irlurl

(this article brought to you with help from Brandon, from whose emails I shamelessly plagiarized much of what follows)

Some folks have been wondering why the Game Studio 4.0 CTP supported touch input on Windows 7 as well as Windows Phone, but our more recent beta and RTM versions only support touch on Windows Phone.

Why on earth would we implement this feature but then take it away at the last minute?

For one thing, our Windows touch implementation had some irritating flaws. Touch was only supported on Windows 7, not Vista or XP. This would have been our only feature that required Windows 7. And there were inconsistencies between the behavior of touch on Windows vs. the phone. For example pressing and holding on Windows caused a right-click mouse promotion that we had no way to disable.

But these were not enough to justify removing the feature altogether. The real problem came when we added touch gesture support. Some history:

• We originally planned on just exposing raw touch point data, with no gesture support
• We figured games could implement their own gesture recognition over the top of this raw data
• Cue the start of our learning experience...
• It turns out that implementing good gesture recognizers is extremely difficult!
• It turns out that if everyone does this differently, you get a crappy user experience where apps never feel quite the same as the built-in system UI
• It turns out that touch panels (like keyboards and gamepads) are complex, quirky pieces of hardware, and their outputs require significant massaging
• It turns out that the best way to do this data massaging varies from one touch panel to another
• So for best results, gesture recognition needs to be done at a low level in the stack, exploiting driver level knowledge of the hardware
• Application level gesture recognition, layered on top of an abstract, hardware independent API, fundamentally cannot produce such good results

When these facts became clear, we decided it was important to add built-in gesture recognition to Windows Phone, in order to provide high quality, hardware optimized, and consistent functionality for all applications.

So that's what we did, in between our CTP and beta releases.

But what about the Windows version of the XNA Framework? We had three options:

1. Implement gesture recognition for Windows as well as the phone
2. Do not support gesture recognition on Windows, but keep the existing lower level TouchCollection API
3. Cut touch from Windows entirely

The first option simply did not fit the schedule. We would have had to cut other work to make time for it, but decided that other work was more important.

The second option seemed too confusing and half-baked to be a good idea. "Touch works on Windows, but only if you have Windows 7, and only if you avoid this part of the API which doesn't work at all".  Yuck.

So we went with the third option. We hope to revisit this sometime in the future, but for now we felt it was better to ship nothing at all than something incomplete, inconsistent, and which we already knew we would have to revisit.

Where does this leave those who want to use touch in Windows XNA games? You can still use XNA for graphics, sound, etc, while reading touch input some other way:

• Easy: using this .NET interop sample library from the MSDN code gallery, call Factory.CreateHandler<TouchHandler>(GameWindow.Handle), and subscribe to the TouchHandler TouchDown, TouchUp, and TouchMove events

• Harder: hook Windows messages for GameWindow.Handle (using GetFunctionPointerForDelegate, then p/invoke to the Win32 Get/SetWindowLongPtr API), and listen for WM_TOUCH messages

Note that we still ship the Microsoft.Xna.Framework.Touch assembly for Windows and Xbox, although it is not referenced by the default project template and is just a stub implementation where TouchPanel.GetState always returns an empty collection. This can still be useful for cross platform games, as it avoids the need for #ifdefs around your touch input code.

Vous êtes éditeur de logiciels indépendant (ou ISV) et souhaitez rejoindre le réseau de partenaires Microsoft sans trop savoir par où commencer ?

Je vous propose de découvrir 5 programmes partenaires et les avantages associés que Microsoft met à votre disposition.

Dernier « programme » que je souhaite vous présenter, c’est la Newsletter Partenaires Microsoft. 100% gratuite, cette newsletter est mensuelle, et vous permettra de recevoir régulièrement l’ensemble des informations relatives aux partenariats avec Microsoft : offres du mois, actualités produits, nouveautés licences, événements à venir, formations proposées aux partenaires etc. Disponible pour: Tous les partenaires - En savoir plus

For ISVs wanting to update legacy applications or for new green field development, ADO.NET Entity Framework 4 has become a time saving, cost effective way to build out your data tier of your application. Entity Data Model (EDM) provides a uniform way for you to work with data by specifying the data structure of a client application through business logic, namely entities and relationships.

In my previous post I showed you how to test simple activities using WorkflowInvoker.  While this is a great way to test simple activities it does have limitations.  The MSDN documentation states

WorkflowInvoker does not allow instance control such as persisting, unloading, or resuming bookmarks. If instance control is desired, use WorkflowApplication instead.

In this post I’ll show you how you can use WorkflowTestHelper to test an activity that uses Bookmarks.

What is a Bookmark?

Suppose you have an activity that needs some data.  Perhaps you want to ask the user for something or you need the host environment to do something that the activity itself cannot do.  In this example I’m going to create a ReadLine activity.  I could call Console.ReadLine from my activity but that is a bad practice because it blocks the Activity Scheduler thread.  As an activity author you should never block the thread but instead should use bookmarks.

Here is my ReadLine Activity

public sealed class ReadLine : NativeActivity<string>

{

    private BookmarkCallback _readCompleteCallback;



    [RequiredArgument]

    public InArgument<string> BookmarkName { get; set; }



    protected override bool CanInduceIdle

    {

        get { return true; }

    }



    public BookmarkCallback ReadCompleteCallback

    {

        get { return _readCompleteCallback ?? (_readCompleteCallback = new BookmarkCallback(OnReadComplete)); }

    }



    protected override void Execute(NativeActivityContext context)

    {

        // Inform the host that this activity needs data and wait for the callback

        context.CreateBookmark(BookmarkName.Get(context), ReadCompleteCallback);

    }



    private void OnReadComplete(NativeActivityContext context, Bookmark bookmark, object state)

    {

        // Store the value returned by the host

        context.SetValue(Result, state as string);

    }

}

Now I can use this activity in a workflow that requires input from the user

If you try to run this workflow with WorkflowInvoker your app will hang.  Instead you have to use WorkflowApplication and deal with the bookmarks in the host application.  I’ve included the host application with this post so you can see the necessary code.

How To Test This Workflow

Testing an activity like this can be tricky.  In the WorkflowTestHelper library I’ve added a class that makes it much easier.  The class is called WorkflowApplicationTest<T>.  This class will create and manage the WorkflowApplication and handle all the events for you resulting in some very clean test code.

[TestMethod]

public void ShouldOutputGreeting()

{

    // Arrange

    const string expectedFirstName = "Test";

    const string expectedLastName = "User";

    var expectedGreeting = string.Format("Hello {0} {1}", expectedFirstName, expectedLastName);

    var sut = WorkflowApplicationTest.Create(new TestReadLine());



    // Act



    // Run the workflow

    sut.TestActivity();



    // Wait for the first idle event - prompt for First Name

    // will return false if the activity does not go idle within the

    // timeout (default 1 sec)

    Assert.IsTrue(sut.WaitForIdleEvent());



    // Should have a bookmark named "FirstName"

    Assert.IsTrue(sut.Bookmarks.Contains("FirstName"));



    Assert.AreEqual(BookmarkResumptionResult.Success,

                    sut.TestWorkflowApplication.ResumeBookmark("FirstName", expectedFirstName));



    // Wait for the second idle event - prompt for Last Name

    Assert.IsTrue(sut.WaitForIdleEvent());



    // Should have a bookmark named "LastName"

    Assert.IsTrue(sut.Bookmarks.Contains("LastName"));



    Assert.AreEqual(BookmarkResumptionResult.Success,

                    sut.TestWorkflowApplication.ResumeBookmark("LastName", expectedLastName));



    // Wait for the workflow to complete

    Assert.IsTrue(sut.WaitForCompletedEvent());



    // Assert

    // WorkflowApplicationTest.TextLines returns an array of strings

    // that contains strings written by the WriteLine activity

    Assert.AreEqual(4, sut.TextLines.Length);

    Assert.AreEqual(expectedGreeting, sut.TextLines[2]);

}

Give It A Try

I’ve just posted WorkflowTestHelper v1.3 which now provides better support for testing with Bookmarks and capturing output of WriteLine activities.  Give it a try and let me know what you think.

As we put together training CCA\UII R1 for CRM I took the time to create a few project starters for things that I do a lot, such as Creating Hosted Controls, or Search controls and CTI adapters. Those of you that attend the CCA training events we held in the second quarter of 2010 will have seen one of them already as we use the Search Control template in module 3 of the training.  After kicking the tires on them ( so to speak ) with several POC’s and a few Customer engagements, I think they are in a state where other folks will find them useful. 

As such, I have posted the project installer for the UII Templates here ( This will be live in a bit ) ,  This installer will work on Visual Studio 2008sp1 and Visual Studio 2010.

How to Use it:

There are 6 project templates in the vsi file, 
To Install them… just click the UII Hosted Controls_r1.vsi on a machine you have Visual Studio installed on.

That will open a window that looks like this :

That is because Iv not signed the package with a public Certificate.
Click Yes and Follow though the installer.

That will install and register the templates with Visual Studio.

You can verify that everything went fine by opening up VS and Clicking the “New Project”.  Under Visual C# you will see a new area called User Interface Integration for Microsoft Dynamics CRM (UII)

In it you will see 6 project templates.. in VS 2008 it looks like this:

 

In VS 2010 it looks like this :

So What does each of these do?

The two simplest project starters are the UII Application Adapter and the UII Web Application Adapter Control templates.  These are used when your writing an adapter for either a web application or a low level adapter for a Win32 program.  both adapter preset up the UII interfaces and constructors.

Next is the Windows and WPF Hosted Control templates,  These are used when setting up a user control for UII. the templates lay out all of the plumbing and much of the “always used” bits in UII, such as Context, Action handlers and access UII Desktop Services layer. 

Next is the Customer Search Control templates,  also provided in WPF and Winform.  This lays out the framework to build a search provider that will work in UII\CCA.  There are a good deal of comments in the code to help you get though what you need to fill out to get things working.  there are several key functions in the template, however the most important method provided is the BuildCustomerResponse method, this is a method that sits on top of the CustomerSearchResult event and is the way that you start a Session in UII.

And Finally is the CTI Starter Solution.
the CTI Starter Solution lays out a solution with all of the relevant bits you need to work with to set up a new CTI interface lib. it does not have the graphical bits, just the “behind the scenes” bits.
When you create a new CTI Starter Solution, Visual Studio will lay out the following solution:

If you are headed down the path of creating CTI adapters, I would highly encourage you to start from this Solution type. 

• The BaseCitConnector project is the communication layer for talking to the downstream CTI solution. This control is setup to talk to the CTI solution via polling, however it can be adapted to whatever you need.
• The BaseCitDesktopManager is the Interface layer that UII uses to manage events between UII and the BaseCTIConnector, it is also the control that instances the AgentState and CallState Manager Classes in the next assembly.
• The BaseCtiStateManagers are the translators for CTI => CCA and places where you can add extended functionality beyond the core control set we offer.

The entire CTI solution template is heavily commented in the code to provide some guidance on where to do what.
In short development of a CTI interface works progresses as "BaseCTIConnector” –> BaseCitStateManagers –> BaseDesktopManager

Important Notes..

I have provided the templates in Visual C# only.  You will not find them in the VB.net area of Visual Studio 

All of the templates configured with “local” references to the UII framework directory, which means you will need to update the References Paths to point to the UII Install Directory \ Framework directory.

To Do that,

Right click on the project in the solution explore and choose “properties”:

then choose the “Reference Paths” from the project areas:

Next, Click the … button next the folder box, and Navigate to your UII Install Directory.  If you used the default install that’s going to be C:\Program Files\Microsoft Uii\Framework

Once you have selected the folder, click “Add Folder” under the Folders box. 

That should fix all the reference problems and you should be good to go.

Hope you guys find this useful, and post comments on the codeplex site if you think other templates would be useful.

This post isn’t spam, malware or security related.  It’s a story about nice, visual formatting.

If you look at the way I write my blog posts, or if you worked with me saw the way I do my slide decks in PowerPoint, I try to make judicious use of white space.  White space, as we all know, is the adding of line returns around paragraphs so you don’t end up seeing large blocks of text.  That makes it harder to read as your eyes tend to get tired when information is so cobbled together.

Well, the other day, me and my co-worker (the same one from before) got into a disagreement about white space (!).  We’re working on a slide deck to present in a few days, and I said that adding lots of white space is important.  After all, here’s what Wikipedia has to say about white space:

In page layout, illustration and sculpture, white space is often referred to as negative space. It is that portion of a page left unmarked: the space between graphics, margins, gutters, space between columns, space between lines of type or figures and objects drawn or depicted. The term arises from graphic design practice, where printing processes generally use white paper.

White space should not be considered merely 'blank' space — it is an important element of design which enables the objects in it to exist at all, the balance between positive (or non-white) and the use of negative spaces is key to aesthetic composition.

…

Judicious use of white space can give a page a classic, elegant, or rich appearance.

This link (Better Writing Skills) says the following:

• White space is essential to readability. It makes the various elements stand out.
• Too often we cover every inch of a page with text. This results in publications that are intimidating and difficult to read

This blog (Ace of Spades) asserts much the same thing:

Why White Space?

White space is used in every form of design. The role of white space is to break up elements and allow for easy recognition of  different objects. The more white space around the object and the more significance it gets.

In other words, it seems inherently obvious to me that white space is critical when it comes to making material readable.  So, you’ll imagine my surprise when he said that he never adds whitespace to anything.  In fact, he said that he *hated* white space.  Furthermore, he said that email servers or mail clients should remove all white space from email.  Quite frankly, I couldn’t believe what I was hearing.  What he was effectively saying was that all email should be as unreadable as possible.

Now, I don’t know the full reasons for why he claimed this.  If I were to hazard a guess, I’d guess that the addition of white space adds to the total overall size of the message, utilizing more bandwidth.  Against this claim, I’d say that the additional bandwidth that this takes up is negligible compared to the total overall size of the message and it depreciates readability.  Of course, he is coming from the Exchange world and older versions of Exchange (Exchange 2003, for example) tend to have a habit of collapsing white space.  This was occurring one time when a header was split across two lines (perhaps Content-Type).  Exchange 2003 was wrapping the line to make it a single line.  The problem is that the customer was signing their message with DKIM using the simple canonicalization algorithm.  Exchange was then wrapping the line, and this resulted in DKIM validation at the other side breaking (since signing a line wrapped message is different than one that is collapsed onto a single line).  The fix for this was to sign with the relaxed DKIM canonicalization method but the point was taken – this version of Exchange took some liberties with the text.

Newer versions of Exchange are not quite so intrusive, but when it comes to email, here is my philosophy: Plenty of white space is fine, and MTAs should not do anything to the text.  Hands off!

The 2011 MVP Global Summit kicks-off on February 28 and already there’s a buzz in the air. Plans are well underway for another world-class event. Product groups are actively planning their deep dive sessions with MVPs, where they offer them advance looks at many of Microsoft’s latest technology developments.

Mike Fosmire, who at the 2010 MVP Summit was an MVP lead and now is a business group lead, said,

“Every day I see the amazing contributions MVPs make around the world, but there’s nothing quite like having the opportunity to meet face to face with these great folks and getting to know them personally. Additionally, it’s an amazing experience to see them meet their peer MVPs—people they’ve interacted with online for years—in person, sometimes for the first time.”

MVP Global Summit is truly a high point in a year of ongoing interactions between MVPs and Microsoft. Some MVPs and their Microsoft relationship managers travel half way around the globe to attend. Why? One big reason is to be with their community. MVPs share their successes, latest ideas, and war stories with others who understand their passion for technology and making a difference in the community.

And of course they come for the deep technical content—which is on track to be more robust than ever. “Each year we host the MVP Global Summit, it gets a little better,” explained Paulette Suddarth, Microsoft Global Events Marketing Manager, MVP Award Program. “MVPs have told us that a four day event is a big time commitment, so this year we’re packing all the content into three highly productive days. We’re doing that by scaling back the keynote speeches—with an important exception. Steve Ballmer is a big fan of MVPS and he’ll be back this year to welcome them to campus.”

“We’ll be focusing more on deep dive sessions—which MVPs tell us are the most valuable,” continued Suddarth. “As well as networking opportunities.  Everyone who can make it can look forward to a great welcome reception and memorable evening events. But that’s all I’m saying right now. We want to keep some surprises.”

We have two Dynamics GP web seminars coming in September.  I've working on the content the last couple weeks and they should be a good spend of your time.  They focus on two important topics we've heard from our community. 

• Webcast: Microsoft Dynamics GP SmartList Builder and Extender (9/8/2010 8:30:07 PM)
  Grow your business using simple reporting and personalization tools for adapting your system, without complicated development efforts.

• Webcast: Microsoft Dynamics GP Light User (formerly Microsoft Dynamics GP Client for Microsoft Office) (9/8/2010 8:30:07 PM)
  Extend Microsoft Dynamics GP business insight and productivity to everyone in your organization. 

We're planning others for October as well.  When new ones get posted you will see them on CustomerSource under events.

These will be recorded and you can watch them on demand if needed.  Please plan to attend.  Partners, educate your customers and get the word out.

Pam

For those of you who missed xRMVirtual’s very popular presentation of the “Interactive Look at CRM 2011” last week it’s at:

http://www.screencast.com/t/ZTIzYjVmNz

The beta release info is at: Microsoft Dynamics CRM 2011—Global Beta Released.

There is more goodness at the CRM Resource Center ‘What’s New’ articles:

Online -> http://rc.crm.dynamics.com/rc/2011/en-us/online/5.0/whatsNewCRM5.aspx

OnPrem -> http://rc.crm.dynamics.com/rc/2011/en-us/on-prem/5.0/whatsNewCRM5.aspx

Enjoy.

FY10Q4 Microsoft earnings are upon us. So, what's been going on since last we met over the quarterly results?

• The KIN phone collapse put WP7's future in doubt. Would WP7 meet the same fate? Is it under the same level of mismanagement? Fortunately, some fairly positive takes on pre-release WP7 have been coming out ahead of earnings to shore up confidence and excitement.
• Market Cap - yes, Apple passed us by and there was an abundance of articles and postings questioning just how much longer Microsoft would have to endure Mr. Ballmer as CEO (hint: a long loooooong time).
• Itsy-bitsy-layoff-committees: targeted small layoffs to kick of FY11 team budgets. If they are that low key and only disclosed on some random bit of the blogosphere, do they really amount to much accountability on Microsoft's sake? Again, our contingency hiring is out of this world so it's not like we're saving a bunch of money - we just have folks on the payroll we can easily cut loose as needed.

What kind of questions might be / should be posed during the earnings call?

• Dates: firm dates for WP7 devices and Kinect and associated Kinect titles beyond the kind-of-interesting launch titles.
• Win7 + Office 2010: are the cash cows still, err, bringing home the bacon?
• Bing / Ad-center: is Bing on the upswing? Is Bing / Ad-Center doing anything more than eating the bacon that our cash cows bring home?
• Legal: it's been very quiet on the European Union front. Office 2010 was released without a single investigatory squeak, as far as I know. Is this all behind us for now? That would be great.
• WP7: application developers in the queue? We need to re-enforce the cool apps that we'll have ready when WP7 is launched. In a move that has totally delighted me, Microsoft is giving every employee the ability to write and deploy WP7 applications (and, what, ability to get a device at launch, too?) - wow! Now's the time to truly show off your stuff and write for WP7 and get your app out the door.

The glow of Windows 7 has dimmed and Office 2010 and the VS2010 eco-system need to pick up the steam as we head to WP7 and Kinect launch. Apple is rolling in the moolah being a content delivery channel and our story, other than some Xbox features, is still pretty fuzzy. For instance: Windows Media Center is one of those crown jewels we've let plop out of the crown and get kicked around the court. I love WMC but it seems to be a neglected feature, caught in the chop between E&D / Zune and Windows. After a phone, it's the next experience we should bring out some reference hardware for to easily DVR HD channels off the air and plug right into your HDMI system and watch it go.

My usual suspects for earnings discussion:

• Mr. Joe Wilcox over at Beta News
• Mr. Todd Bishop over at TechFlash's Microsoft Blog
• Mr. Joseph Tartakoff somewhere within paidContent.org.

(I'll update the post later if there are interesting developments from the earnings release.)

Mini-Microsoft Microsoft MSFT -- Comments

Get out of the way Microsoft Bob, you have a replacement that Microsoft's Gen-Y employees can claim for their own! It's spelled K-I-N.

KIN's demise can't surprise anyone. When I looked at the phone's features, I thought: alright, an incomplete Facebook experience that I cannot improve by installing new applications... and I pay $$$ through the nose for a plan. But I've got a green dot and KIN Studio... maybe that will be enough to sell enough units to justify the Danger acquisition and the person-years of work behind getting KIN out. What the hell where all those people doing? I couldn't imagine anyone wanting the resulting iffy feature-phone at a smartphone cost, but KIN wasn't made for me. I was willing to let the market be the judge of KIN.

Verdict? Guilty, guilty, guilty.

The original Zune/Pink phone had interesting momentum but it all got squandered. What's the one ThinkWeek paper I want to read this year? Lessons Learned from Microsoft KIN and How Microsoft Must Change Product Development. You can't have a failure like this without examining it and then sharing what went wrong, all with respect to vision, execution, and leadership. How big was the original iPhone team? How big was the KIN team? Why did one result in a lineage of amazingly successful devices in the marketplace, and the other become a textbook extended definition for "dud" ?

Interesting comments:

All I can say as a former Windows Mobile employee who is now working for a competitor in the phone space is that this is good news for the rest of us. [...] Personally I quit because of the frustrating management and autocratic decision style of Terry Myerson and Andrew Lees. The only exec in the team myself and other folks respcted was Tom Gibbons who is now sidelined. Lees and Myerson don't know consumer products or phones. Gibbons at least knows consumer product development. We often talk about how Andrew Lees still has a job but Microsoft's loss is a gain for the rest of us.

And

And now Kin is killed *after* it has shipped in June 2010. You can bet Andy was involved in the development of Kin, the partnership agreements with the OEM, Verizon and most importantly the "ship it" approvals all along the way. And Microsoft discovers its a bad idea after it blows up in the broad market. Absolutely no thanks to any pro-active decision making on Andy's part.

Now there is spin that Andy killed kin to put all the wood behind Windows Phone 7. Er, the guy was in charge for two years of Kin development. He could have made this decision far earlier.

Similarly Windows Phone 7 has two years of development under his watch. Based on his past performance, 99% chance this is also going to be a total catastrophe. It further doesn't help that much of the Windows Phone 7 leadership team was kicked out of Windows when they screwed up Vista.

And finally, one Danger-employee's point of view of why they became demotivated:

To the person who talked about the unprofessional behavior of the Palo Alto Kin (former Danger team), I need to respond because I was one of them.

You are correct, the remaining Danger team was not professional nor did we show off the amazing stuff we had that made Danger such a great place. But the reason for that was our collective disbelief that we were working in such a screwed up place. Yes, we took long lunches and we sat in conference rooms and went on coffee breaks and the conversations always went something like this..."Can you believe that want us to do this?" Or "Did you hear that IM was cut, YouTube was cut? The App store was cut?" "Can you believe how mismanaged this place is?" "Why is this place to dysfunctional??"

Please understand that we went from being a high functioning, extremely passionate and driven organization to a dysfunctional organization where decisions were made by politics rather than logic.

Consider this, in less than 10 years with 1/10 of the budget Microsoft had for PMX, we created a fully multitasking operating system, a powerful service to support it, 12 different device models, and obsessed and supportive fans of our product. While I will grant that we did not shake up the entire wireless world (ala iPhone) we made a really good product and were rewarded by the incredible support of our userbase and our own feelings of accomplishment. If we had had more time and resources, we would of come out with newer versions, supporting touch screens and revamping our UI. But we ran out of time and were acquired and look at the results. A phone that was a complete and total failure. We all knew (Microsoft employees included) that is was a lackluster device, lacked the features the market wanted and was buggy with performance problems on top of it all.

When we were first acquired, we were not taking long lunches and coffee breaks. We were committed to help this Pink project out and show our stuff. But when our best ideas were knocked down over and over and it began to dawn on us that we were not going to have any real affect on the product, we gave up. We began counting down to the 2 year point so we could get our retention bonuses and get out.

I am sorry you had to witness that amazing group behave so poorly. Trust me, they were (and still are) the best group of people ever assembled to fight the cellular battle. But when the leaders are all incompetent, we just wanted out.

I guess we need another ThinkWeek paper on how to successfully acquire companies, too. Between this and aQuantive, we only excel at taking the financial boon of Windows and Office and giving it over to leadership that totally blows it down the drain like an odds-challenged drunk in Vegas. And the shareholders continue to suffer in silence. And the drunks are looking for their next cash infusion.

Dude, Where's Ray? You see more and more yearning for the days of BillG at the helm, perhaps because at least he was an uber geek that could drill your team's presentation like nobody's business and understand what your team was doing. And occasionally get enthralled by technology choices that would confound your average user (WinFS). Ray was supposed to serve as a replacement architect at Microsoft's technical helm, yet his impact seems to be superficial (and pretty disparaged if you chat with any leader in the company). Here's a snippet of a great comment about Ray and his impact at Microsoft:

The problem is, Ray doesn't see himself as the "Chief Software Architect" of the company. He sees himself as the "Chief Visionary Officer" (to borrow someone's phrase from early comments). He sees his job as being the person who regularly kicks "old" Microsoft in the butt to wake them up to whats going on in the world.

All of his behavior lines up with this: His correcting of Ballmer (in public!); His team's building Mesh, an expensive, buzz-generating, science-project app beloved by those who know about it, but irrelevant to those who don't (which is 99+% of the planet); More recently, his team's building of Docs.com -- another expensive, buzz-generating app that has no business model and no path to ever having one (if you need an indication of how pointless an exercise docs.com is, just look at the visitor trends for it since launch: http://trends.google.com/websites?q=docs.com).

Meanwhile, Ozzie has made enemies of most of the leaders of the actual products that pay for his "Labs". He's made no secret of the fact that he thinks that Windows is run terribly, or that Office is dead technology. Behind closed doors, he is openly dispariging of Microsoft development practices and Microsoft technology. His efforts to build product display a stunning lack of a caring about how much things cost to run, or whether they will ever make money. To my knowledge, he doesn't care in the slightest about the enterprise businesses at the company.

Dude, Where's My Job? Folks have been talking about ongoing stealth layoffs and the impending July FY11 layoffs reacting to teams with reduced budgets. I've scanned some various HR calendars and found some interesting appointments more around next week vs. this week, but the layoff rumors have spilled over beyond here and into TechFlash: Microsoft pruning more jobs. A follow-up by Ms. Mary-Jo Foley: More Microsoft job cuts coming ZDNet. So I'd expect more news next week than this week, but one commenter has noted:

Layoffs confirmed for tomorrow. I see long meetings booked by HR-types in Lincoln Square and RedWest-C. Didn't go through all the calendars for you main-campus types.

If Microsoft is doing this to appear fiscally responsible, they really can't tell just this half of the story. The other half of the story is the number of contingent staff positions, which if you open up Headtrax for yourself to investigate be prepared to tell Elizabeth you're coming to join her, because it about gave me a mild heart-attack.

If you learn anything, please comment regarding the group and the size of the hit and any impression about the folks impacted (e.g., 10%'ers, long-term employees, etc).

Mini-Microsoft Microsoft -- Comments

Well, here's to wrapping up FY10. The kick-off of the Annual Review Season is our long, long, sloppy kiss goodnight to the fiscal year that was.

How are various things wrapping up?

Entertainment and Devices: with Bach and Allard out of the picture the E&D snow globe got a shaking where it's not clear how things are going to change. I was surprised at the number of pro-Bach comments in the last post, and a number of commenters believed that Mr. Bach had what it took to be the next Microsoft CEO. I respect your opinion, but I have to admit I did my best "ba-roo?" reading that.

Regarding Mr. Bach's departure: you can't call it accountability. Accountability would have been right after the red-ring o' death $1,000,000,000USD write-off. Come on, when senior leaders get together to consider what kind of emergent opportunities to get into, it's all about the billion dollar market. Perhaps they wrongly assumed that it exclusively meant income. It's pleasant that we have an entertainment presence like the Xbox and that Sony took a hard one on the chin, but did it really need to take that much money away from the shareholders and tarnish our reputation so much? And leave so much more unfulfilled around TV media entertainment that is getting rapidly covered by competitors?

Given the swirling flakes in the E&D snow globe, does E&D need to be Sinofsky'd? Discipline can be a good thing. You don't want every project to be like Forza. Willy-nilly feature development without stringent peer reviews and pre-checkin testing: dumb. Agile? So is using two hands instead of one to smear poo all over a wall. You've got twice the mess to clean-up. Those days should be behind us. More than anything, E&D needs leadership that oozes passion for everyday joys and who show up late Friday afternoon to play with what's new this past week and give praise and feedback. It needs joy and delight and laughter. And while running the trains on time is good for everyone, it doesn't need the stoic, passionless, data-driven rectilinear styling of a Sinofsky org's Switzerland.

No, rather than Switzerland E&D needs Italy. It needs curves and "oooo's!" and non-linear surprises. Sinofsky, I'd say, is on a three-release effort with Windows so he's busy anyways. I can't imagine if he was brought in to help pull things around, though, that it would go very well... I imagine his lieutenants first job would be to put the ribbon into the Zune client app and Media Center and then try to figure how to wedge it into the Xbox dashboard. Nanites would start flowing through everyone's bloodstream, and their skin would turn sickly pale... the trains would run ontime, just to dull destinations.

Kin: we put a lot of time + effort around Danger and producing the Kin (well, maybe more effort could have been spent on keeping the services running). Kin is not made for me or my social circle, so I can't judge it as a device. Sales will be the deciding factor here. And I'm sure when the first quarter numbers are released, we'll just say, "Well, we have an update to the Kin feature phone that we are sure will increase uptake significantly." Like fully supporting Facebook and Twitter features. I love the green dot, though.

And I do like Kin Studio, which I think pushes Kin over the top for some Millennials. If Kin Studio could be adapted soon to be a feature available for every WP7 phone user then we'd really surprise and delight potential phone users.

WP7: As for the WP7 phone: goodness. I'm hoping it's great and I like what I see. I like that a number of 3rd parties are already in the tube to deliver apps. I have sore glutes, though, from all the WP7 demos I see: every time a WP7 PM says, "Let me try this" my buns seize up hoping that it goes smoothly this time vs. the PM mumbling something about regressions in the latest build. There's still plenty of runway to go and time to fix all the various bugs and oddities, but it makes me apprehensive regarding the overall quality bar and wondering, "How did this go in so busted to begin with?" Several someones being agile, no doubt.

While we've been chasing the iPhone hockey puck (of what, two releases ago?) we risk that the real puck of today is Android. Maybe. The Android ecosystem is still too chaotic, but its potential is showing (thank you, Vic). We have to not only have great 3rd party apps on release but also show commitment in having our own series of Microsoft applications constantly going out of the door. For important as the mobile platform is, it's surprising how little we're invested in developing our own series of applications for it, hoping that developers will meander over to our party.

And as the mobile application platform grows up into more interesting devices, the Windows hardware platform is growing downwards to meet it. There's a collision of development philosophy dead ahead and it needs to be solved this summer, not within years. Microsoft seriously needs to woo developers, and if you're giving them an ever-changing flowchart of constantly updated development platforms when the competitors have straight lines, you've lost a big campaign and potentially the war. Windows, E&D, and DevDiv must be forced to reconcile the future of application development and distribution from mobile to client to cloud by Microsoft's CEO, or start FY11 with leadership that can.

Natal: I'll get a Natal device when it comes out, though I don't know how much I'll use it in the cozy space I have our Xbox in. I'm not redecorating for Natal, which means every time I boot it up I will look around at all the various potential ankle and knee injuries. It might be worth it, though, if I can swing a light-saber, force-push, and even wave my hand for a Jedi mind-trick. But not for playing paint kick-ball.

A big Windows opportunity for Natal: some smarty plugs it into his desktop and a driver installs and Win7 magically lights up for Natal interaction. Word spreads. Win7 works with Natal and you can go all Minority Report now with your laptop and desktop! That's a Jobs-worthy show-off moment: "Oh, yes, an iPad. How nostalgically quaint to have a device you have to actually smear your fingers around the surface to do something with. Now, watch my Cheetos plastered fingers bring up Media Center to play some recorded World Cup! And after that, I'll navigate the universe with Worldwide Telescope!"

Pop a cap in your ass: which by cap, I mean Market Cap and the reflections and abundant free advice issued forth when Apple passed Microsoft with-respect-to Market Capitalization this past week. A lot of focus came down on Mr. Ballmer, who shrugged it off as much as he shrugs off the lost decade of MSFT stock price. A nice case study of attitude begets results. While Microsoft has its three-screened head in The Cloud (can't wait to see that marketing campaign [eye-roll]) Apple continues a consumer-love affair of joyous design and content delivery. One bit of free advice I naturally loved: What Will It Take to Save Microsoft (MSFT) - a snippet from the end:

And I see no end to the misery. Microsoft should learn from longtime brother-in-arms Intel (Nasdaq: INTC), whose CEO Paul Otellini has cut a complicated beast down to the operations that really matter. That's the kind of sugar-free medicine it would take to save Microsoft from itself, and of course, something that drastic will never happen.

What a shame.

Yes, we need our Neutron Jack at this point. We have our supposedly endangered cash cows and then a lot of products and operations clinging on. Many of which that would never exist in a sane company. Spin-off those groups to live or die on their own, with Microsoft owning appropriate stock such that if their survival instinct kicks in and they flourish, it will be a nice hefty return. You also have to realize that product groups are way overstaffed and just need engineers, in this day and age, that can do it all vs. being silo'd into their coding, testing, or spec'ing narrow band. Specialization is not sustainable. And the Partner system needs to be nuked away: more and more it's leading to bad short-term shiny decisions meant to make Partner. Well, this list goes on. I think our next CEO comes from the outside, because only an outsider at this point can scrub the company clean and ensure that the corporate DNA is rewritten.

Stealth Layoffs: comments here for a while have been saying don't expect anymore large layoffs but do expect ongoing stealth layoffs, the kind that don't trigger the WARN act, let alone publicity. If you see your leadership meeting with HR far more frequently than usual, should you be nervous? Well, first step, ask what's up. If the answer is unsatisfying and doesn't ring true: yep, be nervous, especially as FY10 wraps up and new FY11 reduced budgets kick in.

If you or your group has indeed been affected, please, if you will, share as much as you can.

Mini-Microsoft Microsoft -- Comments

Just a quick celebration of this morning's news: Robbie Bach is retiring from Microsoft.

I'm so happy for him. And for Entertainment and Devices. And Microsoft.

This is a great opportunity for E&D to evolve and restructure. And, of course, a great opportunity to really screw up who to put in charge and such.

And yes, J Allard is out of here as well. Don Mattrick and Andy Lees step up. Also: David Treadwell side steps. And Office shuffles up a little bit.

What would you do with the various groups, products and who else would you put in charge?

Mini-Microsoft Microsoft -- Comments

Time for another quarterly update - all indicators point to a great quarter. With Win7's results and upcoming releases of Office 2010, Natal, and Windows Phone, things are on the upswing. Like I wrote back in July 2009, I believe that Microsoft has turned the corner and is headed in the right direction, though by no means is the corporation out of the scary neighborhood a lot of bad turns sent it into.

But we have hit the bottom with Vista and have emerged as the can-do underdog. If Microsoft knows anything, it knows how to do underdog. We really need to learn how to be the gracious competitive top-dog, too, but for now, underdog works.

Plus, given time, the context of the competitive marketplace has changed a lot. First: thank goodness for competition. Even pureblood Google and Apple fans should be thankful for competition from Microsoft, even if they deign its presence with faint of disdain and use air-quotes when saying the word competition (and for some reason, I can't get a vision of the Seattle Weekly's Uptight Seattlelite out my mind while writing that). Second: there's enough growing concern with Apple and Google's success that folks naturally want balance and by no means do they see Microsoft as dominating. Rather: underdog, fighting for balance.

Things have gotten interesting again. Let's check-in on some of the original reasons this random blog started up:

Improved:

• Microsoft needs to reduce employee size. It’s too big. It doesn’t need a quicky Atkins-equivalent. No, it needs to get itself on a corporate exercise program that will shed itself of unwanted groups and employees. And stay on that.
  • Wellll, we added a lot of jobs in the five years after that point, but when the cold harsh reality of over-hiring became obvious, it was handled (poorly) through layoffs.
• Microsoft needs to stop hiring. It’s hard enough finding the scarcest of treasured corporate resources: the talented individual suitable for working at Microsoft. Stop hiring, trim down, and rebalance those precious scare employees inside to where they can be more productive and make products that delight our customers.
  • There have been freezes and slow-downs so that's good. But some hiring continues. What we really need is an efficient defrag to allow load balancing in the company.
• Unleash employee driven innovation with a Microsoft Labs community area.
  • We have various labs now and other efforts that have come and gone.
• Re-energize the home market. The home market is pretty tepid with-respect-to Microsoft-branded software. It can’t take that much effort to invigorate Microsoft for the home user and make it cool.
  • Yes, we realize now that the consumer market is worth pursuing vs. making the IT department happy with limiting features. People find cool technology now outside of work and bring it into the workplace (e.g., the iPhone). This is much improved and has a long way to go before we're great at it. Actually leveraging the power of the individual PC is still barely tapped, and probably groups are confused given Azure and three-screens about pushing more onto the desktop than we are.
• Start working vigorously on Internet Explorer again. Winning the browser wars, dusting off our hands, and running away screaming from IE to the Next Cool Thing represents the very worst in less-than-competitive behavior.
  • Yep, we are working on IE with great passion. How we participate and influence HTML5 will be an interesting process to watch. I have no faith in the W3C (what was the last useful thing they helped create... XML namespaces?). HTML5 is the Next Big Thing if you listen to some folks who have large impact regarding Microsoft's future direction, so something is going to happen here. Have fun, IE-team!
• Less research, more application.
  • Goodness knows most of the researches I know or occasionally work with are motivated to find out what product teams need and get inline with producing interesting features that the product team just doesn't have the background to create, so kudos there.
• Continue the community effort and make it so if you’re not leading cool innovation, your butt is dedicated to some time per week helping out in the community, sharing all that wonderful knowledge between your ears. Reward that!
  • I did have this under the next section of "Not-addressed" until I realized that employee blogging covers this and has become so rampant that it has faded to a point that it's not acknowledged ("blogging is dead" and everyone now of course communicates in spurts of 140 characters. Uh-huh.). I'd like to see this turn into engineering employees writing more code that ships outside of our product line rhythm.

Not-improved:

• Re-interviewing: all employees below a certain life-time review average need to re-interview. Those that don’t make the cut the second time around get to look for new opportunities elsewhere.
  • Just an idea regarding what to do for people who do not have career momentum. Over the years, the question has been: "Will this person make Level 63?" - if not, they should find a new company.
• Back to Basics. Win32 and C++. Bread and butter. Not everything can run in the freaking CLR.
  • Our development story is a complete mess. And I don't see it getting any better. I'd say we're on a collision course of Bach vs. Sinofsky given development options for the Windows Phone vs. Windows. In the middle of this is a meandering DevDiv organization. If we have a gap in our underdog armor, it is our development story.

Back to quarterly results: the analysis I look forward to:

• Mr. Joe Wilcox over at Beta News
• Mr. Todd Bishop over at TechFlash's Microsoft Blog
• Mr. Joseph Tartakoff somewhere within paidContent.org.

Friday we have a Town Hall. I'm sure there will be questions about going forward competing with the iPhone and iPad and Google. And maybe questions / comments like:

• Are the layoffs over?
• Wow, what a great quarter. I'm really looking forward to my raise this year...

Administrivia time...

This old blog: hey slacker blog-writer, what's going on here? Well, obviously not much. Mainly, unlike many of you talented people, I don't do multitasking well. Writing especially. Back, going on six years now, this was my spare time focus for writing and reading & responding to all the great comments. It was a unique place that arose organically as a lone voice to ask, "Aren't other people concerned about where Microsoft is going?"

Well, this lone voice has other writing passions right now (not involving Microsoft) and that's where I'm putting the occasional spare time I squeeze out of my life. I'm sure you can understand. It also happens at a time where things are fairly good with-respect-to Microsoft's future and direction. Yes, there are problems but there have been more successes than failures and the success of our competitors have provided clarity regarding direction and what success looks like.

If there are interesting constructive topics you'd like to discuss, please let me know.

Mini-Microsoft Microsoft MSFT -- Comments

Time for another Microsoft earning announcement. I'm going to be missing you, Mr. Liddell, and your New Zealand accent. With so many tech companies reporting good numbers and with Windows 7's success, I dare say that we're expecting a rosy quarterly earning report. And, if that's the case and knowing Mr. Ballmer's past record, he'll say something financially scary soon to rain on the parade.

Places I track for news on earnings include:

• Mr. Joe Wilcox over at Beta News (Joe has been on fire lately with all of his postings - one reason I've been quiet here is that when I think of something to write about, Mr. Wilcox already has it written up and posted)
• Mr. Todd Bishop over at TechFlash's Microsoft Blog
• Mr. Joseph Tartakoff somewhere within paidContent.org.

What questions do you expect or would you like to come up during the call? And if they don't come up during the conversation with the analysts, what Q&A do you want to send Mr. Ballmer's way during our upcoming Town Hall meeting?

• Windows 7 continued success: how does that turn into profits and what kind of projections are we looking at?
• Entertainment and Devices re-org: how does that align for future success and avoidance of being one big huge money pit?
• Windows Mobile 7: we so dropped the ball in our early phone OS presence that now it seems like it's a losing battle to have a dog in this fight. But WinMo7 is out there. To me, I can imagine this becoming like the Zune HD: well praised and all, but not making a dent in the market because everyone has already moved on to the iPhone platform.
• Bing: % of market share on track?
• Efficiency: are back to our "we always fire the bottom 10% every review cycle" line of B.S. or are RIFs and layoffs still in effect? Given that the tech market at least seems to be turning around with-respect-to hiring (at least looking at the internal openings in Microsoft and how often I get pinged by recruiters), does Microsoft need to close down on the layoffs loudly and publically for both morale and recruitment's sake?
• iPad iPad iPad! So what, the techie echo-chamber screams for the iPad? I'll be quiet happy with my Kindle for now, just because I do need it for lots of book reading vs. momentary goofing around with apps and browsing. Still, it does extend Apple's reach into the Windows market. What 'cha gonna do about that, Microsoft? How come you never thought of something like this? Or a book reader? You had what and what? Wow...
• Ballmer: seems as though people are questioning Mr. Ballmer's continued CEO-ship. How much longer did he say he's in for being CEO?

Going back to the layoffs: first of all, this round does need to wrap up by end of FY10. The stress of possible layoffs will continue to have a negative effects on Microsoft, let alone recruiting. We should have one last big flush and then call ourselves done. I'm tired of the layoff rumors as much as anyone else. Probably more so, given the comment fear-mongering. To paraphrase a commenter here: Mini-Microsoft has correctly predicted 12 of the last 3 layoffs.

One commenter made a good point in that it is going to take a while to work through the fat, though, because Microsoft dug itself into such a deep, undisciplined hole that when layoffs were needed, no one knew how or where to start and certainly didn't realize how bad it had become.

(later...)

Thanks to the deferral $s, it was a break-out quarter. Some follow-ups:

• Joe Wilcox: Microsoft reports $19 billion quarter, lifted by $1.71 billion deferral Betanews
• Todd Bishop: Windows 7 sales lift Microsoft to record revenue, strong profits and PC Windows sales strong, but other Microsoft units struggle
• Joseph Tartakoff: Microsoft Blows Past Analyst Estimates paidContent
• Mary Jo Foley: Earnings take-away Microsoft is still powered by Windows All about Microsoft ZDNet.com
• Brier Dudley: Brier Dudley's blog Microsoft earnings report includes CFO's hush deal Seattle Times Newspaper
• Nick Eaton: With Windows 7, Microsoft kills Wall Street with record quarter and Breaking down Microsoft's Q2 earnings

Mini-Microsoft Microsoft MSFT -- Comments

With today's 800 Microsoft layoffs, Microsoft Layoff 2009 has reached its final milestone and shipped, exceeded expectations of 5,000 with 5,800 reduced positions.

Err... yay?

Last week during the Town Hall Mr. Ballmer confirmed there would be one more iteration on the layoffs. And after that? Who knows. More to come? Maybe. Booga booga!

You know, we have people working for Microsoft (or, at least did, I don't know, maybe no longer) responsible for driving executive leadership education and growth at Microsoft. This is their friggin' job. Develop Microsoft Leadership at the executive and L68+ levels. So, has anyone hemmed and hawed in-front of Mr. Ballmer and mentioned that this nickel and diming layoff approach is at the worst case end of the layoff management scale?

The looming threat of continuing RIFs and layoffs indicates that Microsoft is just too big for its leadership. It is beyond their capabilities to wrap their minds around everything Microsoft is doing. It has gotten away from them. What needs to go? Hell, I don't know even what all these people do, and you want to decide who stays and goes?

Yes.

Cut deep. Cut once. Get on with it and say, "We're done. We have aligned our company to be efficient and effective within this new global economic climate and are ready to focus on returning to profits and market share growth."

Done.

Coverage I've noticed today on the outside:

• Mr. Brier Dudley's blog Microsoft cuts 800 more jobs, including 200 in Puget Sound Seattle Times Newspaper
• Mr. Joe Wilcox: Is there any sense to Microsoft's 800 layoffs Betanews and Former Microsofties, Can I Tell Your Story « Oddly Together
• Mr. Nick Eaton Microsoft laying off 800 more
• Ms. Mary Jo Foley Are the Microsoft layoffs over now All about Microsoft ZDNet.com
• Mr. Joseph Tartakoff Microsoft Cuts 800 More Positions paidContent

On Don Dodge:

• Mr. Michael Arrington: Microsoft Loses Don Dodge. This Is A Huge Mistake
• Nick Eaton Startup guru Don Dodge among Microsoft layoffs
• John Cook Startup guru Don Dodge among those let go in Microsoft cuts

And, bummers for me given that she interviewed me for Microspotting, Ms. Ariel Stallings tweet about being caught up in this layoff round.

Coverage from the inside? No email. Quiet. Quite dysfunctional. There was something linked off of the MSW site and it also had a FAQ document that had to be one of the worse FAQs I've ever read. There is an "A" portion to an FAQ and in this case some of the questions were great but the answers looked like they were generated from some sort of English obfuscation Perl script 3rd place prize winner.

So, I'm going through about sixty comments now on the older post. I think it was necessary for Microsoft to have layoffs due to the mismanaged growth and lack of focus and direction our Senior Leadership Team has given us. But it should have been twice as much, done all at once. Now we dither.

Were you affected by the layoff or know someone who was? I'd be interested in knowing which groups and organizations are affected.

Mini-Microsoft Microsoft -- Comments

October 22nd 2009. Windows 7. The circle is now complete.

What is Windows 7? There's a lot that Windows 7 is (oh, it's faster, it has an improved task bar, peeking, snapping, homegroupin', stable drivers and some pretty freaky desktop pictures) but the big thing that it isn't is that Windows 7 is not Vista. It didn't suffer Vista's raging dysfunctional mismanagement and broken windows. It didn't require a reset. Sure, it wasn't perfect and there's a lot of improvements yet to be made in focus and team productivity, but the Windows team delivered. So toot that damn horn, because this here train is arriving on time.

With FY10Q1 announcements coming this week and along with Windows 7, I hope we have a lot of good things to talk about with the analysts. Google and Apple and Yahoo! certainly did. Usually we release our quarterly earnings on the appropriate Thursday afternoon, after closing. It is unfortunately disturbing that we've decided to release our FY10Q1 earning results instead on this Friday morning before trading. I say disturbing only because the last time we did this, a whole bunch of Microsofties were pulled into a layoff. Now... hopefully this earnings report is delayed so that we can have this Thursday the 22nd be all about Windows 7 and not our financials. And I can not imagine that we (and by "we" I mean the Microsoft Senior Leadership Team) would be so dumb as to release our flagship product on a Thursday and turn around and fire a bunch of people the next day.

So, anyway, what's in the mix as the financials come up this week?

Windows 7: check. Thank goodness for SteveSi. I certainly hope he gets paid a lot more than Robbie Bach this year.

Within the Windows 7 reviews, there's going to be a point-of-view that the operating system is dead, which is, ah, kinda dumb. Your web browser isn't going to bootstrap that Intel CPU on its own. What might be dead is rich applications, which is a fair argument and Microsoft is failing to provide much in the way of new rich applications. In fact, we are cutting them one by one (Money, Encarta... Streets, you best watch your back). Sure, there's a transformation to online replicated services and all, but we really need to convince our consumers that there is a strong worth in having a Windows 7 on your laptop so that it's not a fancy glowy brick when the internet is down.

Kindle? Wouldn't it be sweet if we had a nice ebook reader application? We could call it... mmm, Reader?

Windows Live is supposed to help with building value via rich applications. Live has been broken out of Windows to free it from the consent decree and all ('cept for sneaking a Win7 component out early, wink-wink). Messenger, Mail, Photos, Movies, and an awkward online service. And Live Writer (though rumored a dead-man walking per comments).

It's a fair start, and if I had my druthers OneNote would move out of Office and into Windows Live to be the essential authoring companion to the Windows experience. Windows Live Essentials is a good start, but to add some joy into owning a Windows machine, what we need just as urgently is Windows Live Non-Essentials.

Joy. There's a concept just asking for a planning pillar. How strangely would your coworkers look at you during spec reviews if you asked how joyful the feature happened to be?

Windows 8: speaking of planning! The Sinofskyfication of Windows continues, along with alignment around his good lieutenants.

Office: hey, hey, hey, there's a Beta on the way. The Office train lost its conductor but it mostly seems to be still on track. Though trust me: Office wants its Steven back. Bad.

Mobile: Holy. Crap. I don't think we have any unbruised skin left on our body to take any more lumps regarding our mobile strategy. The Microsoft Mismanagement theory is in full force as we throw any willing body into the Mobile effort. Something good has to come out of those typing monkeys, rights? Windows Mobile Phone 6.5 or whatever the hell it's called didn't win any "Wows" and I discovered 1:1 the worst question to ask is, "So, can I upgrade it to Windows Phone 7?"

Look. Let's talk about device loyalty. I first started with owning PocketPCs. An HP Jornada. I loved it. When upgrade time came, HP had bought Compaq and abandoned the Jornada for the iPAQ (what, they had the iThing first?). So, unable to upgrade to the next CE, I cursed a little and bought one of those iPAQs. But HP decided not to allow it to be upgraded. So I switched to Dell to get their latest Axim PocketPC. Dell would be a safe bet, right? And Dell gave up on the line. My latest act of company loyalty: getting a powerful HTC WinMo 6 device. It was cut-off the 6.5 train, and soon, I'm going to be buying a new phone.

And I'm going to buy an iPhone.

I hate it. I hate to think that I'll be installing Apple software on one of my computers because their PC software is so inelegant and buggy (check Watson). I hate that I've been so loyal to the PocketPC platform and Windows Mobile but I've finally had my chain yanked for the last time. I'm not buying a 6.5 device only to have it abandoned when 7 comes out. Microsoft is doing nothing to convince me that it's going to get any better. We suffer through rumors that Pink is imploding and issues with Sidekick data doing disappearing acts while our CEO has conniption fits over Microsofties sporting iPhones. Dude, this is why.

In this case, Microsoft is going to have to earn me back and convince that not only do they have a better experience and better quality phone but that they also won't kick me off to the side of the road when a new release comes along, spinning a sad tale that the carriers make all the decisions.

Dev Div: If I had to sit down tomorrow and write a casual application for the PC, my mind would fork itself in about five different directions. Native with ATL? WPF? Silverlight? An HTA? And what's up with XNA? If I want to write an app for the Zune (which Zune?) what do I do? And can it run on some future mobile device? And the PC? And Xbox?

And how do I share it? How do I sell it? And, ah, crap, you mean you just released a whole new version of C# / Silverlight / XNA that I have to go and relearn? Maybe those free Starbucks coffee dispensers wasn't a good idea...

If anything, I'd probably be pretty damn tempted to invest time learning Adobe AIR. And I'm thinking that while smack dab in the middle of the Microsoft bubble. There are a lot of Partners in Dev Div, and I'm not seeing any benefit from their concentration. The Windows client should be the premiere development platform. It's not. What am I missing?

Are We There Yet? Are the layoffs over? Has Microsoft stabilized? Of course, I'd be satisfied with another 10,000 or more positions being eliminated. But I want it done in one fell swoop, like all the conventional wisdom out there dictates, so that the remaining work force can align itself and get to work and not constantly worry if their group is next. If we're going to continue this quarterly rhythm of maybe-layoffs, maybe-not then morale is going to get seriously poisoned. Let's finish this round and call it done.

Ballmer: well, Mr. Ballmer, if you ever wanted to leave on a high-note, this is it. I'm frustrated because when you hear Steve 1:1 you know that he gets it. He knows some key strategies and things that need to get done. But then Yahoo! happens. Vista happens. Over-exuberant hiring happens. Layoffs happen to shed off the over-hiring. And a flat stock price happens. So something is seriously not connecting between (a) when you hear Steve talking and (b) when he makes major decisions. Hmm. Maybe it's something about guys named Steve having localized reality distortion fields.

This week, as we celebrate Windows 7, you do see an undercurrent of knife-sharpening while examining Mr. Ballmer.

• Ballmer takes center stage with Windows 7 by Bill Rigby at Reuters. This week's award for damning praise: "He hasn't destroyed the company, but it clearly is not at the top of its game." Yikes. Is that on Mr. Ballmer's commitments? "FY10: do not destroy the company..." I should have added that to mine.
• Forecast for Microsoft: Partly Cloudy by Ashlee Vance at the New York Times. It almost wants me to say, "Hey, no, we are the Evil Empire here! Not Google! I. AM. THE. EMPIRE. Don't you put us in that corner!"
• NY Times all but says it: Ballmer must go by Fake Steve. This is the highlight reel of the NYT story above, with scary graphs charting Microsoft stock performance compared to Apple and Google. Two follow-ups: Why the Borg's copycat business model no longer works and Why won't the Times just come out and say what they mean about Fester?

The biggest question still out there: just who would you replace Ballmer with? If a shareholder revolt was to actually happen (shyeah, right) who would be the right choice to lead Microsoft? There is no heir apparent. And no obvious motivation to find one. But wait. Maybe, just maybe... you know, we'll have to wait and see and discover if Steven Sinofsky's upcoming book One Strategy! has a chapter on 'How To Become the CEO of a 100,000 Employee Company' (hopefully followed by the chapter 'More With Less - How To Transform a 100,000 Employee Company Into a 70,000 Employee Company').

Any fireworks you're expecting this week of Windows 7 and Quarterly results?

Mini-Microsoft Microsoft -- Comments

Some quick comments on this year's Microsoft 2009 Company Meeting.

First, how did my six hopes for the Company Meeting hold up?

1. Steve Ballmer comes out first to set the context for the meeting in light of a pretty awful FY09 Q3 and Q4: Zilch.
2. Practical vision: well, Craig and Ray did seem to focus on the practical aspects of product groups, research, and inbetween the technology transferring power of the labs groups. Seemed practical. But then there was that whole Avatar assistant thing that no one around me felt like was real: one-half.
3. Demos are short, sweet, powerful... sorry, but Elop's demos sucked the life out of entire stadium. Some were good, and some were really really short. So: one-half.
4. Show us the new stuff. Hey, we did get to see some new stuff. Bing. Zune HD. Map goodness. No Halo. New ad cuteness. But it was still conservative. Hmm. How about: three-quarters realized.
5. New simple review system? Phffft. Not unless thwacking balls w/ your avatar is our new review system. 160 for that. Zero for this.
6. Serious wrap-up by Ballmer. Zero.

Add that up and we get 1.75/6.00 - hey, almost one-third realized.

Now, I'm not going to go into revealing anything all that interesting that happened in the meeting. Just my general impressions of the day.

Kevin Turner was first and, well, I'm kind of tired of the "ThankYou"s by now. He did take on the job of addressing the tough year and I believe he said some things that really surprised me. Growth hides mediocrity being one of them. That we over hired. Sure we all thought it, too, but to now go and put on the 20/20 glasses and speak it in front of the company gives me hope (hmm, need a new word) that it won't happen again. Same with the realization that you shouldn't start up doing work in good-times that you know you'd drop and cut during bad times.

Dr. Qi Lu might be my favorite techie right now. I was impressed with what he's brought together for Bing and what's coming and how he has focused the team and adopted some of the new technology that Satya was showing. Who the hell thought we'd be feeling so good about our search decision engine? Ever?

Elop. Steven. Baby. Dynamics. XRM. Really? What did I do to you to have that forced down my eyeballs? I'm pouring another glass of wine right now hoping I can kill whatever brain cells are still connecting this demo memory together. Geez. Did anyone give you advice that this was a bad idea? If so, keep listening to them. If not, you're seriously lacking good reports willing to give you honest feedback.

Robbie Bach did okay, but I can't say the demos blew me away. The table-top demos were full of slick sparkly presentation but... it was all stuff I've seen one way or another so nothing new there. He missed a golden opportunity for Microsoft-Fan-Boy love to go and have someone play Halo:ODST on stage or show some great Zune HD apps.

Bob Muglia. What did he talk about? I remember the real cool tech for traces and then WinDiff. Did he talk about how we're losing the edge on client development for Windows and how it's all a confused multi-SDK technology mess centered around everything being .NET based?

Sinofsky went pretty fast - when in doubt, load up the stage with a bunch of new, cool technology and play with it. I loved the reveal on the Mac Air case ("It's aluminum!"). And I think Steven gets the best line for when the train let loose its blaring whistle he said something along, "This is where someone mentions about the trains running on time."

Craig and Ray: it was nice that they switched up their presentations - that added some energy. But not enough. It seemed a lot more practical this year, other than what I mentioned previously about the whole very well staged Starfire demo. I hadn't seen that in like... over ten years.

And then Steve Ballmer. I've got say, at this point in the day I was pretty much in a "Where's mai KoolAid" funk until Mr. Ballmer came on stage and started presenting. I feel this is a big transitional year for Microsoft. I've said we've turned the corner, but that doesn't mean we're out of the bad neighborhood yet, nor are we incapable of making bad decisions all over again. The second half of FY09, and what we are still enduring as part of the economic crisis, has provided a certain level of alarmingly crisp clarity to refocus, and I believe Ballmer's presentation served for about as much focus we're going to see in the near term.

And I like how he ended his presentation. How do we feel? He reflected on how Microsoft is not a normal company and that its employees have an unnatural emotional attachment to it (yep, that's true - it can cause them to have all sorts of crazy reactions and do crazy, passionate things). How do you feel? Steve, well, he wants you to feel good about where we are, what we're doing, and where we're going.

I must feel good, because I have hope.

(Oh, by-the-way, if you see Mr. Ballmer walking your way: hide you iPhone. Trust me on that one.)

Additional links:

• Rule No. 1: Hide the iPhone from Ballmer at the Microsoft meeting
• Microsoft's Bing 2.0: Coming this fall (maybe even next week)
• Twitter highlights from Company Meeting at Safeco

Mini-Microsoft Microsoft -- Comments

(Updated below for the Extra-Long-Labor-Day-Vacation-Layoff of September 3rd 2009)

I'm one of the biggest Microsoft Company Meeting fanboys *evah*, but even I'm surprised that we're having a full-blown Company Meeting this year at Safeco Field in Seattle. I thought it and MGX were going to be cut without a second thought given the economic reset we are all enduring. I'm wrong. Given that it is happening, it's my opinion that this year's Company Meeting sure can't be a clone of last year's. I mean, last year's was great and everything... but now our everything is different.

I think about the context around this year's Company Meeting. There is what the crowd brings, what the crowd expects to see, and what the Senior Leadership Team (SLT) wants to accomplish with this meeting. Look, against this current economic tide the Microsoft SLT is putting on the Company Meeting. There has to be a pretty big goal they are shooting for, not just rah-rah party-demo time.

Because there are two very large elephants sitting down front and center with the hand-picked floor crowd. Two grumpy elephants with very good memories, one of January 22nd 2009 with 1,400 Microsoftie layoffs and the other with May 5th, 2009 and 3,600 further Microsoftie layoffs. Folks are going to come into Safeco, grab their box lunch, sit down with their co-workers and friends and as they fold their pink paper airplane, they are going to remark, "I can't believe they are spending all this money for today. <<Fill name in the blank>> and more could have kept their job if they just cancelled this horse and pony show."

These folks might have on their Proudly Serving My Corporate Masters buttons, but they've scratched out the Proudly part. They are staring at the grumpy elephants, and are looking to the SLT for some serious L.

I'm just imagining what corporate baggage people are bringing in during the Company Meeting. Maybe they were part of the original 1,400 and had to scramble through interview loops to find a new Microsoft position. To be clear: I wanted cut-backs when we were in the 50,000 range of employees, let alone approaching 100,000. 100,000, man. That's crack-pipe craziness. Had we been more prudent and efficient over the years, we wouldn't have reached the stage where the light bulb went off over Ballmer's head and he said, "I know... layoffs!" We got bloated and we cut, and we should cut more. But our leadership shouldn't have gone down that crack-pipe path to begin with.

Anyway, looping back to the 2009 Microsoft Company Meeting, some of my hopes and expectations:

One: I expect Steve Ballmer to come out front first, before any other Microsoft leadership, to speak the truth about the last year and where we are now. He must acknowledge it starkly. We had layoffs. We had inefficiencies. Positions had to go due to the economy being unable to sustain those parts of the business. There are people missing this year that, last year, were some of the biggest Microsoftie fans.

And, there are people here this year that will not be in the audience next year.

Take that in.

With success in the middle of hardship, this is a rare opportunity to enact change in Microsoft culture and recalibrate to being efficient and streamlined. I want Ballmer to get out front and say, "Today, we're celebrating our success of Windows 7. From this success we are learning and we are acting. We're learning why it was a success, how to do even better, and then taking those lessons and putting them into practice. In Windows. In Office. In Dev Div. In all of Microsoft. The rest of today we will not only tell you where we are and where we are going, but we're also going to discuss honestly how we're changing to be an efficient, streamlined company that smartly uses its successes to leverage good change. For the benefit of the company, our customers, our shareholders, and our employees."

Two: Any vision this year has to be practical and realized with one, two, or at most, three years. And, closing the loop on accountability, there's a discussion and a review of how the vision of the past has brought us to practical results. The pie has come down from the sky and now it's time to eat.

Three: demos are short, sweet, powerful, and made especially for a crowd of some of the smartest (plus good looking) people on earth.

Four: if it's new and hot, we get to see it now. That new Halo game. Zune HD. Stuff that even Beta testers haven't seen yet. Give us some reward for actually working for Microsoft and being excited about seeing things that are new and known by very few. Hell yes we'll tweet and blog about the coolness. And to assuage any anxiety over that: happy, enthused Microsofties sharing their enthusiasm for Microsoft with the world == a good thing in this day and age.

Five: a short introduction by LisaB of the new, efficient, streamlined review system: a simple Word document that let's you cover what you were responsible for, how you did, and your manager's assessment. Hey, I can dream.

Six: wrap-up by a serious Steve Ballmer. No running around high-fiving people or shaking his fists in the air to get a "YeAAAH!" from the crowd. But rather a serious Ballmer who covers what we've been through, how we're going to change, and a re-enforcement for the success at Microsoft being something that has to spread through-out the teams.

After the Company Meeting, I intend to sit down at Pike Brewing and ponder over: what did the SLT intend to accomplish this year at the Company Meeting? How are the Microsofties attending better for having been there?

My concern is that the template for the meeting this year is the same as it ever has been, with some comedic hijinks, Kevin Turner covering all the "gooood" results that we should be fired up about, music, Liddell's financial review, an opaque speech by Ozzie, very late arriving busses full of people wondering why we can't figure out traffic control, rambling demos of misbehaving and barely competitive technology, paper airplanes smacking the back of my head, and a big cheerleader Ballmer at the end, all screaming and full of gusto... and totally passing over the hardships of this year.

I hope that all doesn't happen, but if it does, later I'll just sit at the bar between the grumpy elephants and drop some tears into my beer while still musing over what the SLT's intentions and goals might be.

What goals and expectations do you have for the Company Meeting?

Addendum: as of September 3rd 2009 it looks like it might be two large grumpy elephants and a little baby elephant:

• Ms. Sharon Pian Chan "Microsoft laying off 27 employees in Redmond and Bellevue" Seattle-Times
• Mr. Nick Eaton "Microsoft to lay off 27 from Redmond, Bellevue" Seattle-PI

Weird. How much more than 27? And just who is affected? I don't see it on the WARN site yet. Snippet from Ms. Chan's post:

Microsoft spokesman Lou Gellos said the company is making cuts across the country, but he did not elaborate on how many more jobs in the U.S. were affected.

"I can confirm that part of our effort to reduce costs and increase efficiencies involved 27 job eliminations here and in other regions across the country. While job eliminations are always difficult, we are taking these necessary actions to realign our resources against our top priorities."

Mini-Microsoft Microsoft -- Comments

Hello - Today we're releasing our Advance Notification Service (ANS) for the September Security Bulletins, which are scheduled for release Tuesday, September 14, 2010. This is a service we provide to help enterprises plan and prepare for the upcoming security bulletin release.

This month we will be releasing 9 bulletins addressing 13 11 vulnerabilities affecting Windows, Internet Information Services (IIS), and Microsoft Office. Four of those bulletins carry a Critical rating, with the rest rated Important.

We recommend as always that customers review the ANS summary page for more information and prepare for the testing and deployment of these bulletins as soon as possible.

Next Wednesday, September 15th, Adrian Stone and Jerry Bryant will host a public webcast during which they'll go into details about the bulletins, and answer questions live on the air. To register for this webcast in advance:

Date: Wednesday, September 15, 2010
Time: 11:00 a.m. PDT (UTC -7)
Registration: https://msevents.microsoft.com/CUI/WebCastEventDetails.aspx?EventID=1032454433

We highly recommend that customers register for our comprehensive alerts if you have not done so already. Sign up here: http://technet.microsoft.com/en-us/security/dd252948.aspx

Thanks,

Carlene Chmaj

Security Response Communications Manager

Follow us on Twitter: @MSFTSecResponse

Hi everyone,

Since we released Security Advisory 2269637 on August 23, we've continued to conduct an investigation not only into our own affected products, but also into how we can best help to protect customers given DLL preloading also affects some third-party applications. We'd like to provide an update on our investigation.

First, I want to be clear that Microsoft plans to address those of our products affected by this issue in the most appropriate way for customers. This will primarily be in the form of security updates or defense-in-depth updates. Also, due to the fact that customers need to click through a series of warnings and dialogs to open a malicious file, we rate most of these vulnerabilities as important.

One of the goals we have at Microsoft is to make it easy for developers to create secure applications on our platform. As we stated in our previous blog post, DLL preloading is a well-known class of vulnerabilities and we have had guidance for developers in place for quite some time. We have recently updated that guidance to provide more clarity.

Even with improved guidance, we recognize that it may take quite a bit of time for all affected applications to be updated and for some, an update may not be possible. With the advisory, we released a tool to help customers protect their systems (see KB 2264107). This tool provides a framework for customers to modify the behavior of the DLL search path algorithm and essentially block unsafe DLL loading. When installed, this tool still needs to be configured in order to block malicious behavior, and customers have asked us for our recommended setting. As a result, our Security Research & Defense team has written a detailed blog post on this topic and has worked with our Microsoft Fix-it team to develop a Fix-it to enable our recommended setting which blocks most network-based attack vectors. (Please note that the tool needs to be installed prior to enabling the Fix-it.)

Many enterprise customers have asked us to make it easier for them to deploy this tool. As a result, we are working with the Windows Update (WU) team to add the tool to the WU catalog. This will make it easier for those running Windows Server Update Services (WSUS) to deploy. We are working to have that solution in place within the next couple of weeks. We are also considering releasing this solution more broadly via WU as a defense-in-depth update for all customers in an "off by default" state. We will share more information through the MSRC blog as our plans are solidified.

Customers should note that the tool is limited to protecting against DLL preloading only and does not protect against .exe files that do not properly load files via a fully qualified path and developers will be required to update those applications accordingly.

Thank you,

Jerry Bryant
Group Manager, Response Communications

Overview

Today we released Microsoft Security Advisory 2269637. This is different from other Microsoft Security Advisories because it's not talking about specific vulnerabilities in Microsoft products. Rather, this is our official guidance in response to security research that has outlined a new, remote vector for a well-known class of vulnerabilities, known as DLL preloading or "binary planting" attacks.  We are currently conducting a thorough investigation into how this new vector may affect Microsoft products. As always, if we find this issue affects any of our products, we will address them appropriately.

Additionally, today we are providing a defense-in-depth update that customers can deploy that will help protect against attempts to exploit vulnerable applications through this newly identified vector. Finally, we are using our strong connections with researchers and partners in the industry to help address this new class of vulnerability. Our Microsoft Vulnerability Research program has been working to coordinate communication between the researcher who first brought this new vector to us and other application developers who are affected by this issue.

Technical Background

What this new research demonstrates is a new remote vector for DLL preloading attacks. These attacks are not new or unique to the Windows platform. For instance, PATH attacks that are similar to this issue constitute some of the earliest class of attacks against the UNIX operating system. The attack focuses on tricking an application into loading a malicious library when it thinks it's loading a trusted library. For this to succeed, the application has to call the trusted library by name instead of properly using its full path (for example, calling dllname.dll rather than C:\Program Files\Common Files\Contoso\dllname.dll). The attacker then has to place a malicious copy of the library in a directory that the system will search to locate the library and have that be a directory it will search before the directory where the trusted library actually is. For example, if an attacker knows that the application simply calls for dllname.dll (rather than using the full path) and it will look for dllname.dll in the current working directory before looking in C:\Program Files\Common Files\Contoso\. Then if the attacker can plant a malicious copy of dllname.dll in the current working directory, the application will load it first executing the attacker's code in the application's security context.

PATH or DLL preloading attacks have so far required the attacker to plant the malicious library on the local client system. This new research outlines a way an attacker could levy these attacks by planting the malicious library on a network share. In this scenario, the attacker would create a data file that the vulnerable application would open, create a malicious library that the vulnerable application would use, post both of them on a network share that the user could access, and convince the user to open the data file. At that point, the application would load the malicious library and the attacker's code would execute on the user's system.

Because this is a new vector, rather than a new class of vulnerability, the existing best practices that protect against this class of vulnerability, automatically protect against this new vector: ensuring that applications make calls to trusted libraries using full path names.

While the best protection is following best practices, we are able to provide an additional layer of defense by offering a tool that can be configured to disable the loading of libraries from network shares. In particular, because this is altering functionality, we encourage customers to evaluate this tool before deploying it. As part of your evaluation, we encourage you to review the information at the Security Research and Defense (SRD) blog.

We will continue our work with the researchers and the industry to identify and address vulnerable applications. And as always, we will update you with any new information we have through our security advisories, security bulletins and the MSRC weblog as appropriate.

Thanks

Christopher

Hello,

Today we published the Questions & Answers from the August 2010 Security Bulleting webcast. We answered a total of 17 questions concerning the March bulletins and open Security Advisories. No particular themes emerged from the questions but there were some good ones so please review them.

The video covers the core part of the presentation Adrian Stone and I gave during the webcast. We talk about the 14 bulletins for August and Security Advisory 2264072.

Please join us for our next scheduled webcast where Adrian and I, along with a room full of subject matter experts, will present on the Security Bulletins for September and try to answer all your questions live.

Date: Wednesday, September 15, 2010
Time: 11:00 a.m. PDT
Registration: https://msevents.microsoft.com/CUI/WebCastEventDetails.aspx?EventID=1032454433&EventCategory=4&culture=en-US&CountryCode=US  

Thanks!

Jerry Bryant
Group Manager, Response Communications

Hi everyone,

Yesterday we tweeted to let customers know that we were investigating a publicly disclosed vulnerability in the Windows Kernel-mode drivers (win32k.sys) affecting all supported operating systems. We are not aware of attacks that try to use the reported vulnerability or of any customer impact at this time. Today we have more information, as well as a planned course of action.

While most in the industry reported this as a low-severity vulnerability, it generated quite a bit of attention, and as always, we started our investigation as soon as we became aware of the issue. We have not yet reported on this issue because it's important we're thorough in our investigations, and there were a couple of possible vectors that we wanted to validate (or invalidate as the case may be) before we commented or defined a course of action.

As a result, we are now able to report that this is a local elevation of privilege vulnerability only. This type of issue allows attackers to gain system-level privileges after they have already obtained an account on the target system.  For this issue to be exploited, an attacker must have valid log-on credentials on the target system and be able to log on locally, or must already have code running on the target system. The vulnerability cannot be exploited remotely, or by anonymous users. 

We will not be releasing a security advisory for this issue, but it will be included in a future security update. We will continue monitoring the threat landscape and alert customers if anything changes.

Thanks to Dustin Childs and the rest of our security engineering team for their quick and thorough work to determine the cause and extent of this issue across platforms!

Thanks,

Jerry Bryant
Group Manager, Response Communications

Hello all. As part of our usual cycle of monthly updates, today Microsoft is releasing 14 security bulletins, addressing 34 vulnerabilities. Eight of those bulletins have a Critical severity rating, and we consider four of those to be high-priority deployments:

• MS10-052 This bulletin resolves a privately reported vulnerability in Microsoft's MPEG Layer-3 audio codecs. The vulnerability could allow remote code execution if a user opens a specially crafted media file or receives specially crafted streaming content from a Web site. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.

• MS10-055 This bulletin resolves a privately reported vulnerability in Cinepak Codec, which is used by Windows Media Player to support the .avi audiovisual format. The vulnerability could allow remote code execution if a user opens a specially crafted media file, or receives specially crafted streaming content from a Web site. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.

• MS10-056 This bulletin resolves four privately reported vulnerabilities in Microsoft Office. The most severe vulnerabilities could allow remote code execution if a user opens or previews a specially crafted RTF e-mail message. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the local user. Windows Vista and Windows 7 are less exploitable due to additional heap mitigation mechanisms in those operating systems.

• MS10-060 This bulletin resolves two privately reported vulnerabilities, both of which could allow remote code execution, in Microsoft .NET Framework and Microsoft Silverlight.

Currently none of the vulnerabilities addressed has been observed under exploit in the wild. In the following video, Jerry Bryant and Adrian Stone talk about why these four are at the top of our priority list:

The six other bulletins offered this month are rated Important. Two of the Important-level bulletins, MS10-047 and MS10-048, are Windows Kernel updates.

As always, Microsoft recommends that customers test and deploy all security updates as soon as they can.

For a closer look at some of the issues involved in these bulletins, our Security Research & Defense (SRD) team writes about MS10-048, MS10-049, and MS10-054 today on its blog.

We're also releasing Security Advisory 2264072 with this update. This advisory addresses the potential for attacks that leverage the Windows Service Isolation feature to gain elevation of privilege. In turn, the release of MS10-049 closes Security Advisory 977377, which described a spoofing vulnerability addressed in today's release. When early investigation revealed that this vulnerability is an industry-wide problem, Microsoft worked on a coordinated response with our partners in the Internet Consortium for Advancement of Security on the Internet (ICASI). A new standard was developed, RFC 5746, which allows developers of both client and server applications to address this vulnerability.

More information about the security updates can be found on the Microsoft Security Bulletin summary webpage.  Our Exploitability Index provides additional information to help customers prioritize deployment of the monthly security bulletins.

On August 2, we released MS10-046 out of band in response to a new zero-day vulnerability being exploited by the Stuxnet family of malware. This month, we have added Stuxnet and several other malware to the Malicious Software Removal Tool (MSRT) in order to help clean up systems that may have been impacted. Here's the full list of new malware being added:

• Win32/Stuxnet
• Win32/CplLnk
• Worm:Win32/Vobfus.gen!A
• Worm:Win32/Vobfus.gen!B
• Worm:Win32/Vobfus.gen!C
• Worm:Win32/Vobfus!dll
• Worm:Win32/Sality.AU
• Virus:Win32/Sality.AU
• TrojanDropper:Win32/Sality.AU

Please join the monthly technical webcast to learn more about the August 2010 security bulletin release. The webcast is scheduled for Wednesday, August 11, 2010 at 11:00 a.m. PDT (UTC -7). Registration is available here.

Reminder: You can follow the team for late breaking news and updates on the threat landscape here: @MSFTSecResponse.

Thanks!

Angela Gunn
Security Response Communications Manager

Hello; I'm Angela Gunn and I'm new to the Response Communications team. Today we're releasing our advance notification for the August security bulletin release, which is scheduled for Tuesday, August 10. This month's release is composed of 14 bulletins addressing 34 vulnerabilities in Windows, Microsoft Office, Internet Explorer, SQLMSXML, and Silverlight. Eight of the bulletins carry a Critical severity rating, and six are rated Important.

As always, we recommend that customers review the ANS summary page for more information and prepare for the testing and deployment of these bulletins as soon as possible.

For those who keep track of such things, this will be the most bulletins we have ever released in a month; we have released 13 bulletins on a couple of occasions. However, in total CVE count, this release ties with June 2010, so there's no new record there. Please join Adrian Stone and Jerry Bryant for a public webcast on Wednesday. We'll go into detail about all the bulletins and answer questions live on the air. Register at the link below:

Date: Wednesday August 11
Time: 11:00 a.m. PDT (UTC -7)
Registration: https://msevents.microsoft.com/CUI/WebCastEventDetails.aspx?EventID=1032454431

Thanks,

Angela Gunn
Security Response Communications Manager

Follow us on Twitter: @MSFTSecResponse

Hello -

During today's webcast our team of technical experts answered over fifty questions regarding the August 2010 Out-of-Band Security Release update questions.   Click here to review the entire list of questions and answers from today's Out-of-Band webcast Q&A page.

Also, here is the link to the Q&A index page for your review -  in case you wanted to view any of the past 12 webcast Q&A's.

As always, customers experiencing issues with the installation of today's security update should contact our Customer Service and Support group:

• Customers in the U.S. and Canada can receive technical support from Microsoft Product Support Services at 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates.
• International customers can receive support from their local Microsoft subsidiaries. There is no charge for support that is associated with security updates. For more information about how to contact Microsoft for support issues, visit the International Support Web site.

We look forward to your joining us during our regular monthly webcast on August 10, 2010.  Click here to register.

Thanks!

Christopher Budd

Sr. Security Response Communications Manager at Microsoft

Hello,

As we announced on Friday, today we released Security Bulletin MS10-046 out-of-band to address a vulnerability in Windows. This security update addresses a vulnerability in the handling of shortcuts that affects all currently supported versions of Windows XP, Vista, Windows 7, Windows Server 2008 and Windows Server 2008 R2. As our colleagues over in the MMPC have noted, several families of malware have been attempting to attack this vulnerability. The security update protects against attempts to exploit this issue.

For customers using automatic updates, this update will automatically be applied once it is released. Customers not using automatic updates should download, test and deploy this update as quickly as possible.

As we do with every bulletin release, we will be hosting a webcast to address your questions today at 1PM Pacific Time. Register now.

Thanks,

Christopher Budd

Sr. Security Response Communications Manager at Microsoft

Today we're announcing plans to release a security update to address the vulnerability discussed in Security Advisory 2286198 on Monday, August 2, 2010 at or around 10 AM PDT. 

We are releasing the bulletin as we've completed the required testing and the update has achieved the appropriate quality bar for broad distribution to customers. Additionally, we're able to confirm that, in the past few days, we've seen an increase in attempts to exploit the vulnerability. We firmly believe that releasing the update out of band is the best thing to do to help protect our customers.

Our colleagues over in the Microsoft Malware Protection Center (MMPC) have more details about what they've seen in the threat environment.

As always, we'll provide additional information as it is available.

Finally, as always, we'll hold a special edition of the bulletin release webcast on Monday, August 2, 2010 at 1:00 PM PDT. If you are interested in attending the webcast, click here to sign up.

Thanks,

Christopher Budd

Sr. Security Response Communications Manager at Microsoft