Microsoft Update Certificate Woes

When I choose "Start -> Microsoft Update" on my Windows system IE starts and shows http://update.microsoft.com/microsoftupdate/v6/default.aspx?ln=de .
Security paranoid as I am I have HTTPS://update.microsoft.com/microsoftupdate/v6/default.aspx?ln=de in my list of "trusted" sites but not the HTTP-site. I am willing to pay the price to have to add the "s" after "http" every time. No problem.

What annoys me is that since some time ago the certificate is issued to "www.update.microsoft.com" but not for "update.microsoft.com".
I admit that maybe I am not supposed to visit this site because I edited the URL by hand but come on Microsoft: Please buy another certificate or configure the server to redirect me to the one and only with the correct certificate. (This prepending "www" to every webserver is stupid anyway. Leave that to the companies that are 90% marketing and 10% feature)

All OS-updates should be over HTTPS anyway. CPUs are cheap! Buy some more if the encryption is a performance issue. I want that extra SSL security.

Uninstalling Microsoft's Clickonce Support for Firefox

Just learned how to uninstall Microsoft's Clickonce support for Firefox.

When you are a Microsoft customer by using e.g. Windows XP like me; and you update regularly then you might have wondered some time ago that a new addon misteriously appeared in Firefox.

This Microsoft explains some of it and how you can tweak the registry to get rid of it again. Yig.

This is too much customer care for my taste. Or too less when you have to edit the registry to clean your computer from unwanted helpers. Not good.

Your search - cardspace site:microsoft.de - did not match any documents.

http://www.google.de/search?q=cardspace+site%3Amicrosoft.de yields:

Not good! It seems that the German Microsoft site is not searched by Google. Strange.
Ahh. Searching for German language content on microsoft.com yields results...
Still...

Searching for Cardspace at search.microsoft.com results in an interesting suggestion: "Meinten Sie vielleicht: cards pace" (did you mean 'cards pace'). It seems that search.microsoft.com does not know Microsoft products.

user-agent pollution .NET CLR 3.5.30729

Don't know when this started but currently the Firefox user-agent string is polluted by new a new addition "(.NET CLR 3.5.30729)".

Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9 (.NET CLR 3.5.30729)

Maybe the new add-on "Microsoft .NET Framework Assistant" is to blame.

But although I disabled it the user-agent string was not reverted to normal.

Who gave Microsoft the right to blurt about the fact that .NET3.5 is installed on my computer?! Well, others are not better: If the Azigo Selector is installed then it adds itself to the user-agent string too.

Maybe SUN should add the installed Java version and whether OpenOffice is installed, and Adobe the installed Acrobat Reader version and the Flash version, and Apple the Quicktime and iTunes version and ...

Waiting for CardSpace Geneva

I wanted this video to loop forever but could not find how this is possible.
Maybe Microsoft should open source CardSpace Geneva; then we could help to bring it into the world.

Backward Compatibility. Java, Mozilla, Sun, IBM, Microsoft

About a week ago there were press articles about SAP paying SUN Microsystem to support SAP customers with stoneage java 1.4 users/systems.

Unfortunately there is nobody who wants to own and support the stoneage OJI project that puts java support into Firefox. The new way to support java is provided through the NSAPI plugin interface and the new thing is called "plugin2". Unfortunately (again) SUN forgot - or never knew - that Firefox extensions have - if they want - all the rights of the Firefox user. SUN implemented plugin2 having java applets in mind. Firefox extension that use java were forgotten.

But Sun is very helpful to ease the pain and supports me - thanks Kenneth - in rewriting the java classloading stuff from OJI to plugin2. But (again) you need java 6 update 12 or newer for this to work. This version of java has a patch for plugin2 that gives Firefox extensions the necessary priveledges.

So currently there are two options for openinfocard users: either disable plugin2 as I discribed in previous posts or install java6u12ea.
When Mozilla stops support for OJI then there is only the option to install a current version of java. I guess that Firefox 3.2 will not have OJI inside.

This reminds of an email thread/t on the higgins-dev mailing list. Where most developers wished for java 5 in higgins but IBM's shogun ordered his men to commit harakiri should they become traitors to java 1.4. Well, I am exaggerating...

I guess that IBM does not want to pay SU... - Hm, IBM has its own java - IBM to migrate customers stoneage IBM systems to a better world?!

Other memories bubble up: Did you remember the news that Microsoft CardSpace was downgraded to run on FAT file systems?

Well, well, well. I am happy that openinfocard is provided AS-IS.
I will do my best to support all versions of Firefox on all platforms, but my resources are limited. So we all should be happy if we can always work with the latest and greatest software. Happy downloading. Enjoy.

3500 New Jobs at Deutsche Telekom

Today I read about SUN Microsystem laying off 1500 people. Last week I read about Microsoft laying off 5000 people.
Time for some good news: Deutsche Telekom says it might offer 3500 new jobs.

Deutsche Telekom is planning up to 3,500 new jobs in Germany in 2009, dependent on the economic development in its individual business segments, CHRO Thomas Sattelberger announced today in Bonn.

CardSpace @ Microsoft 360° Security Days

Microsoft Germany offers the Microsoft 360° Security Days to German speaking architects, project managers and developers. One session for architects and project managers is about Microsoft CardSpace. I really hope this will be an inspiring talk given by a true believer of the claims paradigm.
It's a pity that a participant can not provide her claims by using information cards during registration for the event.
Anyway, I am happy that CardSpace is a topic. We need more events that advocate information cards. Worldwide and in other languages than English too. I hope that Microsoft Germany offers the slides of the session to the public after the event and not only to participants.

Microsoft acquired Credentica

This is such a smart move of Microsoft! I am impressed and I am sure that Credentica's technology will lead to a privacy improved version of CardSpace. I hope that Microsoft will provide open access to this technology for others to implement identity selectors, relying parties and security token servers. CardSpace is token agnostic but when I have read the U-Prove papers correctly then there is more then one roundtrip between id selector and STS required to deliver all the nice features. The protocol between id selector and STS thus probably has to be changed.
"Nice features": Some weeks ago somebody asked me "What is this (group signatures, zero knowledge based algorithms, electronic money based algorithms) good for. Where can anonymity, privacy, pseudonyms, untracebility, unlinkability, ... be used". At that time I answered this questions on a too technological level, interpreting the word "where" to mean protocols, signatures, encryption. The better answers would have been, and the acquisition of Credentica by Microsoft points in this direction: If the technology in available on every desktop computer or mobile computer/phone then users will learn to want privacy, untracebility and unlinkability. The services a company offers must have these features then or the users will use services that provide them.

Yahoo Information Card?

It has a long tradition to put question marks after the headling in big letter newspapers...
I was just reading that Microsoft is offering to buy Yahoo. And after much tataa for Yahoo's OpenId initiative I am wondering when Yahoo will support information cards. But even Microsoft is not very fast with supporting information cards at e.g. MSDN, MSN or liveid...

tataa = "Probably onomatopoetically for the sound of trumpets announcing someone's appearance or a circus stunt or whatever."