Newsletter Archives

• You’ll be amazed to learn how Microsoft really makes dough

  Posted on July 1, 2024 at 02:44 CDT by B. Livingston • Comment in the Forums

  PUBLIC DEFENDER

  

  By Brian Livingston

  If you think the sale of Windows software is Microsoft’s primary source of revenue, you’re in for a big surprise when you see the way the Redmond corporate giant actually earns money.

  As of the fiscal quarter ending March 31, 2024, more than 56% of the company’s revenue — easily a majority — is generated by Microsoft’s cloud services, including Azure Server, Office cloud services, and other online income streams.

  Read the full story in our Plus Newsletter (21.27.0, 2024-07-01).

  Public Defender Azure, Cloud computing, Financial Performance, Gaming, LinkedIn, Microsoft, Newsletters, Office, Windows

• Don’t patch while traveling

  Posted on June 17, 2024 at 02:41 CDT by Susan Bradley • Comment in the Forums

  PATCH WATCH

  

  By Susan Bradley

  Recently, a Plus member asked whether they should patch before leaving for vacation or could patch while on vacation.

  Then a coworker let me know about their own imminent multiweek vacation and wanted to know the same thing.

  Both requests reminded me of my stance on updating machines right before, during, or just after travel. Don’t.

  Read the full story in our Plus Newsletter (21.25.0, 2024-06-17).

  Patch Watch AuthLite, Azure, CVE-2024-30078, CVE-2024-30103, KB5002600, KB5039211, KB5039212, KB5039214, KB5039217, KB5039227, Master Patch List, Newsletters, NTLM, Patch Lady Posts, Travel

• Check your defenses

  Posted on March 28, 2022 at 02:44 CDT by Susan Bradley • Comment in the Forums

  ON SECURITY

  

  By Susan Bradley

  On March 21, the US president issued a warning about the possibility of Russian cyberattacks against American businesses, an outgrowth of the conflict with Ukraine.

  As part of the administration’s briefing on the topic, the White House issued a fact sheet, “Act Now to Protect Against Potential Cyberattacks.” The short document contains a list of recommendations, along with the exhortation: “We urge companies to execute the following steps with urgency.”

  Here are some of those recommendations.

  Read the full story in our Plus Newsletter (19.13.0, 2022-03-28).

  On Security Azure, Browser security, Microsoft Security, Newsletters, Patch Lady Posts, Threats, Windows Security

• Foley: This is how Microsoft’s Azure organization makes Windows

  Posted on December 12, 2019 at 12:32 CST by woody • Comment in the Forums

  Fascinating story from Mary Jo in ZDNet. She had an opportunity to interview Jason Zander, the EVP of Azure — in other words, the head honcho of the team that now makes the insides of Win10.

  “Security, reliability and performance are prioritized all across,” Zander said. “Then certain features are prioritized depending on new launches — like a new console launch.”

  Feature priorities are decided sometimes in a six-month or a year-long boundary, he said. The biggest take-away: “It’s not a tyranny of organizations anymore” when it comes to deciding on timing and feature sets.

  Given how high priority and all-encompassing Azure is for Microsoft these days, do Zander and his team still care much about Windows?

  “I get updates every other day with self-host builds,” Zander said. “We love Windows and will continue to love Windows.”

  If you wonder about the way Microsoft’s going to keep developing Windows, this is a must-read.

  Windows News Azure, Jason Zander, Win10 core

• Patch Lady – what gives?

  Posted on December 2, 2018 at 11:22 CST by Susan Bradley • Comment in the Forums

  There is something I don’t get.

  I do get that there is still a lot of people running Windows 7.

  I do get that there is a fair amount of discontent in the technology communities surrounding Microsoft.  I see many complain about the lack of quality in updates, in the inability to know exactly what Microsoft is tracking, in the inability to know for a fact whether or not your device will survive a feature update.  All of these are tied to what I’m going to call the traditional desktop model of Microsoft.

  And yet, Wall Street, which always has a hyper view of the future is saying that everything is rosy.  And yet, the future of Microsoft is still based on the code that we run in Windows 10.  Granted it’s a much more slimmed down, less bloated version of what we run, but it’s still prone to issues.  Case in point the Multi factor issues of the last few days.

  There were three independent root causes discovered. In addition, gaps in telemetry and monitoring for the MFA services delayed the identification and understanding of these root causes which caused an extended mitigation time. 
  The first two root causes were identified as issues on the MFA frontend server, both introduced in a roll-out of a code update that began in some datacenters (DCs) on Tuesday, 13 November 2018 and completed in all DCs by Friday, 16 November 2018. The issues were later determined to be activated once a certain traffic threshold was exceeded which occurred for the first time early Monday (UTC) in the Azure West Europe (EU) DCs. Morning peak traffic characteristics in the West EU DCs were the first to cross the threshold that triggered the bug. The third root cause was not introduced in this rollout and was found as part of the investigation into this event.

  Let me translate:  We installed a software update and it caused an issue.  We weren’t paying attention and it wasn’t until our customers were impacted that we realized we had a problem.

  Gentlemen… that’s what you promise when we move to the cloud.  That YOU are in charge of the updating and can fully monitor and ensure that nothing like this happens.  Yet you blew it.  With a piece of software/policy (multi factor authentication) that is a must have for anyone installing anything on cloud services.

  Then a few days later you blew it again:

  As described above, there were two stages to the outage, related but with separate root causes.

  • The first root cause was an operational error that caused an entry to expire in the DNS system used internally in the MFA service. This expiration occurred at 14:20 UTC, and in turn caused our MFA front-end servers to be unable to communicate with the MFA back-end.
  • Once the DNS outage was resolved at 14:40 UTC, the resultant traffic patterns that were built up from the aforementioned issue caused contention and exhaustion of a resource in the MFA back-end that took an extended time to identify and mitigate. This second root cause was a previously unknown bug in the same component as the MFA incident that occurred on 19 of Nov 2018. This bug would cause the servers to freeze as they were processing the backlogged traffic.

  Let me translate again:  Someone or something probably sent a wrong PowerShell command out causing the domain name system to fail which in turn caused the MFA system to fail.  Then you had a second software induced bug in the software that wasn’t properly diagnosed until your customers were impacted.

  To me these two events in close sequence indicate that for all that telemetry that is deemed to be so effective at allowing Microsoft to monitor, control and contain issues…. it really isn’t as good as it should be.  I’ve always said about telemetry that if it does what it’s supposed to… to allow our vendors to better understand how hard it is to maintain their software… bring it on.  Do more of it.  Disclose to me what you are looking at.  But stop using me as your beta tester and learn ahead of time not to blow me up.

  Authentication has to be rock solid.  Multi factor – even more so.  And communication regarding the impact could have been better.  I saw many saying that they had a hard time finding out information regarding this outage.  Bottom line, Microsoft blew it.  Showcasing that the investors may think things are wonderful, but for Microsoft, in technology, this week wasn’t so good.

  If you were impacted and want to provide feedback on how they should make communication better, take the survey.

  Other Azure, Patch Lady Posts

• Cloud is in, desktop is uh …. well?

  Posted on March 29, 2018 at 11:25 CDT by Susan Bradley • Comment in the Forums

  Susan here with a non patching post:  My Wall Street Journal tech alert just came in pointing to an email from Satya Nadella about a big shake up in the Windows organization that really showcases that Microsoft’s focus is the cloud.

  Terry Myerson (desktops/Windows 10) is transitioning out of the company and Scott Guthrie (developer focused and Azure) is moving to a role more focused on cloud and artificial intelligence called Core OS.  In the email Satya notes that Terry …”Over the past several years, Terry and the WDG team transformed Windows to create a secure, always up-to-date, modern OS. ”

  I just had a yin/yang discussion the other day with a good tech friend where I argued that what we have now with Windows 10 patching isn’t good enough.  From 1709 getting three updates/reboots in a single month, to updates coming out nearly any day of the week these days, to the January/February race condition of Windows 10, all of these should be a wake up call to Microsoft that Windows foundation needs work.  I opened up several support cases on behalf of impacted customers and short of a refresh or reinstall, once the operating system was nailed by the race condition which was [apparently] caused by the servicing stack update, those computers were toast.  Going forward with artificial intelligence, we have to have an operating system that can self heal.  Right now I still have several customers who are scared to install updates on Windows 10 for fear that they will have a recurrence of the Inaccessible boot device.  That’s not a good place to be in.  I fear that we’ve lost trust in patching, and the idea that we’re all up to date with our operating system, is still a dream, not reality, even on Windows 10.

  One comment is interesting in the email:  “Having a deep sense of customers’ unmet and unarticulated needs must drive our innovation.”

  When we still have enterprises dragging their feet on feature releases, still have issues even with LTSB updating, there’s a lot of things unmet.

  I think a focus still needs to be made on the platform and get that right before cloud is 100% Microsoft’s focus.

  If you had Mr. Nadella’s ear for a moment, what would you say is unmet?

  Windows News Azure