# Tuesday, November 06, 2007

I got this message again this morning and I am so sick of it!

Only 16 chars?  O RLY?  What if my dog's name is more than 16 chars long?

Further investigation of the JS source reveals that other error messages include:

Password can only contain letters and numbers

I am always talking to people about password policy and no wonder people are confused.  So much good guidance out there is buried under so much rubbish.

Compare this to the other user experience that is becoming more common:

Much better!  There was a time when it would be appropriate to explain why the second case is better... but in this day and age it should be obvious.  It is all about coercing people to do good passwords until they are made obsolete in the future.

Since Version 1.0.60731.0 of the ASP.NET AJAX Control Toolkit there has been a quite good Password Strength control available to the ASP.NET platform.  Everyone else (like my first, deliberately anonymous example) can just Google it!  There are plenty of samples available.

One that I liked was at Gerd Riesselmann's blog, where he shares (GPL) a simple example suitable for learning how this is done.

What do you think?  Is there any excuse for giving poor password guidance in 2007?

Tuesday, November 06, 2007 10:37:32 AM (AUS Eastern Daylight Time, UTC+11:00)  #    Disclaimer  |  Comments [0]  | 
# Thursday, October 18, 2007

I have a ColorPlus monitor profiling spyder by what was formally marketed as Pantone and is now Datacolor and I profile my monitors regularly.

Today was the first time I have tried to profile it since I built my new dev workstation.  It turns out the (circa 2004) ColorPlus spider that has served me well so far is now in the legacy bin.  While it works great on Vista x32 with the XP driver it has not had signed drivers released for Vista x64.

This lead me to look at what was the latest news for loading unsigned drivers into Vista x64, since I only need the thing to run for 5 minutes once every couple of months I was hoping to see that there would be some BCDEdit trickery that may let me reboot into a non-standard config, generate an ICC profile and then boot back into "real" Windows.  Seems that option was supported on Vista RC2 and removed for the RTM.

What has this to do with Linchpin Labs?

Further investigation showed up the case of Linchpin Labs (who have a Willoughby NSW address, as well as Ottawa CA).   Linchpin released a widget called Atsiv that was itself signed and would let you load unsigned drivers through it. 

Things got interesting when Microsoft categorized Atsiv as malware. 

The Microsoft position on this is detailed in the Windows Vista Security blog, and the equally detailed response by Linchpin Labs is detailed on their site.  It's unfortunate that Linchpin do not have a blog because it would be interesting to contrast the comments on the MSDN blog to any they attract.

As for the comments it seems lots of folks think their obligation ends with complaining.  It may be fun to type crap on a message board, but my respect is reserved for the folks who put time into finding the solutions.

But, what seems missing in the discussion to me is that (depending on how you count the numbers) between 40 and 60 million copies of Vista have been shipped in 19 languages to 70 countries.  Only a slim slice of that huge number of users are the tech savvy / tech professional community who, generally speaking, keep technology and the internet working and profitable for the rest of the world.  I think it is right that security decisions favor the great unwashed masses rather than the techno-elite, who should be able to look after themselves.  A bit of perspective please people.

If you get to the bottom of the Linchpin Labs announcement you find the following:

  Linchpin Labs would like to suggest that Microsoft spend less time using debatable policy as a security mechanism, and spend more time actually tightening its operating systems.

Wha??  Isn't that what this is all about?  Driver Signing Policy is tightening the OS.  Other examples of Vista security enhancements include:

  • Restricted Services (service hardening)
  • DEP and NX, including supporting hardware-based DEP 
  • User Account Control (UAC)
  • Windows Defender / Windows Firewall / Windows Security Center (techies:  think of the 98% of the world; they need hand holding, OK)
  • Network Access Protection (NAP) 
  • Bitlocker and EFS
  • ActiveX Opt-In, support for EV Certs and anti-phishing filter support in IE7
  • ...

...and probabbly others.  Yeah I'd call this tightening the OS.

Back to my ColorPlus Spyder...

So, looking at my options:

  • Get a Mac.  Oh yes would I love to get a Mac.  hmmmm :)  But, desk space, power and brain cycles are at a premium at the moment.  Also being a entry-level product the ColorPlus is a Windows-only product so it would mean getting a new spider anyway.
  • Get a new Spider.  These are costly devices and not really top of my spend list right now.  Maybe one day.
  • Abandon the DRM-infested evil Microsoft empire, like some of the commenters (e.g. "Joe" et al) on the Vista Security Blog suggest.  Just try and have a 16-bit/channel colour accurate workflow in Linux.  I've been there (not recently, but as far as I can tell things haven't changed much) and it's not fun.  Just go and spend some a couple of weeks setting it up and let me know how you get on.  Send me a postcard.  Really.

Now for some real options:

  1. Email Datacolor and let them know that people are interested in Vista drivers.  Done.
  2. Install a copy of Vista x86, update to the latest vid drivers, calibrate the monitor, pinch the ICC profile, reboot into my "real" Vista x64.  It'll take 1hr tops.  I'll get to this on the weekend.

um, anyone want to but a second hand ColorPlus Spyder?  One careful owner, still with original box...

Listening To: The Polyphonic Spree, The Fragile Army

Update:  My ColorPlus is no longer for sale :-)

It turns out that in the ColorVision Knowledge Base (under Support Centre) there is an article that says:

ColorPlus users can download Spyder2express software from the colorvision website's support section, and run that software with a ColorPlus serial number and a ColorPlus Spyder. The latest versions of Spyder2express are compatable with Vista32 and Vista64.

I can confirm this works.  Spyder2express is a 120Mb download which is hefty since I only want the driver :-/  The ColorPlus is detected as a Spyder2 after installation and works as advertised.

...and would you believe their is a Mac version of ColorPlus 1.1 in the Knowledge Base that is not listed in the Support downloads.  I'm happy to be wrong anytime it works out for the best :)

Listening to: The Campfire Headphase, Boards of Canada

Thursday, October 18, 2007 10:09:42 PM (AUS Eastern Standard Time, UTC+10:00)  #    Disclaimer  |  Comments [0]  | 
# Monday, August 27, 2007
Don’t underestimate the sly and insidious lengths Personal Firewall products in general, and Norton Internet Security 2007 in particular, will go to in fulfilling its goal of disrupting SQL Sever Management Studio.

That will be all.
:-)

Monday, August 27, 2007 4:56:39 PM (AUS Eastern Standard Time, UTC+10:00)  #    Disclaimer  |  Comments [0]  |