“Microsoft Update” Half Baked

Let’s see. In April, Microsoft released Windows Installer 3.1. In May, we got Windows Installer 3.2. This is June, so we must be due for another version of Windows Installer, right?

Sure enough, we got it… and a whole bunch more.

As promised, I installed – and have been trying to use – Microsoft’s new Microsoft Update package. Microsoft Update consists of the latest Windows Installer, tied into a single Web site that incorporates the functions of the old Windows Update site and the old Office Update site. Sorta.

The goal’s noble: Microsoft Update is a new service – offered at no charge – that provides everything you get through Windows Update, plus High Priority updates for Office and other Microsoft applications. It’s a one-stop destination for updates that help keep your computer more secure, up-to-date, and performing at its best. Microsoft Update includes the Automatic Updates functionality already found in Windows Update so you can choose to install High Priority updates automatically. Microsoft recommends that users of Windows Update move up to Microsoft Update.

Before you get your clicking finger in a frenzy, heed my warning: the sucker doesn’t work. Right now, on one of my production machines, I’m getting repeated notices to download and install two security patches. I download them, install them, re-boot, and a day or so later, I get another notification to download and install the same patches. My installation history entries show that they’re installed. My Critical Update entries show that they need to be installed. It’s Patch Keystone Kops, all over again.

The beta test versions of the latest Update software were so bad that they overlapped – one beta started before the previous one finished. Microsoft is shoveling “update” crap out the door, for reasons I can’t begin to fathom.

Avoid “Microsoft Update” like the plague. Wait until they get their act together. If they ever do.

Internet Explorer 7 Sightings and RSS To Go

Steven Binks’ Web site, bink.nu, sports a few screen shots of Internet Explorer 7.. Looks like the folks at Gnomedex in Seattle got an eyeful, with a heavy dose of RSS religion. (Good on ya, Chris!)

‘Course you Firefox users must be wondering what all the fuss is about. You’ve had handy access to RSS feeds for a long time. (To a first approximation, for those of you who don’t use it, RSS is a method for receiving notification about updates from a Web site as soon as they’re posted. See Dan Bricklin’s excellent intro to RSS. No, shamefully, I don’t have an RSS feed yet at AskWoody. It’s on my “To Do” list.)

CNet has a good overview of how RSS will be built into IE 7, and later into the next version of Windows (Longhorn) itself. Channel 9 is supposed to have a video of how RSS feeds will work in IE 7, although it doesn’t appear to be available at the moment – not sure why it was pulled.

Microsoft has posted a white paper on RSS support in Longhorn.. They’ve also nailed down specific XML tags to be used for lists associated with a Web page – a very good idea, if it’s carried through.

New MS AntiSpyware Beta Build 1.0.613, er, 614

On Friday, Microsoft posted an update to its AntiSpyware program, version 1.0.613. Then sometime between Friday night and Saturdary morning, Microsoft posted a new version, this one numbered 1.0.614. If you have recently downloaded MS AntiSpyware, you can check the version number by launching the program (use the icon down in the system tray, next to the clock) and clicking Help | About Microsoft Windows AntiSpyware.

If you don’t have version 1.0.614, you can get it here.

Quoth the Softies: In this second beta refresh (Build 1.0.613^H^H^H614), we’ve made other enhancements to the detection and removal capabilities, including improved Winsock LSP removal capabilities and support for long descriptions of categorized software. In addition, we have also extended the Windows AntiSpyware beta expiration date to December 31, 2005. Existing users of the beta (Builds 1.0.501 and 1.0.509) will receive a software update that extends the expiration date and includes the enhancements to the detection and removal capabilities. The second beta refresh is also available for download through this site.

Why the quick change from version 613 to 614? I dunno – and the people who do know aren’t saying. More Microsoft Mushroom Management.

Note that MS tries to get you to “Validate” your copy of Windows, but the validation is easy to bypass by simply clicking where indicated on the download page.

Ten New Security Bulletins – a Patch – and Microsoft Update, too!

Microsoft has released ten new Security Bulletins, numbered MS05-025 to MS05-034.

MS05-025 replaces MS05-020 (sic transit gloria, eh?) and fixes Internet Explorer so it handles PNG files correctly. A cretin could put a bad PNG pic on a Web site, or send one to you in an email message, that will take over your computer. If you use Windows Media High Definition Video, look at the warning in the Knowledge Base. Otherwise, the newsgroups are relatively silent, and this looks like a reasonably good patch.

MS05-027 looks like a disaster waiting to happen, but so far the newsgroups have only shown a few, minor problems. Go for it.

The rest look good, too. Patch away. (I’ll update the Patch Reliability page ASAP.)

Microsoft has also released a patch for the notorious MS05-019 patch that I warned you about two months ago. This patch of a patch appears to be OK, at least at first blush.

Just an idle note: that means both MS05-018 and MS05-019 were incredibly screwed up, and MS05-020 has been superceded already.

There’s a new, ho-hum, MaliciousSoftware Removal Tool.

Microsoft also released Microsoft Update, the first amalgamation of Windows Update and Office Update. I’m taking it for a ride before pontificating on the rights and wrongs of the beast, but if you want to take a look by all means swing by the Microsoft Update site and give it a whirl. Tell me what you think.

Catching Up

I’ve been on the road and under the weather for the past week. Time to get things kicking again….

Apple to Ditch IBM, Go With Intel

It’s official. The Mac is now part of the Intel-Microsoft-Apple triopoly.

While the move may be symbolic to some, to me it just means that Apple’s going to have to work harder to get its main business back in shape.

With the iPod selling like hotcakes and people downloading (and paying for!) legions of copy-protected songs from Apple, it’s getting harder to tell where Apple’s core might be.

By the way, I love my iPod, and WinAMP with ml_ipod works like a champ. (At least ml_ipod does. The latest version of WinAMP has an annoying bug in it that disrupts the default action when you double-click on some folders. Ah well. It’s better than being bombarded with iTunes ads.)

MS05-018 Patch Patched

Looks like Microsoft has finally ‘fessed up to the reports of Blue Screens of Death following installation of the MS05-018 security patch. More than a few Windows 2000 users got stung by Windows Automatic Update.

Imagine. You walk into your office one morning, and your computer has a blue screen. You re-start it, and blue screens again. And again. There’s nothing you can do but wipe out your hard drive and start all over again.

Now imagine how good you feel when you find out that the cause of the endless round of BSODs was Microsoft itself, compliments of a botched Windows Automatic Update.

Details on my Microsoft Patch Reliability Ratings page.

More DOC Dumpster Diving

The two Word documents just posted about Office 12 file formats – Microsoft Office Open XML Format: Preview for Developers. and Microsoft Office Open XML Formats: New File Formats for “Office 12” – contain hidden “meta” data that should’ve been scrubbed before the files were posted. If you want to look, better hurry and download the files before Microsoft changes them.

It’s the same problem I talked about last week – and one that I’ve been harping about for years.

Looking inside the first document reveals that fbruno and Joe Andreshak (who’s on the team) edited it. Lisa Koetz (lisak@wagged.com) sent it out for final review with an email message titled “READY for SIGNOFF – OfficeXMLFormatPR”. The computer Lisa used to send that message is branded with the number 3084176363. The document was stored internally as Technology ServicesO\\tkxtfsa01\wepr$\Press Materials\Postit\Doc\Office12FileFormatDevPreviewWP.doc.

The second document has hidden data similar to that in the first. Lisa sent this one out with an email message, too, with the Subject “READY for SIGNOFF – OfficeXMLFormatPR”, and the machine that sent it out is branded with the number 33000186. The file was stored internally as Technology ServicesI\\tkxtfsa01\wepr$\Press Materials\Postit\Doc\Office12NewFileFormatsWP.doc.

Somebody who edited both documents was probably using an older version of Word (!!!), as evidenced by the buggy, bogus styles called “Default Paragraph Font Para Char Char Char Char Char Char Char Char Char”. Guess it’s hard to convince everybody to upgrade to Office 2003, isn’t it, Steve?

If you want to see for yourself, download the DOCs, go into Word, click File | Open, under Files of Type choose “Recover Text From Any File” and open the doc. When you’re done spelunking, close the doc, then File | Open to open it normally, and click File | Properties | Custom to see the branding that Outlook so kindly imprints upon attached documents. (Open question: does Outlook brand Word docs that are shared using SharePoint? I suspect the answer is “no”. If that’s the case, then Wagged didn’t use SharePoint to, uh, share this file. Guess it’s hard to convince everybody to use SharePoint, too.)

I repeat, for the umpteenth-thousandth-time: Never post a Word document on the Web, or make it widely available, until it’s been cleansed with Microsoft’s “Remove Hidden Data Tool” or a more powerful product such as Payne Consulting’s Metadata Assistant..

UPDATE: In an earlier version of this news posting I mentioned Charles Maxson and his Web site, OfficeZealot. “Charles Maxson” and “OfficeZealot” appear buried inside the file. It looks like Microsoft borrowed a Visio slide from Charles for the first white paper – but I’m only guessing. Strange.

Get MS05-016 Patch Installed NOW!

Nick FitzGerald has posted a Bugtraq report describing a very strange email-based attack that can cause problems if you don’t have the MS05-016 patch installed.

Nick discovered an infected file attached to an email message. The file is called “agreement.txt ” – with a trailing space. The trailing space isn’t really a space, it just looks like one. If you double-click on the file to open it, the file reaches out to a pirate Web site in Russia, downloads a backdoor program, and turns your machine into a zombie.

If you don’t have the MS05-016 patch installed yet, better do so now. And, no, you can’t trust “.txt ” files.

New Office 12 File Formats – and a Glimmer of Hope!

Matt Hines at CNet reports that new Office 12 files (for Word, Excel and PowerPoint) will use XML as the default format. If Microsoft can live up to the claim, this could be one of the best changes in Office in many years.

The ‘Softies have long kept the internal structure of their doc, xls and ppt files a deep secret. The “Binary File Formats” were notoriously poorly documented and not well understood, even by people working on the development teams. If Microsoft is serious about moving to XML, it should be relatively easy to reverse-engineer the new docx, xlsx, and pptx file formats and get directly at data inside a file. The consequences are enormous. Not only will we have plain-text Word, Excel and PowerPoint documents, they’ll be compressed on the fly with standard ZIP technology. Good choices, right down the line.

My hat’s off to the folks at Microsoft who are working on this tough project, particularly after the lame implementation of XML in Office 2003 (and in Office XP before that). This one really could make a difference. Good luck!

UPDATE: Brian Jones, a key XML guy on the Word dev team, has started a blog with lots of worthwhile details. Good stuff, well worth reading.

Microsoft’s official Press Release featuring Steve Sinofsky is here.

White paper: Microsoft Office Open XML Format: Preview for Developers.

White paper: Microsoft Office Open XML Formats: New File Formats for “Office 12”. An interesting paper because of the commitments: “The new formats are fully documented with publicly available specifications. The XML specifications for the individual parts that make up the file are fully documented and publicly available.” Heady stuff, if Microsoft follows through. (Most of the “Scenarios” in that document can be readily implemented in Office XP, much less Office 2003, but what the heck.)

A BOTT-UPDATE: Ed Bott’s blog has a tremendous, skeptical take on the announcement. Quoth Jim Minatel, one of the savviest editors in the biz:

I’ve been burned so many times by the “this Office version is going to do XML right/better” mantra. In fact, I’m sure that back in 1998 when we started drafting proposals and outlines for “Special Edition Using Office 2000,” XML was one of the new features then that was going to turn Office on its head.

Will this XML implementation be better than the last three? Stranger things have happened.

More bugs in Internet Explorer

With Internet Explorer 7 going into beta test next month (and the announcement that IE 7 won’t work with Windows 2000), the last thing Microsoft needs is a diversion for the development group, to fix a bunch of old bugs in IE 6.

Guess what? German researcher Benjamin Franz has just posted descriptions of four bugs in IE. Three of them have been around for a long time, according to Franz.

The three old bugs crash IE when it encounters a specifically designed mal-formed Web page. Franz claims one bug was discovered on August 17, 2003, one on September 26, 2003, and one on September 11, 2003. He doesn’t mention if (or when) Microsoft was notified.

The fourth bug crashes IE, but only if you manually add certain kinds of URLs to the Restricted Zone.

Oh My!

Todd Bishop at the Seattle PI reports that the “My” prefix will disappear in Longhorn. “My Documents” becomes “Documents”, “My Pictures” -> “Pictures” and so on. Todd talked to Jim Allchin, who confirmed “My” is going bye-bye.

Interestingly, the Longhorn build 5048 screen shots on Paul Thurrott’s SuperSite show “My” all over the place. I guess MS made the final decision rather recently. Paul does talk about a new “virtual folder” called Documents, which will replace My Documents, but “My” still appears in the screen shots. Precisely how virtual folders will work remains to be seen, particularly without the new WinFS file system…

I just hope they work better than Search Folders in Outlook.