye correction works well and, like iPhoto’s, finds and corrects all eyes automatically. Windows Live Photo Gallery still makes you find the eyes yourself and drag a box around them, but its results are fine. I got slightly better results with iPhoto’s blemish retouch tool than Picasa’s or Windows’, but Picasa lets you choose a neighboring area to match the color of the area you want to fix, which can be helpful in some cases.

For fun effects Picasa was on par with iPhoto, adding matte and vignette effects to the usual black-and-white, sepia, and saturation. Picasa adds the very cool “Focal B&W” effect which puts all but a target object in the image in B&W; and with version 3.8 Picasa now adds an “Edit with Picnik” button, which integrates the well-regarded online photo app to add a slew more effects.

Microsoft’s monthly patch release for April 2004 caught a number of security specialists by surprise due to the number and severity of the vulnerabilities fixed. The four new Microsoft Security Bulletins are:

* MS04-011 “Security Update for Microsoft Windows”
* MS04-012 “Cumulative Update for Microsoft RPC/DCOM”
* MS04-013 “Cumulative Security Update for Outlook Express”
* MS04-014 “Vulnerability in the Microsoft Jet Database Engine Could Allow Code Execution”

Additionally, Microsoft has made major revisions to four earlier Security Bulletins (one from each of the past four years)—MS00-082, MS01-041, MS02-011, and MS03-046—as detailed at the end of this article.

Details
According to a CNET News.com report, Microsoft says that some of these fixes have been available for months but the company delayed the release of patches to ease the burden on harried administrators.

With the release of these patches, numerous companies are coming forward with distressing information about just how long many of these critical vulnerabilities were known. Symantec, for example, has been sitting on an Outlook Express MHTML vulnerability since November 25, 2003, waiting for Microsoft to release a patch that has been included in MS04-013.

Best Microsoft MCTS Training – Microsoft MCITP Certification at Certkingdom.com

eEyeDigital Security, which has been given credit for discovering six of the recently patched flaws, reports that some of these had been known for more than 200 days before being patched.
Author’s note
Please note that any of the Mitre CANdidate listings for individual vulnerabilities listed below can be accessed using this URL format: www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0807. Simply substitute the correct year and item number after CAN.
MS04-011
This “Security Update for Microsoft Windows” replaces some earlier bulletins and also covers some new threats. The patches provided address:

* LDAP Vulnerability (CAN-2003-0663) – A denial of service (DoS) threat
* PCT Vulnerability (CAN-2003-0719) – A buffer overrun may allow an attacker to take over a vulnerable system
* Winlogon Vulnerability (CAN-2003-0806) – A buffer overrun allows remote execution of arbitrary code
* Help and Support Vulnerability (CAN-2003-0907) – A remote code execution threat
* Utility Manager Vulnerability (CAN-2003-0908) – A privilege elevation threat
* Windows Management Vulnerability (CAN-2003-0909) – A privilege elevation threat
* Negotiate SSP Vulnerability (CAN-2004-0119) – A buffer overrun may allow an attacker to take over a vulnerable system
* SSL Vulnerability (CAN-2004-0120) – A DoS threat
* ASN.1 “Double Free” Vulnerability (CAN-2004-0123) – A DoS threat
* LSASS Vulnerability (CAN-2003-0533) – A buffer overrun allows remote execution of arbitrary code
* Metafile Vulnerability (CAN-2003-0906) – A buffer overrun allows remote execution of arbitrary code
* H.323 Vulnerability (CAN-2004-0117) – A remote code execution threat
* Local Descriptor Table Vulnerability (CAN-2003-0910) – A privilege elevation threat
* Virtual DOS Machine Vulnerability (CAN-2004-0118) – A privilege elevation threat

MS04-012
This “Cumulative Update for Microsoft RPC/DCOM” fixes vulnerabilities identified as:

* COM Internet Service and RPC over https: (CAN-2003-0807) – A DoS threat
* RPC Runtime Library (CAN-2003-0813) – A DoS threat caused by a race condition
* RPCSS Service (CAN-2004-0116) – A DoS threat
* Object Identity (CAN-2004-0124) – An information disclosure threat

MS04-013
This “Cumulative Security Update for Outlook Express” replaces MS03-014 and all previous Outlook Express updates.

MS04-014
This “Vulnerability in the Microsoft Jet Database Engine Could Allow Code Execution” is a remote code execution threat that results from a buffer overrun. An exploit would require that the attacker craft a special database query and send it to the Jet Database. The only vulnerability covered by MS04-014 is CAN-2004-0380.

Microsoft Security Bulletin MS03-011, “Flaw in Microsoft VM Could Enable System Compromise,” reports that a critical-rated vulnerability has been found in all versions of Microsoft’s Virtual Machine, the software that runs Java applications in Microsoft Windows and Internet Explorer.

Details
The newly discovered vulnerability is due to a flaw in the way the ByteCode Verifier loads. This is a low-level process that determines whether the Java code is valid. A carefully crafted applet on a Web site or sent via HTML e-mail could bypass any security checks.

For more information about how Microsoft supports Java, see the Microsoft Virtual Machine index page. On that page, you’ll also find links to the current status of the legal wrangling between Sun and Microsoft over just which version of the Virtual Machine will ship with Microsoft products.

Best Microsoft MCTS Training – Microsoft MCITP Certification at Certkingdom.com

Applicability
According to the Microsoft Security bulletin, “all builds of the Microsoft Virtual Machine up to and including build 5.0.3809 are affected by these vulnerabilities.” The Microsoft Virtual Machine is likely to be found running on all versions of Windows starting with Windows 95. To determine whether your system has Microsoft Virtual Machine installed, open the command prompt and run the command jview.

If the Microsoft Virtual Machine is installed, the program will execute and present a list of options. The top line will also include the version number. For example, this might be 5.00.3161 on an early Windows XP installation.

The latest version of the Microsoft Virtual Machine is 5.0.3810. If you have that version installed—or you don’t have the Microsoft Virtual Machine installed at all—no action is required.

Risk level–critical
Exploiting the hole in this piece of code can enable an attacker to run arbitrary code on the penetrated system.

Mitigating factors
As usual with this sort of threat, the attacker needs to entice a user to visit a particular Web site or open malicious HTML e-mail. Any system that has been configured so that HTML e-mail is opened in the Restricted Zone will be safe from this attack.

On a network, this attack will grant the same privileges as those held by the user who was attacked. Firewalls may provide protection against this attack vector.

Fix–Upgrade Virtual Machine
The new VM build, which Microsoft reports can be installed on Windows 98 and later systems, addresses all the issues discussed in the following Microsoft security bulletins:

* MS99-031
* MS99-045
* MS00-011
* MS00-059
* MS00-075
* MS00-081
* MS02-013
* MS02-052
* MS02-069

Microsoft doesn’t specifically say that you can’t install this new build on Windows 95 systems, so it may have been left out simply because the company no longer supports Windows 95.

Final word
Although users would have to be tricked into visiting a malicious Web site containing Java code designed to exploit this vulnerability, we all know that users can often be tricked into doing a lot of things, so this is a significant threat. I also have my doubts about just how many systems are properly configured to open malicious HTML e-mails in the Restricted Zone.

Best Microsoft MCTS Training – Microsoft MCITP Certification at Certkingdom.com

Microsoft has reduced the confusing array of volume licensing options to only four programs:

* Open
* Select
* Enterprise Agreement
* Enterprise Subscription Agreement

And although many IT managers have expressed their discontent with the possibility of subscribing to licenses, this could actually be a good solution for scores of companies looking to ease the administration of their licensing and its associated costs. Here’s a closer look at Microsoft’s new licensing and how it will affect different organizations.

Open License agreements are great for small organizations
Only five licenses are needed to acquire an Open License agreement, which has two levels of pricing: Open Business and Open Volume. An Open License provides opportunities for growing companies to receive volume license pricing from Microsoft. The customer’s discount level is determined by the first purchase of licenses; the discount then lasts for two years.

How do Select Licenses and Enterprise Agreements work?
With Select License and Enterprise Agreement, a company agrees to purchase a certain number of perpetual licenses for a minimum of 250 desktops. For Select, as the company grows and meets the various level requirements, Microsoft automatically promotes the agreement to the improved pricing level that’s reached. Monthly reporting for Enterprise Agreements determines the need to true-up or add to the current license-in-use amount, the number of licenses added that month. If you have a layoff or a division is sold, you still have to pay for those seats.

The greatest benefit of these agreements is indisputably the CD subscription kit. This provides the customer with a predetermined set of Microsoft Software CDs, including evaluation software, that doesn’t require separate activation codes. Windows XP is included.

Many people have worried that Windows XP’s new activation key would be a disadvantage to the enterprise customer, but Rebecca LaBrunerie, Microsoft Program Manager Volume Licensing, said that corporate Volume License Product Keys will be provided to each Select and Enterprise Agreement customer, which will make product activation unnecessary for those customers.

How about an Enterprise Subscription Agreement?
While the Enterprise Subscription Agreement has received a great deal of negative press, I would like to point out some benefits of this type of licensing for some companies. A subscription agreement provides reduced up-front costs to the customer and benefits corporations who “expect significant fluctuation in the number of PCs in the organization over three years.”

A subscription customer has a commitment to lease software over a three-year period at a reduced cost. Subscription customers have the added advantage of the opportunity to true-down their licensing for a period when the number of desktops is lower or reduced for some reason, such as a division of the corporation being sold or phased out. Be sure to check with your tax adviser, since there may be tax savings in leasing vs. purchase plans.

Software Assurance = new upgrade licensing
Organizations who sign agreements have the opportunity to enroll each application license in a new program called Software Assurance. Software Assurance is the new SKU available to Microsoft’s volume license customers, replacing all of the confusing CUPS, PUPS, LUPS, and VUPS upgrade options previously offered with Upgrade Advantage.

That’s right, I said replacing. All other upgrade options in volume licensing will be gone, and only Software Assurance is to remain for the Open/Select/Enterprise 6.0 customer. Software Assurance gives the customer rights to the latest version of each software application. Customers with an agreement in place who purchase hardware with OEM Microsoft products are eligible to enroll these products in Software Assurance within 90 days of purchase. Microsoft still recommends using the OEM versions of software, as they have been customized by Microsoft and the manufacturer to work properly with that specific hardware.

This offers the greatest advantage for those who are migrating hardware systems as well as operating systems. With Software Assurance on your server OS, Select and Enterprise customers are entitled to the latest version, and Microsoft does not object to running the two in parallel during migration. “We realize that that’s exactly how today’s IT manager[s] run [their] business and that they don’t deploy all at the same time. They just want to know they have the rights to it and roll it out at their convenience. With an Enterprise Agreement, they always have access to the latest versions of the products,” said LaBrunerie.

“Today, the IT manager, whether he has 50 desktops, 500, or 5,000, doesn’t always know what underlying licenses he owns based upon what version upgrades he has purchased. Within the last three years, he may have bought three or four types of upgrades, and now he doesn’t really know what he owns. So we’ve eliminated that confusing option and simplified it, so that he knows he either has the license or he has software assurance.”

BackOffice licensing changes
If you previously purchased BackOffice client licenses, contemptuously cursing because you had to pay for expensive SQL Server client access licenses even though you don’t use SQL Server, you will be happy to note that Microsoft has remedied this. BackOffice client licenses have been replaced with Core Client Access Licenses (or Core CALs). Core CALs include the following clients:

* Exchange CAL
* Systems Management Server CAL
* Windows CAL
* SharePoint Portal Server CAL

SQL Server CALs are now a separate product.

Online licensing tracking
Microsoft now has an online site called eOpen to track licenses purchased through Open Licensing and Volume Licensing Services to track licenses purchased through Select and Enterprise Agreements. This can further simplify management of your licensing by providing a central location for administrators to verify their current licensing situation and to always know exactly where they stand with respect to licensing of Microsoft products.

Existing Select and Enterprise customers
Select 5.0 and Enterprise 5.0 customers (who have an agreement in place prior to Oct. 1, 2001) still have the opportunity to enroll in Upgrade Assurance from Oct. 1, 2001, to July 31, 2002. The Upgrade Advantage Brief outlines this information. See Gartner’s report “Act now to cut Windows upgrade costs by up to one-half” for clarification on this change.

Other available agreements are specially tailored for academic organizations and government agencies. Additional details regarding Microsoft Volume Licensing Software Assurance can also be found at Microsoft’s Web site.

A snowball’s chance
It comes as no surprise that the vast majority of the members who responded were upset about the new license-activation process created by Microsoft.

Cert kingdom member Nbdyfool says he doesn’t see how software piracy could be truly hurting Microsoft and its profits, as its chairman, Bill Gates, is one of the world’s five richest people. He also finds it hard to sympathize with Microsoft when it’s apparent that the company is doing so well.

Another member, TechBoy 606, says he will not be making the jump to Windows XP because of its limited installations. He remembers when software installations were done by floppy disk instead of CDs, and the floppies counted the number of installs made by each disk. TechBoy also says that his job requires a lot of time already, and he won’t do anything that will require more time by e-mailing or calling a company about issues with licensing.

Best Microsoft MCTS Training – Microsoft MCITP Certification at Certkingdom.com

Member Nick Clark asks why Microsoft didn’t ask its clients for their opinions about piracy prevention:
“With this becoming such a BIG problem for us to adhere to, why hasn’t Microsoft asked us what we thought about piracy prevention? I know for a fact there are some Cert kingdom members that have had good ideas in the past when asked for ideas to real world issues. Microsoft has to do the same! It appears to me that all the flack they’re getting will result in a lot of new UNIX/Linux admins out there.”

Is it time to turn your back on Microsoft?
While some Cert kingdom members expressed their views on the new licensing scheme, other members had opinions to share about alternatives to Microsoft products.

Cert kingdom member Cutplug believes that the new licensing program will move people away from Microsoft products and toward Linux as the new OS of choice, specifically Red Hat. He continues by saying that no one in their right mind would pay such a large amount of money without control over the product that they’re purchasing.

Member Raheesom says, “I KNOW Novell technology is better than MS, but Novell is no longer popular enough for the IT professional to take it seriously.” Raheesom says he will have to look for a Linux or UNIX alternative.

Finally, Cert kingdom member FrankArrow asks members to consider MacOS X. He says that the new Macintosh operating system is based on the Free BSD UNIX kernel and doesn’t require any kind of registration. He further states that purchasing Macs over PCs would send a strong message to Microsoft: Don’t push us, because we have alternatives.

If you can’t join ‘em, work around ‘em
The discussion also focused on ways to get around Microsoft’s new licensing system.

Some members, such as Tetsu96, expressed an interest in cracking the license in Windows XP and Office XP. He believes that if Microsoft continues with their activation plan, hackers will have a field day finding ways around the license registration. Tetsu96 says that there are too many variables that would keep Internet registration from being practical for an average Windows user.

Cert kingdom member RobertR explained that there are already ways around the licensing scheme:
“[There are currently] several ways around the [Windows XP] online process. When registering the final version, you will be able to get a ‘code’ via the phone. Just use the same code when you reinstall. As for Office XP, the phone option exists and the code is reusable! Also, you can crash the install by saying no to the registration, reboot, then ‘unregister’ a certain dll, add a certain registry key, reboot, and, poof, it’s ‘registered’!”

Some Cert kingdom members, such as Brian Gray, expressed a concern with supporting users in business environments and home use. Brian explains that he carries a case of burned CDs with him wherever he goes in order to help him do his job in a “timely manner.” He says that he knows he isn’t the only IT professional who uses this method. He goes on to say that he isn’t a software pirate; he only wants to fix the problem quickly. He believes this won’t be possible if he’s waiting on the phone with a Microsoft representative, which will in turn cost his clients time and money.

Some will support XP no matter what
While a large majority of the Cert kingdom members who joined this debate stated that they don’t like Microsoft’s new licensing program, other members support Microsoft’s side of the argument.

A good example is Bergeo, who is a product demonstrator for Microsoft in Belgium. Bergeo explains that the product activation can occur in one of two ways: Internet or telephone. According to Bergeo, both are painless, often quick, and require no personal user information. Bergeo also explains how the hardware changes in a PC might cause a product to stop working:
“For people who often change hardware pieces in their PC, Office XP will refuse to start after five changes in the configuration. All you have to do is to call Microsoft and tell them to cancel the activation you’ve made before.”

Cert kingdom member Sdouglas thinks that the product activation feature is actually a clever idea. Sdouglas believes that using the activation feature will force users to be honest about their use of Windows or Office. Sdouglas also says that anyone who is complaining about the new licensing activation is most likely involved in pirating software.

With the upcoming release of its new SQL Server database (code-named Yukon), Microsoft has decided to enter a market traditionally led by specialized business reporting software companies, such as Crystal Decisions and Actuate. Because the business reporting segment is still experiencing growth in an otherwise bleak software market, Microsoft obviously sees an opportunity to capitalize when its venerable SQL Server database product is released. Tentatively named SQL Server Reporting Services, Microsoft plans to develop this add-on feature to provide the database services capabilities needed to generate reports. Let’s take a look at how this new SQL Server add-on will possibly change this software market.

The importance of Microsoft SQL
End-user business reporting is extremely specialized. Business reporting software companies have to work closely with larger organizations to tailor the output for their customers’ individual requirements. This close relationship has blossomed over the years and developed into the multibillion-dollar business reporting services industry. A key part of that growth was Microsoft’s SQL Server software, which provided the engine for these custom reporting applications to operate.

Best Microsoft MCTS Training – Microsoft MCITP Certification at Certkingdom.com

By staying out of end-user reporting services, Microsoft created opportunities for other software companies to custom-tailor reporting packages for organizations looking to make sense of valuable database information. While many of these software companies continue to develop products in a cross-platform environment, Microsoft SQL is obviously an important part of their business strategy.

What does SQL Server Reporting Services mean for vendors?
First off, it is important to note that Microsoft has not indicated a desire to provide actual report generation with its SQL Server Reporting Services. It merely includes the hooks in the database server for report creation. Another third-party reporting engine will still have to handle the actual writing of the reports. Second, this service is still in a testing phase, so many details about what the add-on will include are still unknown. Also, with the traditionally long testing cycles for Microsoft products, it is difficult to say when the add-on will be available. Nonetheless, Microsoft’s impact will be significant in the once third-party-dominated field of reporting services.

The biggest question is how the relationships between the reporting services vendors and their customers will be changed now that Microsoft is providing the back-end computing for report generation. These vendors have worked with Microsoft SQL extensively in the past to ensure a smooth reporting infrastructure for their customers. With Microsoft entering the reporting services market, that relationship should become adversarial.

Fortunately, in the short term, the business reporting software vendors can count on few changes in their business model. The larger vendors develop their reporting software to work in more realistic, non-Microsoft SQL-only environments, so their cross-platform advantage will keep their customers from switching right away. For instance, Crystal Decisions’ new Crystal Enterprise 9 product release boasts of interoperability among various operating systems by explaining, “Different systems can be combined in one installation, allowing you to pick the best platform for each component. For example, large reports may be better run close to the database on a UNIX platform, and Web components may be managed more easily on a Windows platform.”

Pricing
One area of concern is future product pricing. Traditional Microsoft forays into established software businesses have made pricing difficult for those vendors that developed off the Microsoft SQL platform. Many future buyers of reporting services will be hard-pressed to justify the higher costs for third-party products when much of the database engine work has already been included with Microsoft’s new SQL Server version. In addition, upgrades could be put off until the SQL Server Reporting Services product is tested, causing vendors to adjust their prices further downward.

The future of business reporting software
Business reporting software makes sense out of the seemingly infinite amounts of data accumulated by organizations today. From end-user reports to sales-analysis tools, the software that drives this process is database software. In the past, Microsoft has enabled certain business reporting services companies to develop unfettered of its long reach and superior market position. When Yukon is finally released and the database reporting software that is proposed is fully tested, that all may change.
Tell us what you think
We would like to know your position on this topic. Start a discussion at the end of this article by clicking on the Discuss button below. Some food-for-thought topics include:

* Will your current investment in existing business reporting products preclude you from making a switch to Microsoft’s proposed SQL Server Reporting Services?
* Will the multiserver environments that most third-party business reporting vendors operate out of make it difficult for Microsoft to completely take over this market?
* Do you foresee Microsoft eventually extending its SQL Server offerings to include report generation?

Microsoft Security Bulletin (MS01-034)
Regarding: “Malformed Word Document Could Enable Macro to Run Automatically”
Date Posted: June 21, 2001
Patch URL: Microsoft Word 2002
Patch URL: Microsoft Word 2000
Patch URL: Microsoft Word 97
Patch URL: Microsoft Word 2001 for Macintosh
Patch URL: Microsoft Word 98 for Macintosh
Information URL: Click here for more information.

When a Word document is opened, it is automatically scanned for macros. Depending on the user’s security settings in Word 2000 and 2002, and always in Word 97, the user is allowed to choose whether to execute the macro. A vulnerability has been discovered that will allow some specially modified macros to execute regardless of the user’s choice or knowledge. If security patch MS01-028 has been applied, this patch is unnecessary.

Best Microsoft MCTS Training – Microsoft MCITP Certification at Certkingdom.com

Microsoft Security Bulletin (MS01-036)
Regarding: “Function Exposed via LDAP over SSL Could Enable Passwords to be Changed”
Date Posted: June 25, 2001
Patch URL: Windows 2000 Server and Advanced Server
Information URL: Click here for more information.

If the LDAP server has been configured to allow LDAP over SSL connections and to allow users to change data attributes of directory principals, a vulnerability exists that would allow a domain user to change password attributes for any user, including the administrator. This could allow an attacker to change the password-denying service to that user and give the attacker the privileges of the affected user.

Novell issues
Regarding: NDS 8, NDS Corporate Edition, NDS eDirectory, eDirectory 8.5, iChain, iChain 1.5
Date Posted: June 25, 2001
Patch URL: Click here to download the patch.
Information URL: Click here for more information.

This patch fixes local repair options for the NDSRepair utility.

Regarding: NetWare 5.1, Novell Small Business Suite 5.1
Date Posted: June 25, 2001
Patch URL: Click here to download the patch.
Information URL: Click here for more information.

This patch for Account Management for Win2K fixes a password synchronization problem.

Virus updates from Trend Micro
Virus/Worm: BAT_FORMATC.K
Posted: June 21, 2001
Risk: Low
Information URL: Click here for more information on this virus.

Virus/Worm: PE_MARI.A
Posted: June 22, 2001
Risk: Low
Information URL: Click here for more information on this virus.

Virus/Worm: TROJ_LEAVE.A
Posted: June 25, 2001
Risk: Low
Information URL: Click here for more information on this virus.

Virus/Worm: TROJ_NEWSFLOOD.A
Posted: June 25, 2001
Risk: Low
Information URL: Click here for more information on this virus.

Virus/Worm: TROJ_CHOKE.A
Posted: June 25, 2001
Risk: Low
Information URL: Click here for more information on this virus.

Virus/Worm: TROJ_VAMP.A
Posted: June 25, 2001
Risk: Low
Information URL: Click here for more information on this virus.
Check out our archive of updates and patches
Are you keeping up with the latest patches from Microsoft and Novell? If not, visit the Exterminator archive for past columns with information on bugs and patches you may have missed.

Exterminator brings you weekly updates on bug fixes, virus recovery, service release announcements, and security notices for Windows, Novell, Linux, and other systems.

Microsoft Security Bulletin (MS01-034)
Regarding: “Malformed Word Document Could Enable Macro to Run Automatically”
Date Posted: June 21, 2001
Patch URL: Microsoft Word 2002
Patch URL: Microsoft Word 2000
Patch URL: Microsoft Word 97
Patch URL: Microsoft Word 2001 for Macintosh
Patch URL: Microsoft Word 98 for Macintosh
Information URL: Click here for more information.

When a Word document is opened, it is automatically scanned for macros. Depending on the user’s security settings in Word 2000 and 2002, and always in Word 97, the user is allowed to choose whether to execute the macro. A vulnerability has been discovered that will allow some specially modified macros to execute regardless of the user’s choice or knowledge. If security patch MS01-028 has been applied, this patch is unnecessary.

Microsoft Security Bulletin (MS01-036)
Regarding: “Function Exposed via LDAP over SSL Could Enable Passwords to be Changed”
Date Posted: June 25, 2001
Patch URL: Windows 2000 Server and Advanced Server
Information URL: Click here for more information.

If the LDAP server has been configured to allow LDAP over SSL connections and to allow users to change data attributes of directory principals, a vulnerability exists that would allow a domain user to change password attributes for any user, including the administrator. This could allow an attacker to change the password-denying service to that user and give the attacker the privileges of the affected user.

Novell issues
Regarding: NDS 8, NDS Corporate Edition, NDS eDirectory, eDirectory 8.5, iChain, iChain 1.5
Date Posted: June 25, 2001
Patch URL: Click here to download the patch.
Information URL: Click here for more information.

This patch fixes local repair options for the NDSRepair utility.

Regarding: NetWare 5.1, Novell Small Business Suite 5.1
Date Posted: June 25, 2001
Patch URL: Click here to download the patch.
Information URL: Click here for more information.

This patch for Account Management for Win2K fixes a password synchronization problem.

Virus updates from Trend Micro
Virus/Worm: BAT_FORMATC.K
Posted: June 21, 2001
Risk: Low
Information URL: Click here for more information on this virus.

Virus/Worm: PE_MARI.A
Posted: June 22, 2001
Risk: Low
Information URL: Click here for more information on this virus.

Virus/Worm: TROJ_LEAVE.A
Posted: June 25, 2001
Risk: Low
Information URL: Click here for more information on this virus.

Virus/Worm: TROJ_NEWSFLOOD.A
Posted: June 25, 2001
Risk: Low
Information URL: Click here for more information on this virus.

Virus/Worm: TROJ_CHOKE.A
Posted: June 25, 2001
Risk: Low
Information URL: Click here for more information on this virus.

Virus/Worm: TROJ_VAMP.A
Posted: June 25, 2001
Risk: Low
Information URL: Click here for more information on this virus.

A newly discovered flaw in Microsoft’s Passport put another layer of tarnish on the company’s already heavily corroded security image. Microsoft was forced to temporarily shut down its Passport e-wallet service after being warned that hackers could pickpocket individual e-wallets.

Passport and e-wallet
Microsoft’s Passport service provides a centralized database to store and distribute confidential data and a way for users to be identified on the Web. Passport can make Web sites easier to use because you don’t have to keep identifying yourself to gain access to various services.

Of course, this convenience comes at the not-so-minor cost of giving Microsoft control over your personal data, which, because of the company’s spotty security record, is not something I would recommend.

The online shopping feature of Passport, known as e-wallet, is supposed to eliminate all that tedious data input when you place an order online. Microsoft’s promise is essentially this: “Give us your name, address, and credit card number, and we will send that information to merchants on request.” So far, more than 70 online merchants have signed up for Microsoft’s Express Purchase service.

Best Microsoft MCTS Training – Microsoft MCITP Training at Certkingdom.com

Handing over your virtual wallet
Does it really take a highly paranoid security specialist like me to see that this might be a bad idea? Apparently, several million people out of the much larger Passport community have already signed up for this e-wallet service. According to Microsoft, those subscribers may have placed their personal data at risk due to a flaw that could allow a hacker to obtain the contents of their virtual wallet just by clicking on a link contained in a Hotmail e-mail account message.

Microsoft said that it immediately shut down the e-wallet service after learning of the problem and that Passport security has been enhanced. But that leaves open the question of whether any hacker took advantage of this flaw before a white-hat hacker discovered it and informed Microsoft.

Microsoft was quick to point out that this was an “isolated” problem (almost every individual security problem is) and that it patched the flaw immediately. The company also said that no e-wallet user’s credit card information was actually compromised. That may be true, but the cracker would probably leave no trace using this method, so I’m not certain just how Microsoft can know that no personal data was stolen.

Is even one of you surprised by this latest security breach at Microsoft? Did anyone not see this coming? The answer to both questions is probably a resounding “No.” For some time now, many IT professionals have been very cautious about Passport and downright obstinate about e-wallet.

The bottom line
Convincing people to trust Passport is vital to a number of upcoming Microsoft services in the .NET initiative. So if this recent Passport security flaw becomes widely known, it could be a much bigger PR problem for Microsoft than it appears to be on the surface. Indeed, Passport, which has recently been renamed .NET Passport, may be the crown jewel in the .NET crown.

Unfortunately, most average users will know little about this problem, and even fewer will realize that this is only one in a long string of Microsoft security problems. Anyone with any concerns about personal or business privacy and identity theft must place a great deal of trust in a company’s security policies before they give any confidential information to an online service that offers to serve as a gatekeeper for sensitive personal and financial information.

Microsoft must be hoping that average users won’t notice that there were about 100 Microsoft security bulletins in 2000 and that we are well on track to see another 60 or 70 by the end of this year. In addition to credit card information, Microsoft wants people to eventually store other confidential data, such as medical records, in Passport accounts.

Some people will even be foolish enough to provide debit card numbers, which, unlike credit cards, offer little or no fraud protection. While having your credit card stolen is annoying, it isn’t a big problem because credit card issuers limit the amount you can be forced to pay for fraudulent charges. But since debit cards offer direct access to your bank account, having that number stolen can be just like losing a checkbook full of signed, blank checks.

There is also some question as to whether can you continue to use Microsoft software and still avoid Passport. That’s going to become a major problem in the near future. If you haven’t yet installed a copy of XP, you may not realize that anyone running the new Microsoft operating system will be virtually forced to sign up for Passport.

Microsoft is making a big push to get everyone to use Passport as part of the impending .NET initiative, and in the years ahead, it will probably become increasingly difficult to use Microsoft programs if you don’t provide at least a minimum of information to Passport.