I like having a build box

This morning I came across a blog by Landon Dyer called Dadhacker.  He got linked by BoingBoing for a entertaining post that he wrote about working on the Donkey Kong cartridge for Atari.  I started reading his other posts and it turns out that I agree with nearly all of his opinions.  Except for build boxes. He wrote:

The best thing you can do for your productivity when you’re tempted to set up that spare machine to do extra work for you is to ditch the thing.

If you are the person only using that build machine, I can see that point.  Almost.  I would argue that it's worth the time to have a 2nd machine in case the first one goes to the land whre DOS is eternally blessed.  For a team of programmers, having a dedicated build box is a must have feature.  No more guessing which program set which option to build which executable, they always get built the same way.  Plus it offloads the build process processing from your development environment and that is always a good thing.

The other advantage to having a dedicated build box is that you have have it do everything.  We use FinalBuilder and it's the kitchen sink of automated build tools.  We build about a half dozen or so shrink wrap ready applications on our build box and they all pretty much follow the same pattern:

1. Get the latest code from source control
2. Read an .ini to get the version number and other test resources, the build tool will bake the version number into the compiler and install builder.
3. Compile the application
4. Collect all of the bits and put them in a folder for the install builder
5. Authenticode anything remotely executable that we compiled
6. Create the installer from all bits that were compiled in the last step and add the necessary required bits (CaptiveX controls, Assemblies, help files, etc).
7. Copy the installer to a deployment folder for QA to test
8. Send an email to QA and other interested parties that a new build was available and include a change list in the email.

There are other minor tasks that get performed, but that's the gist of it.  And it works for for Delphi Win32 and .NET assemblies, with error handling.  The time our department saves that level of build automation clearly outweighs the the maintenance time on the build box.

Fun with changing the IP address of ESX Server 3.5

We (our IT manager and myself) have been having some fun with out shiny new VMWare ESX 3.5 server.  We have had it running for about two weeks now and we decided to change it's IP address.  The ESX server was on the same subnet as our LAN.  This meant that it the virtual machines were taking IP addresses out of a pool that was needed for our physical computers.  There were some other security issues, so we decided to put it on it's own subnet.

It was fairly easy to change the IP address address via the command line (this site helped a lot), the fun started with the NFS connection.  We are using NFS to mount a folder located on a Windows file server to add some offline storage for the ESX box.  To mount with NFS, you have to create a VMKernel in the ESX networking and the VMKernel gets it's own IP address.  That IP address must be on the same subnet as the NFS server.

When we moved the ESX to it's own subnet, we put it on it's own physical network and that broke the NFS connection.  We tried a few things and then we checked the Windows box that was running the NFS server.  It had two network cards.  The second one was not enabled, but fully functional.  We enabled it and set it's IP address to the subnet of the ESX box.  I had to drop and recreate the NFS mount, but it all worked.

While testing the networking, the IT manager was running one of the virtual machines (XP 64-bit) and set the network adapter in the VM to a static IP address.   It turned out he set it to the IP address of the ESX server.  That's when the fun started.  When you connected to the VM, ESX would lose it's connection and you lost control over ESX and the VM.  After a minute or two, you could access ESX through the VMWare Infrastructure Client, but you couldn't access the VM to change it's IP address.

We racked our brains trying to figure out how to get control of the VM to reset it's IP address.  The fix turned out to be really simple.  I powered down the VM from VIC and edited it's hardware settings.  I added a second network adapter (it's all virtual) and set the first one to be disconnected.  I powered the VM back up and the new adapter had a safe IP address.  I connected to the VM's console and opened up "Network Connections" in Windows.  The first adapter was enabled, but not connected.  I opened up it's properties and set it to grab an IP through DHCP.

I powered down the VM, removed the second adapter, and reconnected the first one.  I rebooted the VM and it had a new IP address.  Peace and harmony reigned through my virtual kingdom.

Just when I thought my SmugMug plugin was finished...

After tackling the Wix learning curve, I have an installer for my SmugMug plugin does usual things: check for .NET 2.0, install the files, add the registry key to register the plugin, and support upgrading in place.  One step closer to releasing this plugin for Windows Live Writer.

Meanwhile, over at SmugMug, a security issue of sorts popped up.  Don MacAskill, the CEO of SmugMug, blogged about it with great detail and openness and I'm not going into it here.  At any rate, in response to what was perceived to be a security, SmugMug is implementing some changes to their API.  The changes were fairly trivial to implement so it made sense to augment my plugin's code to be compliant with the updated API.

With their recent changes, I saw that my plugin was no longer displaying images for one of my test galleries, where it had worked before.  I spent a hour or so trying to track it down in my code, when the clue light finally flickered above my head.  I logged into my SmugMug account and examined the properties of that gallery. 

Sure enough, for that gallery, the "allow external links" option was set to "No".  This meant that even though my plugin would return valid URL's for the images in that gallery, SmugMug would send back a blank page for those URL's.  I augmented my call to get the gallery list to check the properties for each gallery and filter out the ones that did not allow external linking.

I thought that there would be performance hit for making a web service call for each gallery.  It wasn't really noticeable at all.  That's what I love about SmugMug, their API performance is damn fast.

At any rate, I was hoping to finally push this plugin out the door by now, but I'm going to take a few more days and beat on the code.

I hate spam that comes in under my own name

For the last few weeks, I've been getting spam email addressed to my work account with the "from:" field set to my work address.  That allows it past our companies spam filters.  The subject line is usually something liken "January 79% OFF" and the message body contains a few images, some oddly worded links, and some boiler plate text about receiving this mailing because I am "subscribed to MSN Featured Offers".

The images are blocked by our central spam filter, which means they are being hosted on a known site for spamming.  I haven't verified that with our IT manager, but it's a safe assumption. 

I'm going to block this message at my email client (Outlook 2007), but first I'm going to send a message to the ISP that is hosting the machine that sent the email.  The first thing to do is to see where the images and links are pointing to.  With Outlook, if you right click in the body of the message and select "View Source", Outlook will create a file named email.txt and launches it with the app registered to handle text files.  That's usually notepad, but YMMV.

For this message, I saw something that looked very much like the spam that was reported to the new.admin.net-abuse.sightings newsgroup in this post.

Most of the links were junk, but there was a link to "s y l l a b l e h e a v y . c o m" (I added spaces to prevent it from being a live link and inflating it's Google ranking).

A quick search in the Internic registry brings up the following results:

   Domain Name: SYLLABLEHEAVY.COM
   Registrar: XIN NET TECHNOLOGY CORPORATION
   Whois Server: whois.paycenter.com.cn
   Referral URL: http://www.xinnet.com
   Name Server: NS.XINNETDNS.COM
   Name Server: NS.XINNET.CN
   Name Server: NS2.XINNETDNS.COM
   Name Server: NS2.XINNET.CN
   Status: ok
   Updated Date: 19-feb-2008
   Creation Date: 16-jan-2008
   Expiration Date: 16-jan-2009

That tells us a couple of things.  One, the website is registered by a Chinese registrar.  Two, it was created about a month ago.  The next step is to track down the Registrar, Xin Net.  A quick search on Xin Net, gives us some more information:

Registrar Name: XIN NET TECHNOLOGY CORPORATION
   Address: 1st Floor,2nd Building Section A,BDA BeiGongD, Beijing, China 100176, CN
   Phone Number: 86.1058022118
   Email: domainadmin@xinnet.com
   Whois Server: whois.paycenter.com.cn
   Referral URL: www.xinnet.com
   Admin Contact: cody zhou
   Phone Number: +86.10.58.22266-551
   Email: tech@xinnet.com
   Admin Contact: xiaorui wang
   Phone Number: +86.1058022118-205
   Email: admin2@xinnet.com
   Admin Contact: Baosheng Jiang
   Phone Number: +86.1058022118-623
   Email: admin1@xinnet.com

 

This gives a whole bunch of email addresses to complain to.  What I did was to send a polite message to all of the addresses listed above.  I sent the following:

Hello,

Please excuse this unsolicited message, but I have been receiving numerous spam emails and they link to a site, syllableheavy.com, that you are listed as the registrar of.   This site probably violates your terms of service and I am sure that you do not want to be associated with it.    The message did not originate from that site, but it is using that site.

I then included the message header and the message source.  I doubt that they will do anything, but if they do take action, it takes a spam site offline.

The next thing to do is block additional messages like that. 

• From the Outlook menu, I selected "Tools->Rules and Alerts" to create a new junk mail filter. 


• In the "Rules and Alerts" dialog, I clicked "New Rule...". 


• Under "Start from a blank rule", I selected "Check messages when they arrive", and then clicked the "Next" button.


• Under "Which condition(s) do you want to check?", I selected "with specific words in the sender's address"


• For the "with specific words in the sender's address", I entered my address.  I rarely send myself email from my work account.  When I do, Exchange just uses my first and last name, not the SMTP address.  Then I clicked "Next"


• Under "What do you want to do with this message", I selected "move it to the specified folder" and "mark it as read".  I selected "Junk E-mail" as the selected folder.  I then clicked the "Next" button.


• I clicked the "Next" again to skip over the exceptions to this rule.


• I gave it a name and set the checkboxes to run it on messages already in the inbox and to enable the rule and clicked finish.


• Clicked "Apply" and then"OK" and we are done.

That will permanently take that style of junk mail out of my in box.  I didn't permanently delete the message.  About once a week, I take a quick peek in the junk e-mail folder just in case a false positive hit grabs a legitimate email.

Nvidia nForce network driver problem under Vista

On my home machine, I rarely reboot it. If a software update requires a reboot, then I do it. otherwise it stays running for weeks at a time. Vista (32-bit) has been stable enough for me, where I don't have to start the system or suffer system crashes.

But when I reboot, about 10% of the time (just a wildly inaccurate guess), the machine comes up without any network connectivity. In the past, I have associated it with Windows Update installing a wonky driver for the network card and I System Restore the machine back to normal. It happened today and the list of the usual suspects did not include any hardware updates. Time to dig deeper.

This machine has a NVidia nForce motherboard (Asus M2N-SLI Deluxe) and it has built-in dual Gigabit LAN controllers. I had an Ethernet cable hooked up to the first port and had disabled the 2nd one through Vista's "Network Connections" utility. My dead Windows Home Server box was next to my PC, so I unplugged it's Ethernet cable and plugged it into the second port on my machine. I enabled the network adapter and after a few seconds, it was live and had grabbed a IP address from router.

That was interesting. Since the working adapter used the same driver as the non-working one, that pretty much ruled out Windows Update nuking one of the drivers. I peeked at the driver settings for both adapter, they were both set to the defaults. I also checked the device status of the adapter, Windows reported that "This device is working properly." That was a pretty good indicator that the problem was not a fried controller on the motherboard.

The next thing to check was the ethernet cable. I swapped cables and there was no change. I decided to do the Nintendo fix. That's when you pull out the cartridge, blow on the connectors and ram it back in again. In this case, I disabled the adapter, waited 30 seconds, and re-enabled it. As Emeril says, Bam! The adapter started working. Time to start googleing and see if anyone else is having this problem.

And the number one hit for "nforce network adapter fails" in Google was a long thread in the Nvidia message forums. A sizeable number of people were having the same problem and they were all running Vista. It may be a timing issue during boot-up. Two workarounds were suggested. One was to change the duplex setting from "Full Autonegotiation" to "100 Mbps Full Duplex". The other was to change the priority order of the network adapter priority. I didn't want to mess with the driver settings, so I opted for changing the priority order. I'm not confident that it will fix the issue, but it wont hurt anything. Right now this is more of an annoyance than anything else, but I would like to resolve it permanently.

Tech Tags: nvidia nforce vista network driver

Using Wix for my Live Writer Plug-in

I finally have version 1 of my Smugmug gallery plug-in completed. The next step is to do the installer. To get a plug-in up on the Windows Live Gallery, it must have an installer that meets the requirements on the Gallery Developer Center page. A content plug-in has to meet these requirements:

1. Content Plugins must be built using either the .NET 1.1 or .NET 2.0 frameworks.
2. Content Plugins must be packaged and submitted as a Microsoft Installer (*.msi).
3. If you use the .NET 2.0 framework, the installer must link to the .NET 2.0 download site or use the Visual Studio 2005 Bootstrapper. The Bootstrapper detects and downloads the correct .NET 2.0 framework.
4. Your installer must copy the assembly to the "Plug -ins" sub-directory of the Windows Live Writer installation directory.
   

I have #1, my plug-in uses the .NET 2.0 framework. Number 2 is that it must be packaged using a Windows Installer .msi setup. I'm still figuring out the best way how to implement #3, but I'm not sweating it. With #4, I'm not doing it that way. The alternative method is to install the plug-in in your own folder and write a registry key to Software\Windows Live Writer\PluginAssemblies (HKLM or HKCU) with the name of your plugin and the path to it. That way you don't have to worry about where Live Writer was installed to. In fact that page is probably obsolete, there is an MSDN article that covers the registry method.

Let's start with the .msi requirement.

I looked that the "Setup Project" template in VS 2008. Um, no thanks. After 30 minutes of playing with it, I started getting annoyed. It felt awkward and non-intuitive. Granted, most things with Windows Installer are awkward and non-intuitive, but I couldn't get fast handle on "Setup Project" template. It was easy enough to get the files installed, but getting the registry written correctly was a task I just couldn't figure out. After two years of doing .msi with Wise For Windows and now InstallAware, I have a pretty good idea of an .msi is supposed to work.

I decided to knock out an setup with InstallAware. It took about 5 minutes and worked perfectly. But it was 1.2 MB in size. That seemed excessive to deploy 45K for two assemblies. Frankly any installer will be excessive, but I have to follow requirement #2. I have lots of love for InstallAware and it's my tool of choice for application installs, but it still bothers me to have a setup that 26 times larger than the files being deployed.

With VS's "Setup Project" and InstallAware out of the picture, I decided to check out WiX. WiX stands for WIndows Installer XML and is an open source toolkit for building .msi setups from an XML source file. The current version, 3, installs nicely into VS 2008. It installed so nicely, I didn't need to be concerned with how to run the Candle (the WiX compiler) or Light (the WiX linker). There is also a .msi decompiler, named Dark. It will emit Wix source code from a .MSI or .MSM file.

WiX source code is pretty intimidating when you first look at it. if you have no experience with authoring Windows Installer, it will be hard to grasp at first. The WiX site has a nice tutorial, but it's for version 2 and uses syntax that's deprecated in version 3. Fortunately, I was able to google the differences and I was able to get a working installer in about an hour. It's not handling step 3 completely, but it is terminating the install if .NET 2.0 is not available.

The size of the .msi is much smaller, about 220k. Still way too large, but it's as about as small as I'm going to get for a .msi file. So far, I'm very impressed with WiX. Once you start getting the hang of the syntax, it's very clear on how to setup a proper .msi file. There's even a open source editor called WixEdit. I didn't need it for this task, but I think I make take at peek at it at another timer.

Enough people are using it so that I was able to google for the bits I needed. Morten Lyhr had a great post on how to detect the .NET Framework. I figured out how to write the registry key from a post by Chris Jackson. Bonnie (one of the Live Writer developers) had a good sample WiX file for installing a plug-in. While I didn't follow her pattern, it did give me a tour of the neighborhood. Mike Stall has a good post that covers the basics. I think I need to spend some time reading the blogs of the WiX developers, they have a build a really cool tool.

Tech Tags: Windows+Live+Writer plugin installer msi Wix

When the clipboard doesn't work across Remote Desktop

Every now and then, when I have a remote desktop connection open, the clipboard fails to copy across the sessions.  It's usually the remote to local copy that's borked.  It's pretty easy to fix, but I can never remember what I need to do to fix the connection.

Fortunately the Terminal Services Team Blog has got that covered.  Just kill and restart the rdpclip process in the remote session.   There was also a part two to that post that was pretty interesting.

[Edited on 1/30/08]
There is a command line way of resetting rdpclip, so you can roll up both steps as a batch file

taskkill /IM rdpclip.exe
rdpclip.exe

Tech Tags: Terminal+Services Remote+Desktop rdp clipboard rdpclip

Copying files with VS 2008's port-build event under Vista

I'm still working on my SmugMug plugin for Windows Live Writer. I've ported it from VS 2005 to VS 2008, that was trivial. I'm at the point where I want to debug the plugin while it's being loaded from Live Writer. Normally, this is pretty straight forward. You use the post-build event to copy the plugin's files to the Live Writer plugin folder. For my plugin, I used the following build event:

xcopy /D /R /Y "$(TargetDir)s*.dll" "C:\Program Files\Windows Live\Writer\Plugins"

The next step is to go into the Debug settings for the project and set the Start Action to Start external program, setting it to the path to the Live writer executable. On my machine, that would be:

C:\Program Files\Windows Live\Writer\WindowsLiveWriter.exe

With that set, all I need to do is to press F5 and my plugin gets built, copied to the Live Writer plugin folder, then Live Writer gets launched. Sounds good, but when I did a test build to verify the files would get copied, I got the following error message:

"XCOPY /D /Y /R "C:\dev\DotNet\LiveWriter\SmugMug4WindowsLiveWiter\SmugMug4WLW\bin\Debug\s*.dll" "C:\Program Files\Windows Live\Writer\Plugins\"
" exited with code 4. SmugMug4WLWPlugin

Code 4? I had to get Mr Peabody to look that one up for me. DOS 3.2 ring a bell? At any rate, exit code 4 for xcopy is "Initialization error (not enough memory, invalid syntax, path not found)". That actually was a clue to what the problem was, I was just missing the obvious. I tried pasting that xcopy command into a Take Command shell window and it ran without errors. So the syntax was correct, something was blocking it.

D'oh! I'm doing this under Vista. Joe User can't just copy files into "program files" space, that's no longer allowed. Only administrators have write access to "program files" and I'm running VS2008 without elevation. I run my Take Command shell as admin, so of course it can write to the plugins folder.

To get around this, I decided to punch a hole through Vista's default rights for that folder and give everyone and their dog full access to it. I tried doing it through icacl, but I wasn't getting the syntax right. So I just opened up explorer, selected the plugins folder, right-clicked and selected "Properties". I then selected the "Security" tab and then selected Users under "Group or user name". Next, I clicked the edit button, to bring up the edit dialog for the access rights. I selected "Full Control" and then clicked "Ok" all the way home.

That fixed it. VS2008 was able xcopy my plugin without any errors.

Tech Tags: vs2008 post+build+event Code+4 xcopy Vista icacls

What do you mean my router has a UPnP security hole?

It's been recently made public that just about every consumer router is a security hole wide open and it's called UPnP.  That stands for Universal Plug and Play and it's a set pf protocols that allow netwrok devices to configure themselves on a network without requiring much, if any, human intervention.

The problem is that UPnP does not require any authentication and it is possible to create an Adobe Flash applet that will do nasty things to your router.  Like change the router's DNS settings so that when you visit your bank's website, you get sent to a phishing site that will take your login and password.  Or port forward to an external server, allowing your router to be used to attack other sites.  Or expose computers behind the router's firewall.

Since so many web sites use Flash to display ads, you would never see it coming.  Once you visited that page, the code would and your router is no longer solely under your comtrol.

Since many routers enable UPnP out of the box, you'll want to disable UPnP on the router.  It's usually an easy task, but you may need your router's manual to figure how to change your settings.

If you are using Windows Home Server, when you first configured it, it prompted you to allow it to turn on UPnP.  If you did that, go in and turn it off.  Right now.

How (and why) to increase the Windows Desktop heap size

Jon Galloway had a posting about issues that he came across when he opened too many tabs in IE7.  Apparently the Desktop ran out of heap space and Bad Things happened.  Jeff Atwood came across the same problem.  I remember reading Jeff's post back in October, but I didn't associate it with a problem that I was having.   

I was finding my self rebooting my XP dev box a couple of times a day.  The desktop was basically losing control and I couldn't do anything with the task bar or Start Menu.  Part of the problem was due to wonky display drivers from Nvidia.  I updated the drivers and the problem went mostly away.   But not completely.  I have a dual monitor setup, and I have a tendency to keep lots of things open on a desktop that spans both displays.

The longer I used Firefox, the less stable the system became.  I just became used to restarting Firefox.  One of the nicer things with Firefox is that you can restart it and come back to the same tabs loaded with the same pages.  BTW, Jed Brown's Restart Firefox Add-on is very helpful when you want to bounce FireFox and still have the same 12 tabs open.

At any rate, I was seeing the same symptoms that Jon reported.  There is a registry setting that you can edit that will allow you to specify the heap size reserved for the Desktop.  The default size is 3MB, everybody seems to agree that 8MB is the way to go.  The 3MB number was set for NT 3.51, back when we had a lot less memory in out machines.  This is only applicable for 32-bit versions of Windows, the 64-bit version do not have these memory limitations.

Kevin Dente documented how to bump this value.  To change this setting, you'll need to edit the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems and edit the "Windows" value.  This value is (as Kevin put it) a "big honkin' string" and you only want to edit one portion of it.  Look for the part that starts with "SharedSection".  It will have three numbers, the middle one will probably be 3072.  Change that to 8192.  On my machine, that part changed from "SharedSection=1024,3072,512" to SharedSection=1024,8192,512.  The YMMV rule is especially applicable here.  Remember to reboot after making this change.

The first number is the shared heap size common to all desktops.  The global handle table comes out of the shared heap.  The second and third numbers in SharedSection represent the size of interactive and non-interactive desktop heaps (services that interact with the desktop).  If terminal services are enabled, there may be a fourth number.  You only want to change the second number.

Tech Tags: SharedSection XP Memory Desktop Heap

What's the deal with this .rbf file?

I was updating the installer to one of our applications and every time I ran it, it wanted to reboot at the end of the install.  This installer was installing a web application with some utility apps, nothing that should have forced a reboot.  I was running the installer inside a VMWare virtual machine of Windows 2003.

I've been using InstallAware for the last 3 months to author our installations.  It was being signaled by Windows Installer that it needed to do a reboot to complete the installation.  The question was why?  After a bit of digging in the help file, I found that I could use the "/l=filename" command line parameter to have the installer write to a log file.

I ran the installer one more time and copied the log file down to my dev machine to take a look at it.  It had roughly 9400 lines of Windows Installer chattering.  I started scrolling from the end of the file until I came to the line:

Info 1903. Scheduling reboot operation: Deleting file C:\Config.Msi\3e1b7.rbf. Must reboot to complete operation.

What the frack is an RBF file?  After some googling, I learned that a file with the .rbf extension is a backup of an existing file.  I scrolled up some more and found a bunch of message like this:

Info 1603. The file C:\WINDOWS\system32\msvcr71.dll is being held in use by the following process: Name: VMwareService, Id: 1804, Window Title: '(not determined yet)'.  Close that application and retry.

The "Close that application and retry" tag means that installer would normally prompt the user to close the application that had the file in use.  If the process does not have a window title associated with it, then that prompt would be suppressed.  In my case, the processes were services and did not have window titles.  I found that documented in a few places, this post on the Windows Installer Team Blog being the most useful of them.

A few of the VMWare processes were also using msvcr71.dll and the file was in use.  OK, fine, but it was the same file.  Same bat-version, same bat-time.  Windows Installer should have had enough brains to determine that new file was the same file as current file and just skipped that step.  I don't think I ever had that problem with Wise for Windows (WFW had enough problems, but that's another story).  My guess is that it's an InstallAware issue, but I'm in the process of confirming that.

I did have a work around.  With the Install File MsiCode command, the dialog box for the command's properties has a check box labeled "Never Overwrite - do not install if another copy exists".  For msvcr71.dll, our code works pretty much each version that we have seen so far.  Setting that check box eliminated that reboot after every install.

Technorati Tags: rbf,InstallAware,Windows+Installer,reboot,msvcr71.dll

NPR broke the podcasting machinery

I like listening to podcasts on my Zen Vision:M player.  The Zen comes with a decent enough podcast tool called Zencast.  Zencast has an option to convert audio podcasts to video format.  They take the description of the podcast and display it as text in the podcast.  This makes it handy to see what is on a podcast by playing it for a few seconds.  The other advantage is that it categorizes them separately from the music, making it easier to drill down and locate the file to play.

Sometime in December, NPR made a change to their servers and is preventing the Zencast application from downloading any podcasts from NPR.  You get the message: "Unable to download due to a connection error."  It happened sometime between 12/3/07 and 12/04/07.  Other podcast sources work just fine, the problem is limited to NPR.org.   I can directly download NPR podcasts through a browser, but I lose the extra functionality provided by the Zencast application.  I'm not the only one getting this problem, I saw references to it here, here, here, and here.   The best guess is that the NPR server some setting that tells clients what functionality that they support and it's breaking the applications that actually check those settings.

Can someone from NPR please this?  I miss my Fresh Air and Car Talk shows.

Technorati Tags: NPR,Car+Talk,Fresh+Air,Zencast,podcast

Windows Live Writer change from beta to 1.0 that affects plugin development

I've been working on a SmugMug plugin for Windows Live Writer on and off for the last few months.  The code is nearly complete, some other things came up and I had to put that code a way for a while.  Now I'm back on the code and I'm almost done.  While I was off doing other things, two things changed in my development environment.

The first change was the release of VS 2008.  I moved the code from VS 2005 to VS 2008 without any issues.  The other change that Live Writer left beta and there were some folder changes.  Your plugin code needs to reference the WindowsLive.Writer.Api.dll assembly.  The beta version lived in "C:\Program Files\Windows Live Writer\WindowsLive.Writer.Api.dll" and the release version lives in "C:\Program Files\Windows Live\Writer\WindowsLive.Writer.Api.dll".  It's a subtle path change, enough where you wont catch it at first glance.

If you were using the Post-build event command line to deploy your plugin for testing, make sure that you are copying to "...Windows Live\Writer\plugins" and not "...Windows Live Writer\plugins".

The SmugMug API rocks.  Having written and consumed various web services in different incarnations, I've very impressed with the layout and functionality exposed by the SmugMug API.

Tech Tags: SmugMug API Windows+Live+Writer plugin

Zero! In!

While at DevConnections, I ran into a former co-worker, Dave Esposito.  Late one evening, we tossing back a few beverages and it turned out that 20+ years ago, we hung out on different edges of music scene in Albany.  I tossed out a few names of some musicians and it turned out that we both knew Billy Harrigan. 

I mentioned that Bill always detested me and what I did to his dog didn't help.  It turned out that Dave had heard that story but never knew that I was involved.  It's a fun story to share and n0 animals were harmed.  I briefly mentioned it once before, I think it's time to share the full story.

It's time to set the Wayback machine to 1983.  I was spending my free time hanging out with Jack Nemier.  Jack and his then fiance (and now wife) Judy were renting this tiny, one bedroom cottage in Colonie.  Jack had just joined the band "Operation Pluto" and the band rehearsed at Jack's house.

Operation Pluto consisted of the late Billy Harrigan, Richard Fuller, and Jack.  At best, Bill and Richard tolerated me.  Since it was Jack's house, they had to put up with me. 

Bill and his wife had a dog and a cat and one fine summer day, Bill dropped them off at Jack's house.  Bill's landlord wouldn't let him have pets so the animals had to go.  He asked Jack if they could stay there for a while, while Bill worked on convincing his landlord to let him have the pets.  Jack really didn't want someone else's animals, but he felt that he couldn't say no.

The dog was named "Zero" and was one of those little yappy dogs.  More enthusiasm than brains, if you know what I mean.  Jack pretty much ignored Zero and the cat, so Zero looked to me for attention.  At that point in time, I had no experience whatsoever with dogs, but I played with the dog and he got used to me.  Jack wasn't terribly diligent about feeding the dog or the cat, so I ended up doing it a good portion of the time.

By the time fall came around, Jack wanted the pets gone.  Bill didn't appear to be any particular hurry to retrieve his pets.  And I, not knowing anything about dog training, decided to see if I could teach Zero a trick.

Since Zero was always hungry, it turns out that he was quite amenable to learning new tricks, especially if food was involved.  I had discovered the basic rule of dog training, food.

After a remarkably short amount of time and dog biscuits, I had taught Zero to jump out the living room window on command.  The windows didn't have any screens and the season was warm enough that the windows were usually open.  The living room window was above a couch, and he would use the couch as a launch pad. A similar command would launch the hapless mutt back in through the window.

Zero was just big enough to reach the window sill from outside the house.  It was the funniest thing that we had seen in a long while.  Zero had lots of fun doing this trick and he basked in the attention it brought to him.

The next time Bill came over to the house for band rehearsal, I was already there.  He came in and the first thing he said was "Where's Zero?"  Zero was outside in the yard playing.  I innocently said, "I'll get him" and then yelled "Zero! In!".  About 5 seconds later, the dog comes flying in through the window.

Bill was stunned and more than just slightly pissed off at me.  He said "What just happened?"  I replied, "We've been teaching Zero new tricks.  Zero! Out!".  The dog ran to the couch and jumped out the window.   I then had Zero jump back in once more, so Bill could appreciate the sound of the dog's claws scrambling against the side of house as he jumped up to the window and pulled himself back in.  Needless to say, Bill took Zero and the cat home with him that day.

Bill left this mortal coil back in 2001, but the MySpace link attached to his name up above (and here) has some of his music recorded as "New Shiny Things" and as "Operation Pluto".

Thoughts on trading the Town & Country for the Odyssey

I was reading Steve Tibbett's post about trading in his Dodge Caravan for a Toyota RAV4 and I started thinking about the last trade in I did.  Back in August, we traded in our '03 Chrysler Town & Country in for a new '07 Honda Odyssey.

We bought the Town & Country just before we adopted Laura.  It was a nice van, but four years later, it was out of warranty and it felt like every time I took it in a for an oil change, it needed a few hundred dollars worth of work for one idiot thing or another.

Anne and I talked about trading it in and we had narrowed it down to the Toyota Sienna and the Honda Odyssey.  Both are very good vehicles, and I was sure we would be happy with either one.  Late last summer, I started pricing both vans with the options we would want.  The Edwards site is great for that sort of thing.  I also checked the trade-in value of the Town & Country so I would have a good idea of what the final cost would be.

We had the luxury of not being in any kind of hurry to trade the Town & Country in.   We could wait for the end of model year sales and try to get the best deal.  We had the time to test drive different models and get a feel of what we liked and disliked.

Last fall, Rennsselaer Honda had a "Hail Sale".  They were hit with a major hail storm and almost all of the vehicles in their lot had suffered minor hail damage.  Because of the damage, they were taking an additional $1500 off their sales price.  We decided to go down an take a look.

The place was mobbed and people were buying cars left and right.  We had to wait nearly an hour just to see a salesman.   While we waited, we walked through the lot and saw that they had 6 Odysseys.  Two were the Touring edition, which was out of the price range that we were looking for.  Two of the others didn't have the options that we wanted.  That left two EX-L models that we would be happy with.  The hail damage was very slight.  A few little dings here and there, you had to look close up at the right angle just to see them.  None of the dings had gone through the clear coat finish, so we were not worried about long term rust issues.

We got one of the old school salesmen, the ones that use the sale tactics that make you hate buying a new car.  He wanted us to take a van for a test drive, while his people looked over my van.  He wouldn't proceed until I told him how much I wanted for my van.  I didn't want to play the numbers game that early, but he was persistent.

I gave him an absurdly high number, $10,000, and he smiled and said that was a  good starting point.  He gave us the keys to the Odyssey that we liked the most and Anne and I took it out for a drive.  While driving I told Anne that I was going to play hard ball with the salesman and to be prepared to walk out with out buying a vehicle.

When we got back and sat down with the salesman, he asked if we were ready to make an offer.  I said "yes" and he then presented to us a sheet with the four squares on it.  The "4-square"  is the how the dealer tries to get you to pay the highest price for the vehicle.

Each square has a number in it.  The first number has the purchase price of the new vehicle, the trade in value of the current vehicle, the down payment, and the monthly payment.  Basically they make it difficult to see how much you are actually paying until you agree the sign the paper work.

Having read the article on The Consumerist web site about how the 4-square works, I declined to play that game (and a similar article was hysterical).  I politely, but firmly, pushed the sheet back to the salesman and said that I didn't need to see that sheet.  I said that I wasn't going base the purchase around the monthly payment figure.  I was going to bring my own financing and we would only discuss the amount that I would be the final purchase price with all taxes and fees included.  The salesman started talking about the trade in value of y van and new van price and I politely (but firmly) cut him off.  I said that I didn't care how the numbers were sliced, the only number that mattered would be the amount on the check.  I told him that I knew what my car was worth, what his car cost, what wiggle room he had and that there was going to be $1500 off for the "Hail Sale"

Once he realized that I wasn't going to play the 4-square game, he asked me for my offer.  I knew that they would turn down any initial offer, so I deliberately low balled it.  I had already figured that $27K would be the fair and reasonable amount to pay.  So I came back with $26K.  The salesman told me that he would have to take it to the business manager and he would be right back.  That's the code phrase for he was going to have a cigarette and make us wait and break our resolve.

He came back with $29K and change and tried to explain why how they came up with those numbers.  I said that was way too high and I asked for the keys for my van back.  He asked for a counter offer and I said $27K and that was final.  He went back to the manager and came back with 28K.  I said that was still too high and I think we would call it a night.  He blinked and asked for a final offer.  I said $27,500 and we were not going to wait another 10-15  minutes for his manager and if they didn't meet that offer, then we were done.  He came back with $27,504 or something like that.  I guess he wanted to say that he picked the final price.  I could care less about that sort of detail, the 27.5 number was close enough that we were comfortable with deal.

They tried to play a few more games with arranging financing and buying all sorts of warrantees, but I declined all of that.

After going through that nonsense, we love the Odyssey.  It feels like a better built vehicle than the Town & Country.  We are getting better gas mileage, that was an unexpected bonus.  There are a few things that the Town & Country had that didn't come with Odyssey, pretty much like what Steve noted on his trade in. 

The big thing was not having a powered rear hatch.  It was one of the more useful luxuries with the  Town & Country.  You could only get that on the Touring model of the Odyssey, but that would have added about $6K to the price tag.  The handling of the Odyssey is much better, you get a real feel for the road.  The Town & Country pretty much insulates you from the road.

Citizens Bank Debit card security worries me

A few weeks ago (on December 9th), I was reviewing my Citizens Bank checking account history online when I saw two transactions that didn't belong to me.  They were debit card (MasterCard) charges from an online grocery store in another state, halfway across the country.  They were posted on 11/27 and 11/28 for about $260 and $11 respectively.  I'm going to be vague about the amounts and the identity of the online grocery.   The online grocery made an honest mistake and did everything they could to rectify the matter with in a day.

I immediately called the 800 number on the back of the debit card.  The customer service rep told me that I needed to file a fraud report.  We could do it over the phone, but since it would need to be notarized, it would be faster to go a local branch office and file the report there.  I then asked to have my debit cards reissued to prevent any additional transactions from going through.

The next day, I went to local branch of Citizens Bank and filled out the fraud report.  I was told that I would get a provisional credit for the amount that was taken out within 10 business days.  It would take 45 days for the fraud report to be processed.

On 12/17, my replacement debit card arrived in the mail.  There was no sign of my wife's debit card.  I called the 800 number again and I was told that only my card was reissued.  I explained why I needed both cards reissued and they said they would do a rush order on my wife's debit card and they would waive the rush order fee. 

On 12/20, my wife's card came in and I went online to verify that we were not being charged the additional fee.  I saw that fee had been applied and immediately afterwards a credit for the fee had been applied.   Then I saw another charge from the same online grocery store, dated on 12/18 for around another $250.  I called the 800 number and I was told that I would have to file a second fraud report.  Since it was in the evening, this would have to wait until the next day.

Since the fraud department at Citizens Bank was not acting fast enough, I decided to start my own investigation.  I found the home page for the grocery outfit and called their customer service number.  I left message that several fraudulent charges had been placed on my wife's debit card and I requested that someone from that company to call me.

A few hours later, I received a call from "Dan" (not his real name), the owner of the company.  He had received the message and wanted to make sure that his company had not charged the wrong person.  I gave him enough information to prove that he had indeed charged my wife's card for three separate amounts.  After some research on his part, we determined that the transactions occurred when his customer transposed two digits of his credit card number when he had placed the order.  The two subsequent charges occurred because the number had been stored in the grocer's system.

I had several conversations with the owner and the directory of finances for this company and they said that they were changing their credit card processing to apply additional checks to accidental or fraudulent use.  They immediately credited back the three transactions to my wife's canceled debit card number.  As of this date 12/28, they have not been contacted by Citizens Bank or Mastercard about these transactions

The next day (12/21), I went to the local Citizens Bank and explained what happened again.  They apologized for the problems with 800 department and called the fraud department while I was filling out the second fraud report.  They told me that the second report would be attached to the first report and I would get the provisional credit to my account that day.  The person at the fraud department had some of the more critical details wrong.  This did not leave me with a warm and fuzzy feeling.  The money was posted back to my account later that day.

I now check that account every day to see if any odd transactions will be posted.  On 12/26, the money returned by the grocery was posted to my account.  Now I had too much money in the account.  I called the local branch and they will reverse the transaction for the provisional credit.

Here's the part that really bugs me.   None of this should have happened.  The grocer should have validated the credit card number.  The name didn't match.  The shipping address didn't match.  And they didn't require the 3 digit Card Security Code from the back of the debit card.  Any of those checks would blocked the transaction from going through.  That was the first failure.

The next point of failure was when the credit card transaction was submitted.  My wife and I had used our debits on the same day the first transaction went through.  Mastercard or Citizens Bank should flagged the grocery transaction as suspicious and called me to verify the transaction.  We have never used our debit cards online and have never set foot in the state where the order was placed and shipped.

The last point of failure was with the customer service department at Citizens Bank that handles the debit cards.  When I made the first request to have the cards reissued, both cards should have been immediately reissued.  I had no way of knowing from my account history of which debit card number had been used, I wanted them both reset.

Right now my concern is that there is nothing in place with MasterCard or Citizens Bank to prevent something like this from happening again. 

Externally signing Wise Installation System generated executables

I had a problem with applying an Authenticode digital signature to installer that I had created with Wise Installation System 9.02.  Basically, it was failing with the lovely message:

The signature was being applied outside of Wise, through our build process.  We use FinalBuilder to build all of our applications and it has a handy Authenticode action for applying an Authenticode signature to the target you specify.  If I disabled that action, the installer worked.

Wise has the ability to sign it's executables, but that version is hard coded to use Microsoft's signcode executable to handle the actually signing.  Microsoft has deprecated signcode in favor of signtool and I didn't have a copy of signcode laying around.  In all likelihood, the current version of Wise's script based installer would be able to use signtool, but I can't use the current version because they broke other, more important things.

After a fair amount of googling, I found an old copy of signcode on Thawte's site on this page.  I downloaded the file set and extracted signcode and placed it in my \windows folder.  I fired up Wise and went to the "Digital Signature" page in the IDE.  That's when I saw the blindingly obvious setting that I needed to set:

 

On the “Digital Signature” in the Wise Installation System IDE, make sure that the radio button labeled “Add a digital signature externally” has been checked. Once I made that change, everything worked.

Just listened to a great interview with Dan Appleman over on Hanselminutes

That spring, I treated my self to an MP3 player, a Creative Zen Vision:M.  Why I picked a ZVM is food for another post, but it's opened up a new world to me.  The world of podcasts.  My podcast listening typically falls into two categories:  programming related and NPR shows.

One of the programming podcasts that I listen to on a regular basis is Scott Hanselman's Hanselminutes.  His stuff is very good.  He gets to interview a lot of cool people in our world.  I just listened to his 11/29th interview with Dan Appleman.  They talked about software architecture, but they concentrated on the human side of architecture. 

Dan talked about what should go in a software specification.  He mentioned something that I occasionally do and that is that the spec should clearly list what it doesn't do.  A good spec will cover what it will perform, but you usually don't see specs that clearly list what will not be performed.

That makes so much sense.  It's important to list the scope of the spec, but it's just as important to list the limits of the spec.  We all make assumptions, that's just human nature.  I've been in situations where code was delivered and people asked for feature "B".  "B" was never specified, but since the code included feature "A", they had just assumed that "B" came along with "A".  Then you have to go back to add "B" and hope it wasn't too expensive to add after the fact.

When you list what the spec wont do, it forces the client to think a little more about what they want.  If you want something additional, it's lot easier (and cheaper) to add that feature before the code has been written than after.

How can you give away a eight year old?

I came across a news article about the Dutch couple who gave up their eight year old daughter, who they had adopted as a baby from South Korea.  They claimed she didn't fit in their life style.  What on Earth is going through these people's minds?  She has been their daughter since she was four months old.  Since when did the disposal of second graders become a life style option?

This little girl has basically had her entire life shattered.  How does a eight year old come to terms with the fact her mommy and daddy don't want her anymore?   I can't imagine what she must be going through right now.  The family has been living in Hong Kong for the last few years, but the girl is still a South Korean citizen.  The Korean community in Hong Kong has stepped in to find her a new home,  but she's going to need some help.  So does that Dutch family.  It's just mind boggling that they could do this.

Converting Delphi enumerated values to strings

It's pretty easy to converted Delphi enumerated types to string and vice versa, but I can never remember the syntax.  The good thing about having your own blog is being able use it as an off-line cranial storage device.  I did the same thing a while back to do the same thing in .NET code.

To convert an enumerated type to a string:

uses typinfo;

function MyTypeToString( value: TMyType ): string;

begin

    result := GetEnumName(typeInfo(TMyType ), Ord(value));

end;

 

To convert a string back to an enumerated type, the following syntax can be used

uses typinfo;

function StringToMyType(const value: string): TMyType

begin

  result := TMyStyle(GetEnumValue(Typeinfo(TMyStyle), value);

end;

 

GetEnumName and GetEnumValue are defined in typinfo, you'll need to add that unit to the uses clause of your code.  This functionality is very useful if you ever need to implement your own object serialization routines in Delphi.

Little Bobby Tables

Not too long ago, the online comic xkcd ran a strip that just killed me.

(thanks to Randall Munroe for providing the image link for hotlinking)

Our applications make extensive use of a table with a very similar name.  Most of our programmers got the joke and had a good laugh.  Our QA staff found it hysterical.  Had they been drinking milk, it would have sprayed out of their noses.

It does demonstrate quite effectively how easy it is to intentionally damage a database through a SQL injection attack.   The user enters in string literal characters into an entry field and alter the logic of the SQL statement being executed.  In the example displayed in the comic, the insert or update statement that would be been populated from the entry fields has been truncated.  A command to drop the students table would be executed immediately after the truncated insert/update had been executed.

This is an easy attack to block.  You have at least three ways to prevent this attack from going through.

Don't create your insert or update statements directly from the user editable entry fields.  If you use a parameterized SQL statement, that will block the attack.  The injection text will get written to the database as part of the entry field, but the injection SQL will not have been executed.  You get some additional benefits.  With SQL Server, the server will cache the execution plans of parameterized queries, providing a faster execution time when the next insert or update statement is execute.

Don't run the application with database login account that has enough rights to modify the database structure.  If you really want to lock down the access rights, block direct access to the tables and do everything through stored procedures.

"Sanitize your database inputs".  That usually involves the most amount of work, but a well designed application is usually doing some level of field validation.  Just filtering out the ";" from the entry field is enough to block the attack.

I used to use Yahoo...

Steve Trefethen's posting about Yahoo is pretty dead on.  I used to use the various Yahoo apps and services, but I have slowly replaced them with the various services from Google.  I think  the problem was the development team saw too many bright and shiny objects and decided to implement them.

Yahoo's email is an over-developed mess.  It's trying to be the web version of Outlook.  Even Microsoft's web version of Outlook isn't trying to be a clone of the desktop version of Outlook.  With web-based email, I want to get in and read it in as simple a manner as possible.  Thanks to the GMail Manager plugin, I have notifications when email comes into my various gmail and Google Apps email accounts get mail.

I don't want yet another proprietary IM client.  There's nothing wrong with Yahoo's IM, it's just that no one that I IM with uses it.  I prefer to use Trillian, one client to serve them all.

It's kind of sad.  I remember 10, 12 years ago when Yahoo was the only game in town for searching.  It got slower and slower to use and when Altavista came out, I dropped Yahoo for speed and simplicity of a fast search app.  And I stayed with Altavista until Google came out of nowhere and changed the search engine game as we know it. 

What happened after I emailed Sears

Earlier today, I posted about what I went through with ordering a vacuum cleaner from Sears.com.  My first inclination was to just call the store.   But I wanted to make sure that I got everything down and with as little emotion as possible.  I can do that better with email than over the phone.  I wasn't 100% successful with keeping my emotions out of the message, but I think I accurately conveyed the experience that I went through.

After a little bit of searching with Google, I found the email address of the CEO of Sears, Aylwin Lewis.  I figured if I sent it there, the executive assistant that would handle the email would send it the right person at the store.  That's not exactly what happened.  Mr. Lewis did read it and took action on it.

When I came home from work, I had a message from the district manager for Sears.  He called me back later in the evening and it was a very positive conversation.  He apologized for what happened with Sears.com and for what I went through with the salesman.  He told me that Mr. Lewis had forwarded my message to the nine regional vice-presidents.  They were concerned over the melt-down at Sears.com, and they wanted to address the problem with the sales staff.  They were well aware of the Sears.com melt-down, but having their own sales people bad mouth their Internet portal was something they were not aware of.

I was bit shocked by all of the attention, but I think it shows that they do care about the customer experience.  From what I saw and was told, the Sears.com site was unable to handle the load from the holiday shopping.  That's the easy problem to fix.  Their site just didn't scale.  You can fix that with more hardware or by tuning the existing hardware and/or software.

The other problem was the one that really bothered me and is why I sent out the email.  That was the experience that I went through when I tried to buy a vacuum out in the appliance department.  That's a harder problem to fix, but the district manager (Mark) made it clear that he was going to personally look into it.   I have to give credit to Mark, and the people he works for.  They did listen when I complained.  And he did offer me a small gift to make up for what I went through.  It wasn't necessary, but I do appreciate it.  I really think they intend on fixing the problem with the salesmen.

How not to handle Black Friday: Sears.com

On Saturday I was vacuuming when I noticed a burning smell coming from the vacuum cleaner.  It wasn't the burning rubber smell you get when the belt gets caught on something, this was coming from the motor.  This was the Saturday after Black Friday, so if an appliance is going to go, this would be a good day to replace it.

My wife wanted a Sears Kenmore canister vacuum, so I loaded up Sears.com and started searching.  They had the one she wanted for $100 off.  I had the option of ordering online with in-store pickup.  Great!  I could avoid the crowds and just show up at the merchandise pickup counter.  When I placed the order, they took 10% off the sales price for some on-line promotion that was due to expire in a few hours.

While placing the order, I was notified that I would receive an email within two hours.  The email would have a barcode that I could use at the automated station that Sears uses when you pick up an order.  I could also use my credit card to pick up the order.  Two hours seemed like an excessive amount of time, so I took the kids to Five Rivers (a local nature preserve) for a few hours.  On the way back from Five Rivers, I stopped at the house and checked my email, nothing from Sears.  I decided to head into Sears anyway to pickup the vacuum.  Before I left, I printed out the order confirmation page for the vacuum.  My daughters (5 & 7) came along for the ride.

Before I left my house, I dialed the 800 number for Sears.com to check on the status from my cell phone. I left the phone on speaker more and headed to Sears.  I was on hold for the 20 minutes it took to drive to Sears.  When I pulled into a parking space, I finally got a human being.  He asked me a couple of questions and put me back on hold into the general hold queue.  At that point, I hung up.

I went into the Merchandise Pickup area and waved my credit card into the scanner.  Nothing came up.  One of the employees came over and asked if I needed assistance.  I explained what I did and he took my printout over to Kevin, the Merchandise Pickup Manager.  Kevin explained that Sears.com was having problems and no one else who had place orders for pickup through Sears.com had received their confirmation email.

Kevin tried calling Sears.com to see if he could get order information, but he was unable to get through.  Since they had plenty of the vacuums in stock, he suggested that I buy one while I was in Sears and then cancel the order when the conformation email finally came in.  He gave me his direct cell phone number and promised to expedite the order cancellation.

We walked over to where they sell the vacuums and I saw the one that I wanted.  Within seconds a salesman came over and started telling how good that model was.  I explained that I had ordered that model through Sears.com and the order was stuck in the system.  I tole the salesman that I would like to buy another one for the same price and I would have the order cancelled.

At that point the salesman had a serious attitude change.  He told me that I had wasted my time on Sears.com and I should have bought the vacuum here at Sears.  He then told me that I would not get the 10% off because he didn't have the authority to do so.  I suggested (politely) that he should get someone with that authority.  He waved a manager over, all the while still telling me how wrong I was for buying the vacuum online.  Usually I tune that kind stuff out, but my kids were clearly bothered by it.

The manager came over and took my confirmation printout and started punching some buttons on the register.  While he did not say much to me, he was not cordial and I felt very uncomfortable.  The salesman made one more crack about my wasting time on Sears.com and I decided to end the process right there.

I told the manager and the salesman that I had had enough and I was not buying the vacuum.  The manager pretty much ignored me and continued to put the order into the register.  I walked up to him and asked for my printout back.  He made a dismissive comment that he was almost done.  I reached for the printout from his hand and he refused to let go.  At this point I said that I was leaving and please let go my printout.  At that point, he finally let go and I walked out of Sears with my young daughters in tow.

This Sears is one the anchor tenants of the Colonie Center mall and since we were already down here, I decided to make the most of it.  The girls had fun looking at the Christmas decorations and I bought them some hot pretzels.

The way back to our car was through Sears and we had to walk past the Merchandise Pickup department.  I figured I would give it another shot, since we were going by it.  I waved my card by the machine again, still no sign of my order.  Another employee came up and offered to look up my order on their computer.  I explained what I went through earlier and that it wasn't worth looking it up.  A manager came over and they mentioned that I could buy another one and then cancel the first order.

I then explained what happened with the salesman that they were shocked.  They said they could ring up the order right on the spot and at the price I paid online.  Then they asked for details on the salesman that I spoke to earlier.  They promised to look into that for me and I got my vacuum and went home.

The next day I called Sears.com and after 20 minutes on hold, I spoke to a representative.  I gave here my order number and she said that the order was now canceled and gave me an order cancellation number.  I figured that we were done.

The next day (2 days after the placing the order), I get an email from Sears.com notifying me that my vacuum was ready to be picked up.  I called Sears.com and after 15 minutes on hold, a representative took my order number and then hung up on me.  I called back and 10 minutes later, got yet another representative.  She explained that Sears.com could not cancel the order, it had to be done by the store where the pickup was scheduled.  I gave her my cancellation order number and she told me that it just means that I have requested an order cancellation, but they couldn't cancellation.  I asked her what the point was with the issuing of the cancellation number, and she told me that was to keep track of the cancellation request.  Basically, they could take and log the request, they just were not going to do anything about it.

I called the number that Kevin (the merchandise pickup manager) and within seconds I was speaking with Kevin.  I gave him the information from the confirmation email, and after a few minutes of struggling with the computers on his end, Kevin was able to cancel the original order.   While Kevin was trying to cancel the order, an email comes in from Sears.com.  It included the following text:

Thank you for shopping at Sears.com. We are experiencing a delay in sending order confirmations due to the volume of orders received during the Thanksgiving holiday. Please be assured we have received and are processing your order.

An hour later, I got another message stating that the order had been canceled.  I was amazed by what I went through.  I had placed the order for pickup through Sears.com because I thought it would save time.  It was Thanksgiving weekend and I though the salesmen would be very busy.  The staff working at the Merchandise Pickup counter were polite and helpful.  I can not say the same for the sales staff or the people who answer the phone at Sears.com.   I doubt that I will ever use Sears.com again.

[Update]

After posting this earlier, I decided to email this text Sears.  It did get a reaction, and it appears a positive one.  I wrote about it in the post that comes right after this one.

Digital versus paper books

Charles Petzold has a good point about the digital versus paper books debate.  Digital books are great when you first get them, but how are you going to read them 25 years from now?  How many people reading this have computer gadgets from 1982 that still work?  Can you read the disk from 1982 circa IBM PC?  I know I don't have any 5.25 in floppy drives anymore.

Even if you still have the e-book on a CD-ROM in 2052, good luck trying to read it.   The CD-ROM format should still be readable 25 years from now because the size of the disc seems to work for most people.  The problem will be that nothing will be able to handle the DRM encoded in the e-book.  Google pulled the plug on it's Internet-based DRM system last August, after a year of use.

There are times that I liked having an e-book reader.  A few years back, I got a Viewsonic V37 Pocket PC as part of a MSDN promotion.  One the applications that was pre-installed was Microsoft Reader.  I was able to find a large variety of books in the Microsoft LIT format and it was easy to create Reader files using a MS Word plugin.  When we went to China to adopt Laura, I had a bunch of books on my V37 to read and it took a lot less space to pack.  But that was the exception, not the norm.

On the other hand, you have to deal with battery life, not a problem historically associated with printed books.  Battery life on my V37 was pretty horrible, 3-5 hours of sustained Reader usage.  That's not very useful on a 9 hour plane ride.  I managed to find a little gadget that would power my V37 from a 9V battery, that basically tripled the battery life.

Reading at the beach is something I like to do.  You just can't do that with a digital book reader.  First of all, you can't read one of those screens in bright sunlight.  You also have to worry about dropping it into the sand (not a good idea) or into the ocean (warranty killer). 

How many times can you drop a paper book before it breaks?  I no longer use my V37 because it was not immune from the effects of gravity.  My daughter dropped it and the fall from the height of a three year old (at the time) was enough of a shock to permanently shut off my Pocket PC.

What would be a great use for an e-book reader would be being able to rent from one from the local library and fill it up with books from the library.  If I was going on vacation, I would pay $15 to $20 to rent one for a week with 5 to 10 books in it.  It's not much different than getting a bunch of books on cd audio from the library and ripping them to your iPod (except the e-book rental would be legal). 

Sony has been trying to play in this market for years with their Reader Digital Book.  I have yet to see one of the Sony devices out in the wild.  Amazon has the resources to sell a huge number of Kindles to libraries at greatly discounted prices.  They would make it over time with the e-book sales.  Plus it more people will use one if they can try it for a small fee.  They cost $400 now.  For that kind of money, you can get a cheap laptop and Adobe Acrobat Reader on it.  Come on Amazon, you know what you have to do. 

[thanks to Julie for her post about Petzold]

When memes escape out of the series of tubes

It was only a matter of time before one of the candidates played the Chuck Norris card.

 

What's next?  LOLCats for Kucinich?  Oh wait, that one already happened.

Once you get past the wry amusement of the Chuck Norris "facts", does the apparent endorsement of Norris add anything to Mike Huckabees quest for the White House? 

My doppelgänger is preventing me from giving blood

About two weeks ago, I went to give blood for the Red Cross.  It had been at least five years since I had last given blood and there was really no excuse for that.  The Red Cross had a few rooms in another building in our complex and I made an appointment to give some blood.

When I got there, they asked for my donor card.  I had no idea where it was, but that didn't faze them.  They could look me up in the computer.  I gave them my name, date of birth, and Social Security number.  And that's when the fun began.

After entering in that data into their computer, I was flagged as being in-eligible for giving blood.  Forever.  And forever is a mighty long time.  I was given a form letter that included an 800 number that would provide more details.  Due to HIPAA restrictions, the staff at the Red Cross station could not tell me why I had been banned.

So I called that 800 number and talked to a Red Cross representative.  It turns out that there is another Christopher Miller with the same date of birth as me, but living half way across the country.  He has an illness that has banned him from ever donating blood. 

Because we have the same name and birth date, when my data is entered in the local Red Cross database, they hit his record in the national registry.  And they don't look at the SSN number.

The fun continues.  Back at the 800 number, I was told that the only way I can give blood is to not use my Red Cross donor card and never give out my SSN.  Without the SSN, they don't check the national database.

That's the mind-boggling part.  They don't check the national database unless I provide a SSN, but if I provide a SSN they wont use it to filter out other people with the same name and birth date.  That's just wrong. 

Technical Support: Verizon FiOS vs McAfee

It all started this morning when my wife went to check her email. She said that it wasn't working, so I took a quick look. She uses Thunderbird to check her Verizon FiOS email account. Thunderbird would connect to the POP3 server, incoming.verizon.net, but would time out after a minute or two with the message "Connection to server incoming.verizon.net timed out".

So I pinged incoming.verizon.net and it responded right back, so it didn't seem like a DNS resolution type of error. I logged into her email through Verizon's online webmail interface. That worked, so her account and password were still good. I went to the Verizon FiOS portal page and went through the various help topics. It didn't like Firefox so I fired up IE7. It didn't like Vista and complained that Windows 98 wasn't supported.

That ruled out online support, but it did surrender a toll-free tech support number: (888) 553-1555. (btw, if you ever need to find support number, try the gethuman database) I went down the automated phone tree until it got to the part where it said that I would need to speak a human. And then told that the wait time for a human would be 31 minutes.

Here's where Verizon goes the extra mile. I was given the choice between waiting on hold for the next available human or they would call me back in 31 minutes. I took the "call me back" option and went on with life. About 30 minutes later, Verizon called back and I got to talk with FiOS tech support rep. That's pretty cool.

Within 2 minutes, we determined that the email protection in the McAfee Security Center was blocking Thunderbird. I've only had to call FiOS tech support a couple of time and each time I got a person who knew his stuff and didn't blindly follow a script.

Basically, if you go into the McAfee Security Console and disable email protection, Thunderbird works. Enable it again and Thunderbird can't access the POP3 server. Pretty easy to duplicate and it was repeatable.

Yesterday, we saw a McAfee popup notifying that an update had been installed. Mentally, I had filed that under "Yeah, whatever". It seemed that the latest update was the culprit.

This was the free version of McAfee that you can get with FiOS, via MSN Premium. Getting the free McAfee is a story for another posting, they don't make it easy. Since the McAfee was more or less provided by FiOS, I figure there would be support, more or less. The FiOS guy told me that I would have to contact McAfee support and he gave me the number (800-337-6840) and offered to transfer me over.

I took the transfer and spent the next 25 minutes on hold, which was less far exciting than it sounds. After reaching a tech support specialist named "Terry", the real fun began.

The first thing Terry asked me was the email account that I had registered my copy of McAfee Security Center under. I tried explaining to Terry, that I never had to register my copy McAfee and that it was provided by MSN Premium via Verizon FiOS. Tery mulled thatover for a minute and then asked me for the asset code of my Dell computer. Apparently Terry thought I had eval version McAfee provided by Dell. The funny part is my wife's machine is new Dell desktop, but we had ordered it with the "no software pre-installed" option and her machine did not come with any preinstalled anti-virus application.

I told Terry that I did not have an asset code to give him and it was not relevant to this issue. At this point he finally grokked that I had the McAfee that comes with MSN Premium and I would not be his database. After walking through the steps that duplicate the problem, Terry told me that the solution would be uninstall McAfee Security Center and install a new version. Terry then gave me an issue number and started to wrap the call up. I had no confidence that this would work and requested for Terry to stay on the line. Terry agreed.

I asked Terry how that be different a version than the one that had just updated himself. He said that the currently installed copy had corrupted files. I asked how about he knew this and he said that other people were having this issue. I uninstalled McAfee Security Center and downloaded the latest version through MSN Explorer. You get a 500KB installer and it grabs the actual installable bits from the Internet. While it was downloading, it displayed the usual metrics of size, time, download speed. The download speed averaged around 45Kb/sec. I have the 20Mbps/5Mbps plan with FiOS, I should have been getting a much faster download. Terry told me that the was heavy demand on their servers with users having to manually download McAfee Security Center.

So after reinstalling McAfee Security Center, nothing was fixed. Thunderbird would only work if email protection was disable. Terry then asked me to turn off the PC and power it back up with the F8 key pressed down. I asked why, and he said that we would need to boot up in Safe Mode to see if the email would work without McAfee Security Center running. I made the point that it would be a waste of time since we already new that it work when email protection was disable. Terry made it clear that this step had to be followed. To make a short story long, that didn't work either.

Terry then put me on hold to talk to another support person. After a minute or two on hold, Terry came back to say that this was known issue and an updated would be issued through the McAfee update process within 24 to 48 hours. The work around is to disable email protection and try again in 2 days.

At this point, I have better than an hour and half sunk into this phone call. I told Terry that I was upset that I went through uninstalling, downloading, reinstalling, and rebooting into Safe Mode for an issue that they already knew about. Terry then told me that reinstall had fixed the problem all that reported it. There were a couple others that were not fixed and an update would be coming for them. I then asked Terry how he could use "all" in one sentence, but indicate "not all" in the next. Terry did not understand that question so we ended the call at that point.

At this point I have a lot of respect for Verizon FiOS tech support and almost none for McAfee. I pretty much got what I paid for, no question about that.

Tech Tags: FiOS Thunderbird McAfee Support