Breaking

Saturday, January 24, 2015

1/24/2015 02:12:00 PM

Western Digital, HGST top the list of most reliable hard drives

Hard drive failure data from cloud backup service Backblaze has Western Digital and Hitachi coming out on top.

Western Digital, HGST top the list of most reliable hard drives

Last year, cloud backup service Backblaze crunched statistics about which makes and models of the tens of thousands of drives humming away in its data centers held up best under stress. Hitachi and Western Digital came out at the top; Seagate, not so much.

Now Backblaze is back with another year's worth of stats, harvested from the consumer-level drives running in its custom-designed and open-sourced Storage Pod drive racks. The results, assembled from a data set more than twice as large as the previous year's, square with the earlier findings.

Hitachi (now HGST, a subsidiary of Western Digital) has the lowest failure rates across the makes and models surveyed. Western Digital itself came in second, with numbers only slightly less impressive than HGST's. "It’s hard to beat the current crop of 4TB drives from HGST and Seagate," Backblaze said in its blog post.
Hard drive failures by the manufacturer over the course of one year. HGST, a Western Digital subsidiary did best, but stats on WD's 6TB The driveline remains preliminary.
Seagate, on the other hand, is another story. Its drives didn't do well in the first roundup and this year sported failure rates as high as 43 percent annually. As with last year, its 4TB models were far more durable than its other offerings, failing at around half the rate of the previous year.

What constitutes a failure to Backblaze? Aside from obvious mechanical problems -- the drive won't spin up or be recognized by the OS -- Backblaze included any drives that would not sync properly with a RAID array or reported SMART statistics that were out of the acceptable range. This last criterion can be tricky; Backblaze itself notes that SMART stat reporting isn't consistent between many drives. That said, the company believes a handful of the most critical criteria, such as the uncorrectable error count or the count of reallocated sectors are reliable indicators of failure based on what it's seen in its drive pools.

The best results were with 4TB drives, which showed a marked decline in failure rates since the previous year's statistics -- both between HGST and Seagate. However, 3TB drive was less impressive, and Backblaze promised to dig into the story behind Seagate's striking failure rates there in a future post. Western Digital had no 4TB drives in the running, but Backblaze used 6TB drives from the company's line, the Western Digital Red. Its failure stats were less than 5 percent for the course of the year, but Backblaze cautioned it hasn't been using them for long enough to compute robust failure statistics.

Western Digital acquired Hitachi's hard drive business and turned it into HGST back in 2012; it was originally created in 2003 when IBM and Hitachi merged their hard disk manufacturing concerns. The HGST drives profiled in Backblaze's analysis were all Deskstar or Megascale models, the latter composed of 4TB drives designed for "low application workloads that operate within 180TB per year." Other drives in HGST's the lineup includes helium-filled 8TB and 10TB drives, with the helium providing greater capacity and lower power consumption, although Backblaze hasn't used those drives in its tests, preferring instead to stick with low-cost consumer drives purchased in bulk.

Backblaze has been using its data center as a source of eye-opening and sometimes hotly contested insights. Not long after its 2014 hard-drive reliability report, the company analyzed the effect of cooling on drive lifetimes. It found that keeping a drive cooler than its recommended operating temperature had no discernible effect on its longevity. Not everyone agreed with the conclusions, but few could find fault with Backblaze's underlying mission.

For those who want to crunch the numbers themselves, Backblaze plans to make available the raw data from the 2014 drive pool study in the next couple of weeks, along with more details on how it computed failure rates.

Read More News :- Techies | Update
1/24/2015 02:11:00 PM

Windows 10 January Technical Preview: Show me the bits

The dog-and-pony show is over, but a key question remains.

No matter how you slice it, Microsoft knows how to put on a great presentation. While I've been around the Microsoft block far too many times to believe things will turn out as neatly as presented, the grand scheme looks very inviting. And the holograms! Even if they aren't really holograms, imagine the kind of damage programmers could do with a hologram API in Windows.

ICYMI, the whole presentation is now available in nonstuttering video on the Microsoft website.
The main open question, to my mind, is the licensing can of worms teased by Terry Myerson and, after the presentation in the Q&A session, by Satya Nadella. "Windows as a service" may or may not be equivalent to "Windows for rent." Only time will tell -- Microsoft sure isn't. InfoWorld's Serdar Yegulalp hits the high points of how Windows upgrades will be free for existing users -- at first. Paul Thurrott has posed a fascinating, central question:
But consider this line: "Once a Windows device is upgraded to Windows 10, we will continue to keep it current for the supported lifetime of the device -- at no additional charge." This suggests to me that keeping Windows 10 up-to-date going forward is not optional. That in order to get this offer—or perhaps just to get Windows 10 as a consumer, regardless—will require you to let Microsoft keep your system up to date.
It kind of sends shivers down my Automatic Update chute.
Now that we've seen the future and marveled at the 84-inch 4K Perceptive Pixel -- er, Surface Hub display, another key question remains: What will be in the January Tech Preview? Sadly, at this point, we don't really know.

Brad Sams at Neowin has a series of screenshots on the Neowin site -- shot with a camera, somewhere in a bunker in Redmond -- that shows several aspects of Windows 10 Build 9924: The Cortana-enabled search bar, the weird pinned program layout on the new Start menu, the new version of Metro Start, the Notification pane, the Metro Control Panel -- er, PC Settings, the still-odd File Explorer now without a Home, floating Metro windows, even a tease for Aero Snap.

You have to ask why Microsoft isn't releasing the January Technical Preview at this point. I've heard two theories. One is that the scheduling didn't work out -- Microsoft had to schedule the rollout extravaganza several weeks ago, and somehow the bits weren't baked in time to hand them out.

The other theory is a bit darker. Perhaps Microsoft is milking the moment, to get double the tech press coverage, with two headline-worthy "announcements" back-to-back. That approach would be particularly effective if the new Tech Preview isn't so different from the old one.

It'll be interesting to see if Build 9924 becomes the January Technical Preview.

I'm struck by the odd, but consistent terminology that's flying around. In his presentation, Meyerson said the bits would become available "in the next week." Gabe Aul, the point guy for Windows 10 announcements, has also tweeted twice, "New PC build in next week. First Phone build in February." To me, that's a peculiar way to phrase something that should be pretty simple.

Forgive me, but until I can see the pixels dancing on my monitors, I'll remain skeptical about the new features.

Read More News :- Techies | Update
1/24/2015 02:04:00 PM

Azure Batch: A mash-up of PaaS and IaaS

As cloud services become more automated, the line between IaaS and PaaS continues.

Most cloud architectures focus on the IaaS aspect of cloud, using it as a replacement for infrastructure. It’s a logical first step that builds on tools and techniques you’re likely to find in your own data center. The move from on-premises to cloud can be handled with a simple physical-to-virtual transformation, then an upload, then a switchover.

Take Microsoft’s Azure Batch service, for example. What the tool does isn’t rocket science -- you can use it to create the virtual machines you need, load them with data, and aggregate and process the information they produce. But Batch also provides a PaaS framework to host and batch your code, handling the systems management tasks for you, ensuring that unwanted virtual machines are turned off when no longer needed.

The Azure Batch service creates and runs a pool of similar virtual machines running your software over your data. You don’t need to build, run, and administer the pool -- it’s all handled for you.

Read More News :-  Techies | Update
1/24/2015 02:03:00 PM

One container technology does not fit all enterprises

This application-portability technology is hot for good reason.

Container technology is the most recent trend in cloud computing. Last month, CoreOS announced Rocket, its new container. Rocket competes with the megahyped Docker, which is adding a container management service called Swarm. Don’t forget that Google, Amazon Web Services, and Microsoft have their own container strategies, as does pretty much every startup jumping onto this bandwagon.

Trouble arrives when you consider that enterprises don’t really understand what containers are or what containers do -- at least, not yet. The hype around containers does not necessarily translate into obvious use cases or into an understanding of their business value.
Certainly, containers can deliver value to enterprises around application portability, as well as offer architectural advantages.

The portability comes from the fact that the applications exist within an abstraction layer (the container), so it’s easier to move the application from platform to platform or cloud to cloud. The idea is that you build it once and run it anywhere.

If you think you’ve heard that pitch before, you’re right. Pretty much every push for application portability, including frameworks and distributed objects, made the same “write once, run anywhere” claim. The good news is that containers can deliver on that claim.

There's an architectural advantage, too. Containers provide mechanisms to hold portions of the applications inside, then distribute them across private or public clouds, from the same vendor or from different vendors. Thus, the application components can reside on the platforms that best fit what they do.

Within the enterprise, you should ask, "What will containers do specifically for my enterprise?" In some instances, containers will provide a great deal of value. Others will get moderate value. Some will be no value. Find out what you're likely to get before you jump in.

Read More News :- Techies | Update
1/24/2015 02:02:00 PM

How has Time Warner failed users? Let us count the ways

On the heels of Net neutrality and municipal broadband, a new complaint against Time Warner.

Tired of skyrocketing cable bills, bait-and-switch billing tactics, terrible customer service, and not receiving the Internet speeds promised? Well, this could be the year that telecoms get their comeuppance, as the backlash against the industry continues to grow.

A new complaint filed against Time Warner calls on the FCC to halt the company's proposed $45 billion merger with Comcast and launch an investigation into its business practices. Coming on the heels of recent calls by the agency in support of increased broadband competition and strong Net neutrality regulation, the FCC may yet surprise when it comes to a decision on a deal that would merge the country's two largest cable companies.

In a move to keep pressure on the FCC during its review of the Comcast-Time Warner deal, the complaint from telecom analyst Bruce Kushnick and Tom Allibone of telecom customer advocacy group Teletruth, points out that Comcast and TWC are two of the most hated companies in the United States, according to the American Customer Satisfaction Index. It calls on the FCC to investigate, among other issues:
  • Questionable business practices and charges, including billing errors and made-up fees
  • The "Social Contract," whereby the FCC in 1995 allowed "temporary" rate increases of up to $5 per month to enable the cable companies to upgrade their networks and provide broadband to schools; the contract expired in 2000 but Time Warner never stopped charging customers the extra fee -- nor is there evidence it wired the schools
  • Twenty two years of continuous rate increases (prices for cable service rose 306 percent from 1992 to November 2014), as evidence of a duopoly that is ineffective for controlling prices
Time Warner claims the allegations are without merit while declining to answer them specifically, but the complaints are hardly new. In fact, in the last five years more than 16,000 formal complaints have been filed with the FCC against Comcast and Time Warner, alleging deceptive advertising and billing, bad customer service, and poor cable or Internet service.

FCC chairman Tom Wheeler has said that "meaningful competition for high-speed wired broadband is lacking and Americans need more competitive choices for faster and better Internet connections, both to take advantage of today's new services, and to incentivize the development of tomorrow's innovations."

If Comcast swallows Time Warner, it would become the dominant broadband provider in 19 of the top 20 residential markets in the United States. It's hard to imagine the FCC deciding the merger is in the public interest, especially given Wheeler's comments. But the FCC need not reject the merger outright; it could opt to impose conditions that would make completing the deal unpalatable for Comcast, such as forcing it to offer services in unprofitable, underserved rural markets.

If the FCC succeeds in reclassifying broadband as a Title II public utility and bans fast lanes on the Internet -- costing telecom giants potential profits -- Comcast could withdraw its offer, arguing the Net neutrality plan was a "material adverse change" that allows it to back out of its deal with Time Warner.

The FCC has stopped and restarted its informal 180-day time clock many times during its review of the planned merger -- most recently late last month after Time Warner lawyers belatedly turned over tens of thousands of additional documents relating to the deal. But regulators suggest a decision could come as early as March. The agency is expected to vote next month on Net neutrality rules and a proposal to invalidate state laws banning municipal broadband.

Amid these actions comes another sign that telecoms are feeling the heat: Republicans in the newly seated Congress moved quickly this week to defang the FCC. Proposed Internet legislation would prohibit the agency from reclassifying broadband as a Title II utility and stop the FCC from creating any new Net neutrality rules.

In response, supporters of grassroots organization BattleFortheNet.com bombarded the Hill with more than 16,000 phone calls during House and Senate committee hearings, demanding that Congress allow the FCC to use its authority to enforce Title II regulation on telecoms. Last year the FCC received a record 3.7 million public comments overwhelmingly in favor of Net neutrality.

Net neutrality, municipal broadband, and the Comcast-Time Warner merger: Together, these three decisions could spell the start of a perfect storm ahead for telecoms.

Read More  News :-  Techies | Update

Thursday, January 22, 2015

1/22/2015 02:19:00 PM

WhatSim Lets You Use WhatsApp for Free While Roaming Worldwide

WhatSim Lets You Use WhatsApp for Free While Roaming Worldwide

WhatsApp is one of the most popular instant messaging services worldwide, with the company recently announcing 700 million monthly active users. Now, in an attempt to woo the large WhatsApp user base, an Italian company has launched WhatSim, a WhatsApp-only SIM that comes with a plan that will let you use the popular messaging app for free while travelling across about 150 countries.

(Also see: WhatsApp Now Available via Your Desktop Browser)

Manuel Zanella Rngineer, Founder and CEO of Zeromobile, the company behind WhatSim, says, "WhatsApp is the future of mobile communications. Its only "limit" is the data connection especially when you are traveling because the roaming charges are expensive and you can't always find Wi-Fi everywhere and it is not always free. As someone who appreciates and uses WhatsApp, I tried to figure out how to get around this problem. That's why WhatSim is an extraordinary opportunity for WhatsApp."

whatsim_press_image.jpgFor EUR 10 (approximately Rs. 714), users will get a SIM card (standard worldwide shipping is EUR 5 - Rs. 350 approximately) unlimited text messaging for a year. While sending and receiving text messages, location updates, and contacts via WhatsApp is free, users will have to buy credits for sharing multimedia messages such as photos, videos, and voice messages. How much you get for your credits depends on where you are travelling.

Zanella further explains, The solution we have developed is simple and intuitive. With €5 you get 1000 credits that you can use, for instance, to exchange 50 photos or 10 videos in many countries around the world. There are no limits to sharing your position and contacts. This way we guarantee the utmost transparency. Buying a recharge is quick and easy: just go to our website even from your smartphone and soon even from a dedicated app."

WhatSim is available to buy via the WhatSim website, with the company also planning to make it available via "network of local distributors in over 100 countries."

Of course this is not the first time someone's offering a SIM with unlimited WhatsApp usage, though earlier attempts have been limited to a specific country. Last year, WhatsApp, in partnership with E-Plus, a mobile telecommunications operator in Germany, started selling prepaid SIMs that offered unlimited WhatsApp usage.

Read More News :- Techies | Update

Wednesday, January 21, 2015

1/21/2015 07:44:00 PM

Tech pros ride hot hiring streak into new year

Layoffs increase in last quarter but job seekers are still in a position of power, Dice.com says?

Tech professionals continue to have rosy prospects in the job market.
Unemployment in the U.S. technology sector for late-2014 reached the lowest level recorded since 2008, jobs site Dice.com is reporting this week. Using data from the U.S. Bureau of Labor Statistics, Dice.com noted the average unemployment rate of 2.5 percent for technology professionals was slightly less than the third quarter's 2.7 percent rate. For the entire year, the average rate of 2.7 percent was a "significant decline" from the 3.6 percent average rate in 2013.

Layoffs, though, increased for the first two months of the fourth quarter, based on preliminary data. There were 464,000 layoffs, a dramatic increase from the 340,000 discharges in October and November of 2013. "How layoffs play out in 2015 is yet to be seen, but only 10 percent in the Dice hiring survey say layoffs are likely," Dice.com said.

Indeed, jobless rates dropped for a long list of technology professionals last year. Dice.com's list includes Web developers, computer systems analysts, computer support professionals programmers, network and systems integrators, software developers, computer and information systems managers, data administrators and network architects. "It proved to be a particularly good year for programmers, computer and information systems managers, and computer support specialists, whose unemployment rates were nearly cut in half from 2013," Dice.com said.

"2014 signaled a strong year for tech professionals, and demand for qualified tech candidates remains high," said Shravan Goli, Dice.com president, in the report. "Recruiters continue to be eager to land top tech talent, and candidates hold all of the cards, driving up counteroffers and taking the lead in the negotiation process."

In technology consulting, 26,500 jobs were added in the fourth quarter while 72,300 jobs were added for the year. But data processing, hosting, and related services saw 700 jobs lost last quarter, although there was an annual gain of 5,300 positions. The bureau also said 473,500 persons on average in the professional and business services category quit their positions in the first two months of the fourth quarter in 2014, a slight downturn from the 487,500 professionals who chose to leave their positions this same time last year but above the 10-year average of 415,000 professionals.

"While voluntary departures dipped slightly in the first two months of the fourth quarter, other measures show candidates are still confident in their prospects," Dice.com said. "In Dice's latest hiring survey, 64 percent of hiring managers said they are seeing candidates ask for more money than they were six months ago, while 29 percent said they are seeing more candidates reject offers."

Dice.com recently reported that Java developers continue to be in great demand. Security professionals and those with Microsoft .Net skills also are being sought.

Read More News :-  Techies | Update
1/21/2015 07:42:00 PM

9 features you'll likely see at this week's Windows 10 extravaganza

Everything you really need to know before the live stream starts at Wednesday's Windows 10 consumer launch.

If you weren't invited to Microsoft's "Windows 10: The next chapter" Lollapalooza in Redmond on Wednesday, have no fear. You can use this marvelous contraption called a "computer" to see what's happening, and you don't need to make the cold, wet trek to Seattle. Think of it as carbon footprint karma.

Here's what you need to know -- with a few insider tips on what may come as a surprise -- to get ready for the fateful day. Put on your fuzzy house shoes, check your Internet connection, crank up the volume, pop a bowl of jalapeno corn, and don't forget the designer brew. The consumer version of Windows 10 -- or at least the January Technical Preview -- is about to make an appearance.

First, the personalities. It will be a stellar assembly: CEO Satya Nadella, Windows honcho Terry Myerson, tech uber-geek Joe Belfiore, and Xbox head Phil "gaming first" Spencer will all appear on stage. With that kind of depth in cloud (Nadella), phone (Myerson, Belfiore), UI (Belfiore), and gaming consoles (Spencer), it's a safe bet that "The next chapter" in Windows 10 will go far beyond Windows 8. The question is how -- and how far.

Early last month, ZDNet's Mary Jo Foley predicted that this would be the "consumer preview" of Windows. It's still unclear if this, the January Technical Preview, amounts to a "consumer preview," or if it's just the next beta release of the software that will become Windows 10 -- for consumers, for enterprises, for wondering Windophiles. I don't think we'll see anything formally tagged as "consumer" until the very end of the testing process -- at which point I expect the consumer version of Win10 will be the same as the Enterprise version, minus a couple of features.

The folks at Studio384.be have been accumulating a list of features that are all-but-sure to be included in the January Technical Preview:

1. Continuum -- The big Achilles heel in the refrigerator-and-toaster world of detachable keyboard Windows is how to switch from mouse-centric to touch-centric and back again. Eighteen months ago, in his Windows Red proposal, InfoWorld's Galen Gruman tackled the problem by suggesting a Windows Red Duo version that could easily dual-boot between the mousey desktop and the tappy Metro Start screen. By all accounts, Microsoft has taken that approach, but eliminated the re-boot, likely just re-starting Explorer. It's called Continuum.

Belfiore gave a quick "design motion study" (actually, he ran a canned video) of Continuum in the Windows 10 Tech Preview announcement last Sept. 30. You can see it starting at 31:00 in the YouTube video of the presentation. Expect another demo on Wednesday. If we're lucky we'll see a real live demo, and will be able to judge how quickly the re-boot (er, re-start) happens on a stroked and bored i7 megamachine.

2. Cortana -- Windows Phone 8.1 users (all 10 of you) have been playing with voice assistant Cortana for nearly a year. Belfiore demoed Cortana in his Windows Phone 8.1 video last April, starting at 1:40. The debate rages over whether Apple's Siri, Google's Now, or Microsoft's Cortana is "best," but they're all quite capable, and all point to a voice-first future. Cortana's going to figure prominently in the new Windows 10 desktop and the new Windows browser -- and may well come baked in other places. (Do you know the Cortana backstory?)

3. New UI elements -- It wouldn't be a new Windows release without UI changes. We've seen a lot of details, which I describe in my posts on builds 9860, 9879, and 9901. New Start menu, resizable desktop windows running Metro apps, different kinds of Snaps, multiple desktops, re-oriented Charms bar (which may disappear completely), Task View, and so on. There's even a small chance that Microsoft will bow to the unwashed and uncouth masses, like me, and bring back Aero.

4. Little stuff -- FLAC and MKV support (actually, MKV -- best known for pirate videos -- is already supported in Windows 8.1). We've already seen the improved DOS command box, re-working of the two competing Settings apps, new Calculator, mods to Photos, and Store and Maps. Battery saver. Storage sense. The Lumia camera beta will probably arrive as its own app. Xbox will become a downloadable app in the Store.

OneDrive, as we know it in Windows 8, is dead. There's no way Microsoft will bring it back in the shipping version of Windows 10. Get over it.

All of those changes have already been signaled, some telepathically, from Mt. Microsoft. That leaves a whole lot of anticipation, and not much that's known for sure. Here's what I'll be looking for:

5. Windows everywhere -- It's likely that there will be major announcements about Windows Mobile, the unnatural offspring of Windows Phone and Windows RT. Old name, new incarnation. How does Windows Mobile fit into the mix? Intel only? If so, what happens to ARM devices? Will Windows Mobile apps run on the old Surface and Surface 2? If not, can we get a refund?

And what about the Xbox -- will it be able to stream games onto Win10 machines? Any chance there'll be a WinRT emulator on the Xbox? Will Windows 10 itself run on the Xbox? If so, who would buy such a thing? Many questions, and I hope we hear a few answers.

6. Mods to the Metro side -- There have been precious few leaks about the new Metro Start screen (assuming there is one), or how WinRT-based Metro apps will work in Windows 10. We know that Metro apps will run inside floating windows on the desktop, but beyond that we'll be entering new territory.

7. Unified Windows Store -- We know that's a goal, the big question is how it will work. Yeah, no doubt we'll see plain old Windows apps in the store, reminiscent of the long-dead Windows Marketplace. Will there be Metro apps for Intel processors, separate from apps for ARM? How close will Microsoft get to the ideal, where Intel-based Metro apps can run with few if any changes on the desktop? Any chance ARM apps can do the same? Now that would be a trick.

8. Spartan -- The new Microsoft browser may not ship in the January Technical Preview, but you can bet it'll make an appearance sooner or later. Changes you'll see in IE will be minimal; after all, IE's headed to the formaldehyde jar, to be pressed into backward compatibility duty only when necessary.

9. And if Microsoft doesn't announce a touch-first version of Office, there will be rioting in the streets.
I think it unlikely that we'll see any interesting hardware. Microsoft may cart out other manufacturers' flagship products, but Surface and Lumia aren't likely candidates for announcements this week. My guess is that the Surface line is in for a major re-think, and Microsoft will announce a new flagship phone at some point. The time is not now. Heck, it wouldn't surprise me too much if Microsoft sold off Lumia, but that's another story. There'e one born every minute.

I'll also be watching intently for any hints about packaging, pricing, SKUs, or -- especially -- free upgrades. Don't forget that Myerson promised, near the end of his Build 2014 presentation, that the new Start menu features will be "available to all Windows 8.1 users as an update."
I'll also keep my ear to the ground for any hint that Microsoft is backing off its revised "early fall" RTM schedule.

In spite of what some have said, I'm not expecting to see the January Tech Preview bits on Wednesday. My guess is that they'll hit on Thursday. According to Win10 spokesman Gabe Aul, the new version -- whenever it's released -- will be available through Windows Update, or as a separate ISO download.

If you have an extra Windows 7 or 8 machine that you'd like to toss under the beta bit bus… er, upgrade to Windows 10 January Technical Preview, Microsoft has full instructions. Best to get started now.
You can watch the live stream starting at noon Eastern time on Wednesday. Assuming Microsoft can get the stream to stay up.

Read More News :- Techies | Update
1/21/2015 07:38:00 PM

Data spot check: Oh no, could it all be wrong?

A techie stumbles upon the perfect storm of a cranky system and dubious data.

When an unstoppable force (faulty software) meets an immovable object (user error), what happens? Tough to say, but you definitely want to take a second look at your sales reports.

When I first started in IT 20-plus years ago, a lot of our programs were developed in-house and we, the developers, were responsible for our own programs and maintaining data integrity. In my observation, over the last decade competition has increased in the business software side where market forces have turned the emphasis onto price control of the package. As a result, many vendors have decreased if not eliminated their QC departments in an effort to drop development costs.

Then there's another problem: the users. You'd think it would be important to a business to ensure the data on which they base their decisions and initiatives would be correct. But doing so takes resources and often gets pushed lower on the priority list.

Wading through the data

I recently saw what can happen with lack of oversight from both software vendors and users. My job at the company was IT manager, and one of my duties was to run reports for the execs. In the past, I'd noticed discrepancies in the data entered by our company's sales reps and had made recommendations for putting software governance in place for creating new customer IDs.

However, management frowned about anyone dealing with the sales team and said they didn't see any reason to make changes. But the problems with this philosophy came to light once again as I worked to produce a report for end-of-year sales from our main accounting package.

We'd been running the package for years with many modifications made by the vendor's development team during that time. When we first installed the package, we ran it parallel for several months simply to verify the transactions and data. I'd tried to keep an eye on it ever since, but as the demand for more IT services ballooned along with manpower reduction it became next to impossible to keep doing so. Meanwhile, management wouldn't buy into hiring more worker bees.

I was assembling the data from our four major locations to show sales trends for the prior three years. Our package displayed only one year at a time, and the COO wanted to see all three years on one page ranked by top sales for the most recent year.

The data had to be scrubbed as some locations had used multiple IDs for the same customer. The sales team apparently would choose whichever number struck their fancy that day to enter a sale. My mind whirred as I thought someone should have noticed this; then again, I'd often been amazed at the accounting department's lack of data integrity enforcement. I made note to once again bring it to management's attention.

Once I had the data plugged into my structure, I produced a report that I hoped would meet the COO's demands. Before passing it along, I perused it to see if I could visually spot any anomalies. As I scanned down the page I saw a customer that had $0.00 purchases three years prior, $350,345 purchases two years prior, then $0.00 in the last year.

Run a report and check it twice

Thinking it odd, I checked the numbers I'd been given, and it reflected the data in my report. I fired up the accounting software and went to the customer maintenance module where I could view one customer at a time and eight years of sales history. The numbers for the last two years matched the numbers in the report I'd run. But the ones from three years prior was drastically different: Instead of $0.00, this history showed $256,312.

My heart was in my throat. How could this be? I reran the reports that I had been given, and they again matched my report. I could not see the coded back end of the form that delivered the additional sales onto the maintenance form, but because of my experience in development I was pretty sure of what was happening.

I made a quick call to the vendor's tech line, and they flushed the buffers correcting the form. Now everything matched for the report I was creating. But I wondered if I could trust the numbers. Were they really correct? How many unseen buffers or fields had not been flushed in other situations? What other errors lurked beneath the surface, undetected?

We can't do the volume of transactions without software, and we have to trust to some degree. Hopefully, the errors that are missed remain minor.

Read More News :- Techies | Update
1/21/2015 07:35:00 PM

7 questions to ask any open source project

Do you truly have permission granted in advance to benefit from and innovate upon an open source project?

Whether you're starting an open source project or deciding whether to participate in one, you don't want to waste time in an endeavor that imposes arbitrary restrictions that will stop you in your tracks down the line. 
The Open Source Initiative, of which I am president, has successfully focused on copyright licensing as a concrete expression of software freedom. OSI does not only provide guidance in the form of the Open Source Definition; it also manages a process by which the copyright licenses used for outbound licensing by open source authors can gain OSI approval.

Here’s a model I use in my consulting engagements to help clients work through their proposals for new open source community activities. Evaluating a project's licensing, patent, and community management strategy should begin with the question: How confident are community members that they have permission in advance to do what they need to succeed? See below for examples.

1. Am I granted copyright permission?

 An OSI-approved license guarantees this; does it apply to all your code? If there are portions of your code that remain proprietary, a community is not truly free to form around the code. Developers wanting to enhance or even deploy that portion of the code do not have permission in advance, so probably won’t want to join you.

2. Am I free to use my chosen business model?

Copyleft licenses may limit certain business models, but issues arising from them aren’t usually directly to do with their copyleft terms. Communities use the GPL very effectively where the playing field is level -- the Linux kernel and the GNOME community both come to mind. More problematic is the use of strong copyleft license like the AGPL in conditions where the “project owner” is not subject to the terms of the license for trading. In these circumstances, one community member is free to engage in proprietary strategies while everyone else can only offer support or add-on businesses because any platform value-add would have to be donated to the business of that one community member.

3. Am I unlikely to suffer patent attack?

It can never be prevented, but patent grants like the ones in modern open source licenses -- plus corporate pledges and nonaggression alliances like OIN -- can all help. Communities with no patent grants to protect people can feel like the Wild West, with the concern anyone could show up with weapons any time you’re successful.

4. Am I free to compete with other community members?

Community rules that prohibit -- explicitly or tacitly -- competition with the sponsor reduce freedom. That includes any attempt at field-of-use restrictions -- which are banned in OSI-approved licenses but still show up in governance rules -- such as “not for mobile use” or “can’t be used for military purposes.”

5. Am I free to contribute my improvements?

Copyright assignments get in the way, as does any mandatory agreement that will require legal review. I contribute back to reduce my maintenance and refactoring burden so that it’s not only philanthropy. It’s reasonable for a community to expect me to demonstrate competence before giving me commit rights, asking me to channel my work through others initially. It’s much less reasonable to insist I have to assign ownership of my work to a “project owner.” That chills participation, both by forcing me to effectively pay to participate and by forcing me to get legal advice first.

6. Am I treated as a development peer?

Changes that are conducted in private, then “thrown over the wall” to the community rob potential collaborators of the confidence they have space to innovate. Why would you invest in significant new work, only to find the “project owner” rendering all your work moot with a bolt-from-the-blue code update? When the only way to be sure you’ve permission to innovate is to enter into a bilateral agreement with one company, you’re being treated as a client or partner and not as a community peer.

7. Am I inclusive of all people and skills? How do you license your documentation? Can I contribute to it? What about your user support community? Can I join in both to get and to give help? Do you have policies to discourage harassment of people who don’t seem to fit into your community norms? If people need to ask for any of those, that’s a lack of permission in advance as well.

Using the lens of “permission in advance” turns out to be an easy and useful tool for diagnosing your community governance. The seven points here aren’t the only concerns; which do you use for your own purposes? I would be interested to hear what tests others apply to community and project governance to determine whether there is truly freedom to collaborate.

Read More News :- Techies | Update
1/21/2015 07:31:00 PM

8 OpenStack solutions that claim to be fuss-free

Turnkey OpenStack solutions have their own spins on maintenance.

With OpenStack finally making the inroads its proponents have hoped for, the next big questions are where and how to run it, as well as how to keep it fresh.

Several companies have ready answers via turnkey OpenStack solutions: hosted installations in the public cloud, on-premises managed appliances, and mix-and-match solutions that aim to cover most every scenario in between.

Some of the biggest players are OpenStack vendors plying their trade as a service. Others are existing cloud providers offering OpenStack as one of many technologies in their portfolio. Of particular interest is how each handles the business of rolling out upgrades to the OpenStack stack, as OpenStack's components are revised every six months. Here's a look at the heavyweights.

Mirantis OpenStack Express

Mirantis OpenStack Express deserves upfront mention for two reasons. First, Mirantis offers one of the most prominent and easily deployed OpenStack distributions. Second, OpenStack Express is a novel concept: a bare-metal-hosted OpenStack-as-a-service solution, with the bare metal provided by IBM/Softlayer. Among the selling points: No noisy neighbors, thanks to dedicated hosts; straightforward pricing; new editions of the deployed code are kept close to trunk, but tested for stability and reliability; and the user gets direct control over the physical layer as well as OpenStack itself.

Rackspace

It makes sense that one of the original driving forces behind OpenStack would have its own OpenStack turnkey offerings. Rackspace Private Cloud can be used either on its own or in conjunction with Fanatical Support, where Rackspace's team can stand up an OpenStack instance either on its own metal or in a client's data center. Rackspace also makes a point of its OpenStack private cloud leveraging LXC "to independently scale each OpenStack service and enable seamless, in-place upgrades."

Piston Cloud

Piston's approach to turnkey OpenStack is to provide not just an OpenStack distribution, but also a bottom-up stack -- Piston CloudOS plus Piston OpenStack -- that includes a hardened Linux distribution as a substrate. Among the ease-of-use features professed by Piston is an update service designed to minimize downtime via rolling upgrades and "options for updates to air-gapped installations," for those running a truly private cloud.

Platform9

A relatively new entry to the field is Platform9 Managed OpenStack, a turnkey solution for private clouds, recently released to the public after a six-month beta test period. Platform9's vaunted features include importing existing ("brown field") environments, no need for OpenStack experience to get started, monitoring and service-level agreements, and having "seamless, nondisruptive updates" pushed out, including once-a-year upgrades to stable versions of OpenStack. (Note: OpenStack is updated twice a year, but not everyone is in the habit of automatically going to the latest edition.)

Nebula One/Cosmos

Few items are more turnkey (albeit more expensive) than a packaged hardware solution for a given software product. Nebula One is a hardware appliance cluster, a central controller plus up to 20 cluster nodes in a given rack, running Nebula's Cosmos edition of OpenStack. Built by former NASA employees who collaborated with Rackspace on the original iterations of OpenStack, it emphasizes not only turnkey deployment, but turnkey management and monitoring as well via an enterprise leveraging its existing monitoring tools. Upgrades, too, are automated.

The overall focus here is less on OpenStack itself and more on its enterprise use: running scale-out workloads well, ramping up or down to meet need, and having it all available in a self-service fashion if needed.

Ubuntu BootStack

Like OpenStack Express, Ubuntu BootStack is a hosted-on-bare-metal version of OpenStack. Customers can build their own OpenStack clouds on hosted hardware, have Canonical's team tend to the resulting stack (including OS and OpenStack upgrades) with an SLA to match, and even take back full control of their cloud once the prospect of running OpenStack doesn't intimidate you. Various local and remote cloud hardware options are supported, and upgrades to the latest OpenStack editions are part of the deal. Downsides: The costs aren't as transparent as Mirantis' offering, and a three-month commitment is required to get up and running.

Metacloud

A recent Cisco acquisition, Metacloud effectively eclipses Cisco's own OpenStack distribution. Metacloud's engineers perform the setup, provisioning, monitoring, and updating, letting the enterprise concentrate on application development. The resulting OpenStack installation uses an enterprise's existing single-sign-on infrastructure to allow users to provision their own resources, and both OpenStack and AWS APIs can be used for the core services. Unfortunately, as one might imagine for a service this bespoke, pricing is available only on request.

HP Helion

Another big name that's dipped into the OpenStack pond, HP has built a hybrid cloud offering, Helion, on top of its own OpenStack distribution. Both private and public clouds can be built with Helion, with the public cloud offerings hewing closer to Amazon's service and pricing model than anything OpenStack. But rather than offer a single turnkey solution, HP has several managed and consulting services that reflect its existing status as a business solutions provider. Among them: self-service high-performance computing based on OpenStack, a turnkey hybrid cloud system, professional services for OpenStack, and so on.

One possible downside of such a panoply is figuring out what HP offering is the best fit, but HP's Helion OpenStack distribution is always a safe fallback. That distribution was upgraded to the Juno build of OpenStack around the same time Juno itself was released, so it's likely HP's own managed offerings will follow the same closely tracking path.

Aside from economics (including the economics of IT staffing) or manageability, Nebula CEO Gordon Stitt cited another reason why turnkey and managed OpenStack solutions are useful in both on-prem and remote deployments: "The reason to have a hosted OpenStack alternative," he wrote in an email, "is so that enterprises can build a truly seamless hybrid cloud using the same technology on-premise due to security or regulatory requirements and data residency requirements. The residency requirements -- that data never leaves the enterprise -- may be regulatory or may be due to the cost and/or latency of transferring data in and out of a public cloud."

Read More News :- Techies | Update
1/21/2015 07:27:00 PM

The 3 most compelling updates in Windows Server 10

For the data center, expect useful improvements in Hyper-V, storage management, and PowerShell.

The big focus at Microsoft's latest Windows 10 marketing event today is on the client OS. But don't forget the next iteration of Windows Server -- Windows Server 10, to be exact.

The server version of Windows 10 is more important than you might think to Microsoft's 2015 comeback effort. Despite some bleeding-edge capabilities, Microsoft's cloud offerings like Azure and Office 365 haven't convinced many enterprises to make the full switch to the cloud. Now that IT budgets are a bit freer, they are looking at Windows Server and server-side applications.

Windows Server 10 has three sets of enhancements that may convince you to open your purse strings.
The first set of key enhancements relate to Hyper-V:
  • VMCX/VMRS configuration format. This new binary configuration format (VMCX) is designed to improve read/write efficiency and reduce data-corruption potential in the event of a storage failure. (The .vmcx extension is for VM configuration data and the .vmrs file extension is for runtime state data.)
  • Rolling Hyper-V cluster upgrade. When working with a cluster using Windows Server 2012 R2, you can add Windows Server 10 nodes; the cluster will continue to function until all nodes have been upgraded. Next, you upgrade the cluster functional level using the Update-ClusterFunctionalLevel cmdlet. Then you can enable new Hyper-V features.
  • Production checkpoints. We'e had snapshots in earlier Hyper-V versions, but they came with limitations and warnings about using them in a production environment. In Windows Server 10, production checkpoints address some of the previous snapshot limitations: The Volume Snapshot Service (VSS) is used in the VM and flushes the files system buffers in a Linux VM to create the new checkpoint. I'm very interested in playing with production checkpoints for recovery of applications like Exchange.
The second set of key improvements relate to storage:
  • Storage quality of service. This feature improves upon the storage QoS that Windows Server 2012 R2 provided. In Windows Server 10, you can define policies on a scale-out file server and assign them one or more virtual disks on Hyper-V systems. This lets you centrally monitor and manage storage performance because you can configure the policies to ensure fair use of the storage resources.
  • Storage replica. This feature enables what Microsoft calls "storage-agnostic, block-level, synchronous replication between servers for disaster recovery, as well as stretching of a failover cluster for high availability." With this technology, Microsoft is trying to steer enterprises away from using expensive SAN products and instead use Microsoft servers with cheap JBOD (just a bunch of disks) array storage enclosures. The storage replica capability allows data replication both in a data center and to remote data centers. 
The third key area of Windows 10 Server enhancements involved PowerShell 5.0:
  • New NetworkSwitch module. This module's cmdlets let you apply switch, virtual LAN, and basic Layer 2 network switch port configuration to certified network switches.
  • New PowerShellGet module. This module install, publishes, and updates modules using the PowerShell Gallery. The PowerShell Gallery is the central repository for PowerShell content. You can find new Windows PowerShell commands or desired state configuration (DSC) resources in the gallery.
  • New OneGet module. Now a formal part of Windows Server 10, this module lets you discover and install software packages from the Internet. You may already know it from CodePlex, Microsoft's open source library. It lets software discovery, installation, and inventory work through common cmdlets.
Overall, Windows Server 10 is a foundational piece to on-premises network environments that is receiving enhancements in all the right places, with features that may have massive rippling effects on the VMware market and the SAN market. With all eyes on Windows 10 for PCs and mobile devices, don't miss what's coming on the server side.

Read More News :-  Techies | Update

Tuesday, January 20, 2015

1/20/2015 09:01:00 PM

The best computer security advice you'll get

The world is awash in bad security advice that distracts from addressing the real threats.

I couldn't put my finger on what was nagging at me the last few months. When I finally sorted it out, it was the realization that most computer security advice is an absolute waste of time -- and most of what isn't is barely useful.

Even I'm guilty. Statements I've spouted in the past, like using long and complex passwords or hardening your computer system, don't really deliver much value. Disable weak password hashes? That was good advice 15 years ago. Use an up-to-date antivirus program? If that worked, we would have solved the problem decades ago.

When I look at the data of how people and computers are compromised, those previous recommendations didn't effectively address the attack vectors that make malicious hackers so successful. Instead of giving you dozens to hundreds of truly ineffective recommendations, I'm going to give you a few basic defenses that really work.

Forget every past computer security advice you've ever read -- even from me. This is the real deal. Everything else is wasted cycles.

Patch the most popular software first

Bank robbers rob banks because that's where the money is. Malicious hackers and malware concentrate on exploiting the most popular programs because those are the ones most likely to be on the computers they want to compromise.

If you look at how most computers are compromised, it's through unpatched software. Usually, the exploited unpatched software is the popular software used by everyone. Today, client-side, Oracle Java leads the pack, followed by Adobe Flash and Acrobat Reader. Server-side it's unpatched admin or remote access tools. The most popular programs change over time. What doesn't change is that those programs are the ones most often exploited.

You're going to get far more bang for your buck by patching the most commonly exploited programs and doing that perfectly than patching almost all of your programs with less rigor (which is the case in most organizations). If you can't patch or mitigate the most exploited programs, the rest of your efforts aren't worth much.

Don't get socially engineered

Social engineering is a fancy name for a con, accomplished over the phone, via email, or on the Web, where the con artist manages to extract some vital piece of information or convince the victim to install malware. The only way to guard against social engineering is to keep your user training up to date to combat the most prevalent threats, which most companies fail to do.

Test your employees, and if you can successfully socially engineer them, do a better job at education. If you have an excellent user education program and employees still fail the test, redouble your efforts.

Make sure your user education material tells people they're more likely to be exploited by trusted websites than strange or new websites. Tell users not to be tricked into installing new programs. Let them know that popular, free software, is often full of unwanted programs and malware (you can't even trust CNET's Download.com).

Two-factor authentication has its benefits

Although the security of 2FA (two-factor authentication) is often oversold, its effectiveness often depends on which risks you think you're mitigating. For example, 2FA can't stop most of today's APTs (advanced persistent threats) once they have full control of your PC -- but 2FA is great at preventing phishing attacks (which often precede the ultimate compromise).

If you can be strict enough to allow only 2FA when users log on to company resources, then there's no logon name and password combination to steal. When the fake phishing email arrives asking for the user's logon credentials -- sorry, bad guy, you're out of luck. This works well only if you use 2FA everywhere on the corporate network, and you don't need a logon name and password for some websites.

Don't use the same passwords across systems or websites

After phishing, the most common way hackers obtain your password is from other systems and sites. Many users have been successfully phished for their Facebook or Twitter logon and the attackers use the same password for the user's corporate logon. It works all the time.

Make sure your corporate passwords never match any password you use off the corporate network -- and don't use the same passwords on multiple websites. Even on the corporate network, local admin and service/daemon accounts should never share passwords on different systems -- it allows a credential theft attacker to leverage a single compromise into a network-wide compromise in minutes. Not sharing local passwords is one of the best measures you can take to slow down attackers and minimize the damage.

Don't have permanent members in your highest elevated groups

Malicious hackers always escalate their privileges to obtain the highest security credentials in the network. Once they have those, it's game over. Want to frustrate a hacker? Don't have any permanent members of any elevated group, and monitor and alert on unexpected member additions. There are ways around this defense, but most hackers are stymied when their go-to methodologies fail. Frustrate a hacker today!

Put your event monitoring on a diet

If  you're collecting a bazillion events a day, you're doing it wrong. Instead, focus on defining only events that indicate maliciousness, and only alert on those. Everything else is trying to find needles in a haystack. If you want to know what events to monitor, email me.

Network traffic analysis is a godsend

Today's attackers gain a regular user's credentials, then begin moving around the network accessing servers and sites the user's logon credentials can access. Or they are using memory-only resident software that's really hard to detect. But no matter what they use, bad guys move around networks in illegitimate ways. Use a network flow analysis tool, define what is normal, and alert on the abnormal.

Whitelisting works better than antimalware

If everyone used a whitelisting application control program it would make everyone's life easier. Whitelisting programs can prevent previously undefined programs from executing. That's a terrific way to stop previously unknown malware. But even if you can't use it in enforcement mode, turn on your application control program in audit-only mode. Then you can alert on and respond to new suspicious programs without interrupting normal operations.

Focus on how, not what

Lastly, learn how badness breaks into your network and put less focus on names. The name of the malware program on an exploited computer isn't nearly as useful as how it got in (through unpatched software, social engineering, and so on). Learn those modalities and focus on mitigating those types of threats; then you have a real computer security defense plan in the works.

After every major public hacking attack I read article after article offering absolutely useless advice. Those writers aren't thought leaders. They are parroting the unoriginal, unsupported dogma they've read. They haven't spent years looking at the data and interacting with hacked customer after hacked customer. I have. This advice is the real deal. Follow it, and you'll be better off than anyone else.

Read More News :- Techies | Update