Re: Cannot Create A Web Site

On Apr 2, 1:11=A0am, Matt Davis wrote:
> In article <6af5a620-d81e-4bb9-b510-752b2e828501
> @m3g2000hsc.googlegroups.com>, jaibudu...@gmail.com says...
> My gut feeling is that unless you are Bruce Schneier, your "gut
> feeling" will not factor into any of Microsoft's decision making on
> matters related to security. It takes more than some vague complaints to
> steer Microsoft on something as big as Windows Security.

Most certainly.

> That comes out to about $60/hr. If they can solve in one hour what took
> you 167 hours of fiddling, then I think the $60 spent is well worth it.

And how do I recover the other 166 hours? At what point do I say,
"Hmm...this isn't working, better call Microsoft." Also note that,
during the last 27 hours of my struggle, there were multiple
Micorosoft people looking at the problem, not on the phone of course,
but at WWW.IIS.NET and through email. I finally had to reinstall
everything.

> It would not matter if you had 2000 years of software engineering
> experience if the problem you are trying to solve is not in that domain.

How is WebDAV PUT not in the domain of IIS 7.0?

> I disagree. You know you have done a good job when the *experts* in your
> field say that you have done a good job. If someone is foreign to your
> field of expertise, they are by definition not experts in that field.
> Why use the opinion of non-experts as a measure of a "good job"?

Because the non-experts might be a bit more objective than the people
who wrote it?
Certainly, and experts opinion counts. To use your example, if Bruce
Schneir found a bug in a cipher, that would outweigh any opinion that
non-experts might have about how good the cipher is because it is easy
to use. But surely you do not rule out the opinions of the users. If
that were done, then we would get rid of all rating systems on the
Internet. Technical blogs written by the average Joe would not be
read. There would be a few experts, and we could just take their word
for it. Actually, we could use the same experts who made the software.
That would save a few experts.

> > So I already know how much easier it could be, compared to how it is,
> > which is why I Microsoft (Research?) could do a lot better.
>
> By "it" are you talking about IIS or Active Directory or Kerberos?
> In any case, unless you work for Microsoft, it is unlikely that you will
> be getting your wish from Microsoft.

Both. I studied Kerberos in sufficient detail in 1990, and I only
skimmed enough of Active Directory to stop skimming. In any case,
there was an article written by staff member at CNET in late 1990's
claiming that secure directories were essentially to network-
whatever. IMO, he was right on spot, and of course, many people know
that, but the models that have been devised so far are not exactly
easy-to-use.

On the matter of getting wishes from Microsoft, two years ago, a
column was started called "Pure C++", which, IMO, was thinly veiled
attempt to subvert C++ in favor of C++/CLI, which is not C++...

anyhow, after a bit of back and forth, they changed the name of the
column to ".NETTING C++", which, IMO, more accuratey characterizes
what they are trying to do:

http://groups.google.com/group/comp.lang.c++.moderated/brows e_frm/thread/842=
53d37f970dd2b

Complaining often works.

-Le Chaud Lapin-

Re: Cannot Create A Web Site

In article 21c6dc5db8da@d62g2000hsf.googlegroups.com>, jaibuduvin@gmail.com says...

> And how do I recover the other 166 hours? At what point do I say,
> "Hmm...this isn't working, better call Microsoft." Also note that,
> during the last 27 hours of my struggle, there were multiple
> Micorosoft people looking at the problem, not on the phone of course,
> but at WWW.IIS.NET and through email. I finally had to reinstall
> everything.

That is entirely up to you. You are (and always were) in control of how
you choose to spend your time. Not Microsoft. Not the people on the
Internet. You *chose* to spend all 167 hours on this problem. If you
regret your decision, then the best thing you can do now is learn from
it.

I am not saying you did the wrong thing with your time. That is for you
to decide. I am simply pointing out that you are wasting your effort by
blaming Microsoft, IIS, Kerbereos, etc.


> > It would not matter if you had 2000 years of software engineering
> > experience if the problem you are trying to solve is not in that domain.
>
> How is WebDAV PUT not in the domain of IIS 7.0?

The question should be: how is setting up WebDAV + IIS7 + Vista in the
domain of a network security researcher? I do not setup my own
computers, nor mow my own lawn. I hire others for that. It boils down to
simple economics for me. I can pay someone less per hour to do those
things than if I had done it myself, because I make more than that
(hourly), so by getting my time back, I still come out ahead.


> Because the non-experts might be a bit more objective than the people
> who wrote it?

You imply an inverse correlation between objectivity and experience, but
if anything, the opposite is true. I don't put a lot of credibility into
the opinions of non-experts, and neither should you.

> But surely you do not rule out the opinions of the users. If
> that were done, then we would get rid of all rating systems on the
> Internet. Technical blogs written by the average Joe would not be
> read. There would be a few experts, and we could just take their word
> for it. Actually, we could use the same experts who made the software.
> That would save a few experts.

I was reacting to what you said. You said (and I am paraphrasing here):
"You know you have done a good job when someone who is foreign to your
field of expertise says your solution is the way they would do it, if
they were an expert in that field."

I am saying that experts determine what a "good job" means in a
particular field. Otherwise, why would teachers need to be accredited?
Can the average Joe blogger walk in off the street with no credentials
and no background and start grading medical students at the university
hospital? Of course not.


> > > So I already know how much easier it could be, compared to how it is,
> > > which is why I Microsoft (Research?) could do a lot better.

Perhaps. But if you really know how much easier it could be, you should
publish your findings. Surely you are not expecting Microsoft Research
to reinvent what you already have(?) If you have something, put it out
there. What good is research if it doesn't get applied?

--Matthew Davis