Adobe whacks prices up by 60%

Adobe have written to their Creative Cloud customers announcing a price hike. This is no ordinary increase based on inflation. Some people say their subscription will go up by 60%. My own licence will increase by 57% which is pretty outrageous. Currently I pay £38.11 per month which, from my renewal date later in the year, will rocket to £59.99.

The explanation from Adobe firmly blames currency fluctuations. The British Pound, however, has not collapsed against the US Dollar by 57% as Adobe think we’re stupid enough to accept. One Pound during 2015 was worth an average of $1.50 which dropped slowly during the first half of 2016 to about $1.45. At the end of June when just over half of British voters decided to leave the EU (Brexit) the Pound dropped and since then has averaged at around $1.25. It should improve once the deals to make Brexit happen have been disclosed and approved.

So the Pound has lost 14% of its value since June 2016 and Adobe believes this can honestly justify a 57% increase in their subscription fee to compensate for the currency fluctuation? That’s what most people would call over-compensating.

Some would say Adobe are taking advantage of loyal customers who have locked their skill set in to Adobe products. That might feel true and Adobe want you to believe it, but there are other good products out there which are similar and it’s only a matter of practice to get used to a different interface. The tools are similar, but most importantly your creativity and understanding of digital content creation is 100% transferrable.

There’s been a lot of noise recently about Affinity Photo and Affinity Designer from Serif. Reviews have been very positive as professional alternatives to Photoshop and Illustrator, but the best news is the cost. Just £48.99 each and – wait for it – NO SUBSCRIPTION! Yes, it’s yours to keep forever. Remember those glorious days when you only had to pay for software once rather than monthly for the rest of your life? It gets better because work has started on Affinity Publisher, an alternative to InDesign.

If you use Photoshop, Illustrator and InDesign then you might be spending around £720 per year on a Creative Cloud subscription. That’s £2,160 over a 3 year period. Instead the 3 Affinity alternatives will set you back less than £150 for use during those 3 years or the next 300 years. Even if you bought an upgrade after 2 years at full price it would only have cost you £300 at the end of the same 3 year period in this example. Currently updates to Affinity Photo and Designer are free and are available on both Mac and Windows.

Of course there are alternatives to Dreamweaver, Premiere, and Acrobat Pro that operate under the more reasonable “buy once, keep forever” model. I’ll explore those another time, hopefully before my Adobe subscription is catapulted skywards by 57%.

CFScript v2 – go vote for it!

CFScript is an inconsistent mess. Some statements take the form of functions while tags like cfloop are still named as cfloop in cfscript rather than just loop. Take a look at this:

cfloop(from=1, to=10, index=1){
     //stuff
}

Huh? Why shouldn’t a more JavaScript-like syntax be used rather than trying to replicate the tag’s BASIC-like syntax as literally as possible. It’s like trying to fit a square shape through a triangular hole. Sure, if you bang it enough it might go through, but it’s messy and you know it’s wrong.

No new developer should have to learn this conflicting, inconsistent, scripting language. It should be trashed but retain 100% backward compatibility.

How? Adam Cameron raised some inconsistencies of cfscript in his blog and without much thinking I suggested something simple to allow a new, clean scripting language to be used without having to throw away legacy code:

<cfscript version=2>
      // new code goes here
</cfscript>

When the CFML engine sees that version 2 is stated a new interpreter kicks in to compile it to Java. Obviously if version 1 is stated, or nothing at all, the legacy interpreter is used.

This feature suggestion has been added to Adobe’s bugbase. Please go and vote for it!

Adam picked up on my moment of clarity and blogged again with some great feedback from the CFML community.

V2 implemented this way will guarantee backward compatibility and wipe the slate clean to attract newcomers to CF and utilise it based on what they know from a more elegant, universal syntax such as JavaScript. Tagged based scripting and CFScript v1 are both a non-starter for newcomers who want to start a programming career. It's time Adobe think of the future, stop adding poorly implemented features that no one wants to use (cfclient?) and go back to the drawing board and get the language right without having to throw the baby out with the bath water.

Go vote now. You’ll need an Adobe ID to log in before you can vote.

Twitter the Twit – When short URLs are longer

Twitter is being a bit of a twit. I was tweeting a link to a very short domain and Twitter thought it would be a good idea to use its automatic URL shortener which in fact produced a longer URL! How dumb is that?

I typed in http://owl.uk which is 13 characters and Twitter replaced it with http://t.co/jLQcgAzbqX which is 22 characters. That’s 9 characters longer. What a waste when you’re only give 140 chars in a message.

The problem occurs in Twitter’s web client and also TweetDeck and I imagine most tweeting apps that don’t do a simple sanity check asking itself “is the URL the user types in shorter than the URL I can replace it with?”

I tried to contact Twitter to point this out to them but there’s no obvious contact information on their website. I was going a little crazy searching.

Adobe CC – that really means Continuous Cost

Adobe have moved all their big products over to a new licence called Creative Cloud that means customers will no longer own their own copy of the software. You have to rent it now, therefore the “CC” brand has a special meaning to Adobe’s senior management – Continuous Cost. Photoshop, Dreamweaver, InDesign, Illustrator and many other favourites of creative professionals and hobbyists must be rented from now on. Worse, ColdFusion support for Dreamweaver has been ejected.

So what’s the big deal and the bottom line with the new licencing model?

• Pay a monthly fee to rent a product
• If you stop paying the software will stop working (that’s why Adobe connects their software to the cloud)
• It’s much more expensive for people who don’t normally buy an upgrade each year
• If you don’t like Adobe’s new way of doing business then tough, it’s Cloud or nothing from now on
• If you’re a small business and fall on hard times you must choose between buying food and electricity or your monthly Adobe licencing bill. If you choose the former then your Adobe software stops working and you can’t do any work at all.
• For students, you too must find money to pay Adobe every month.

Example Pricing

Single product monthly cost = £17.58 x 12 months = £210.96 per year.

Upgrade from CS3+ to latest Cloud version = £8.78 x 12 months = £105.36 for first year only. For the second year onwards the price reverts to the full cost of £210/year or whatever it is at the time.

If you’re one of those people who religiously bought every upgrade for the desktop product then you might not experience a price increase moving to the new licencing model (you get every upgrade when you rent from the cloud). But if you only bought an upgrade when a must-have features has been added, say every other year, then you will be paying nearly double what you previously paid just to use the product on a day-to-day basis.

As usual, UK and European customers pay a premium over US customers. The respective monthly prices are $19.99 (£13.42) and $9.99 (£6.70). So an upgrade for the first year costs £25 more for the first year and £50 more for each subsequent year. That’s a 25% premium for not living in the USA. How is that justified if all the software is provided from the cloud. Do European customers drain 25% more resources from Adobe than US customers? The cloud downloads are probably hosted in the US but even if they were in Europe the hosting costs wouldn’t be different enough to warrant charging £50 extra for a single annual download!

If you need to use at least 3 Adobe products then you can get better value from their full suite. For £46.88 per month (£562/year) you’ll have access to every Adobe product they make. It’s unlikely you’ll use even half the 24 products that are included, and even if you did you’ll have to keep paying £562/year forever if you want to access your Photoshop, Illustrator, or Premier files any time in the future.

I used Premier a lot 10 years ago and if I needed to access the project files I can load them up using my old copy that I still own. But if the Cloud licence had started 10 years ago I would suddenly have to start paying a lot of money again just to load up one of my old files. Think about it. Anything you create with Adobe CC and save in one of Adobe’s native file formats can’t be accessed again in the future if you’re not paying monthly to rent the software back. If you want it just for one month only so you can look at or convert your files, you’ll need to pay a greater premium of nearly double the price!

Adobe Not Listening

Adobe’s Photoshop blog has a post called “Creative Cloud – we’re listening” with over 300 comments that Adobe have not listened to. And we say American’s can’t do irony? One comment tests whether Adobe are listening by writing “Wait, they don’t even moderate these comments? F**K, S**T, B*LLS?” There are no asterisks in the original. I wonder how many more weeks it will remain there, unread and unmoderated by Adobe.

Alternative Software

So what can we creative people do about it? Complain to Adobe? Ha-ha, don’t waste your breath. Adobe did a Van Gough to themselves years ago. Start to look at alternative software. Adobe aren’t the only players in the market. I admit most of their software is excellent and people will roll their eyes at the thought of having to learn to become proficient with alternative software. But there’s a lot of other good products out there that will save you money and send a clear message to Adobe’s greedy owners.

Lifehacker has an article suggesting which software you can download for free or for less for each of Adobe’s main products.

Mac owners should check out Gigaom’s article on cheaper alternatives.

A useful site is alternativeto.net that lists potential alternatives to all sorts of software such as Photoshop, Illustrator, Indesign, Dreamweaver and anything else you can think of. You can filter by OS and type of licence (commercial or free). Obviously not everything listed is good, or even satisfactory if you’re used to the Adobe version, but some options might come close if given a chance.

Dreamweaver CC Degraded

If the licence issue wasn’t enough to give developers unwanted headaches, then you might be gutted to hear that support for ColdFusion and .NET has been ripped out of Dreamweaver CC. Only PHP support remains. You’d think Adobe would retain support for their own server-side language. This has infuriated creative web designers who like the visual strengths of Dreamweaver to design and maintain their sites while incorporating CFML code. The alternative Adobe product, CF Builder, is not on par with Dreamweaver when it comes to HTML design tools. There is a glimmer of hope. I heard that DW CC will let you manually add the .cfm and .cfc file types back and will still syntax highlight CFML and provide auto-complete code hints.

Adobe release details of next 2 ColdFusion releases

Since Adobe acquired ColdFusion from Macromedia in 2005 they’ve been pretty tight lipped about future releases. There’s always been speculation about the future of the product, but Adobe have just shown the first signs that they’re changing their ways and giving ColdFusion developers a really big boost.

What has triggered this change at Adobe? Maybe because their accountants noticed the last quarter was the most successful for ColdFusion since 2008? “More of that please!” I hear them shout from the top of the tower! :-)

First off ColdFusion “Splendor” (that’s its code name for version 11) will be released in 2013 followed relatively quickly by “Dazzle” a year later. Adobe have committed to faster development cycles and lots of new features:

• Streamlined mobile application development
• Revamped and new PDF functions (at last, yay!)
• Easy social media integration for Enterprise
• Improved installation and deployment
• Enterprise performance & scalability
• Responsive multi screen content (erm, that’s client-side stuff)
• Social analytics
• Enterprise video portal (whatever that is?)

Read all of Adobe’s announcements about CF at their blog and checkout the roadmap PDF too.

Well done Adobe, no one expected to hear so much about the next release, yet alone the release after that as well!

Buying online from Slow-dobe

Here are some observations and tips for buying software direct from Adobe.com and a warning.

1. Don’t expect to download your newly purchased software on the same day you bought it. Adobe are very slow to release your product’s serial number. Imagine someone working in a tiny room somewhere in India printing out orders, using a ladder to stack them, as his grandmother slowly keys in serial numbers into another computer. The pair have been doing it for years and like it that way; they think their customers must be patient and wait their turn.
2. For UK consumers it’s cheaper to order a boxed copy than to go for the download-only option. Go figure that one out!
3. The US price is much cheaper than the UK price, but that’s no surprise. It won’t let you buy from the US store unless you register a valid US postal address. (I’m not sure if it would reject a credit card registered in the UK, but you could try using PayPal.)
4. If you are a business you can sometimes get a better price by going to Adobe’s Business Store – even taking VAT into account. This store also has the download and boxed options at the same price.
5. Adobe’s website is slooooow. The product pages are slow, the store is slow and the licensing site is slow. I hope the public don’t think this is a reflection of ColdFusion. They may get loads of traffic but that’s no excuse. They may be the market leaders and pretty much have a captive audience for many types of product but that’s no excuse either to be complacent.
6. If you think you can side step Adobe and buy from a reseller then think again. Downloads and the release of serial numbers for certain products (especially upgrades) must go through Adobe.
7. It’s been this bad for as long as I can remember. You should plan to make your purchase as early as possible, don’t leave it to the last minute.

I’ve just bought Dreamweaver in case you’re wondering. Previously I bought ColdFusion several times.

Genius Tech That Blew My Mind This Week

I stumbled upon two things this week that blew my mind. The first is a Xbox Kinect “hacker” who writes his own software to fully exploit Microsoft’s amazing hardware add-on. (Yes, I know it’s a few months old but you may not have seen it.) First check out this video. Keep in mind the Kinect is sitting stationary on his desk.

Genius video manipulation in 3D

A couple of months later he’s discovered how to link 2 Kinects together. What you will see is video from two stationary Kinect cameras. They do not move.

Super genius manipulation in 3D space with 2 Kinects

Taking this to the next level but with practical gaming in mind, look at what he did with a Kinect set up in two remote locations, a network connection between him and his colleague, a Doom 3 map and lots of clever code.

Augmented virtual reality taken to a new level across a network

Lastly, I was really impressed to see that a radio controlled hummingbird has been invented that uses nothing but wing-flapping to propel itself and behave remarkably like the real thing. It’s only 19 grams in weight (0.7oz) but can carry a camera to transmit live video back to its base.

The video of it flying in action is at NewScientist.com

Critical CF hotfix must be applied pronto!

Adobe released a security hotfix on 10th August 2010 and classed it as “important”. However, if security is even moderately important to your ColdFusion server, the file system, database and network then you must think of this hotfix as CRITICAL. Just to clarify, this is CRITICAL. An HP security expert has blogged about it and It also caught the eye of The Register.

Hackers have proven how easy it is to use a vulnerability in CF 7, 8 and 9 to gain access to the CF Administrator. Code to perform the hack has been made freely available (which I won’t directly link to, but others have). Mike Bailey tweeted “It works and it’s scary.” Someone else chimed in and showed how you don’t even need to hack the Administrator’s password by using a cheeky bit of JavaScript.

Why is this really bad? Well, once you have access to CF Admin you can run scheduled tasks to access the OS. Someone has kindly(?) written an FAQ explaining how it works and why it’s so bad.

Now that the world knows how to hack it, everyone running CF must now patch their server. Adobe need to hammer home the seriousness of this problem and how critical the hotfix is. “Important” doesn’t stress it enough.

If you have already made the “administrator” directory inaccessible to the Internet or IP protected it then you should be safe, but it’s a good idea to still apply this critical hotfix.

SP1 Joy for Windows 7 and Server 2008 R2

My main issue with Windows 7 and Server 2008 R2 was the removal of the otherwise simple feature of restoring open folders after a reboot. Currently Windows restores the folders in a random cascaded position forcing you to tidy up your desktop every time you boot up. It appears that through pressure from many users Microsoft have listened. Yay!

SP1, to be released in early 2011, will restore this much missed feature that was present in XP and Server 2003. From the documentation:

“SP1 changes the behavior of the ‘Restore previous folders at logon’ function available in the Folder Options Explorer dialog. Prior to SP1, previous folders would be restored in a cascaded position based on the location of the most recently active folder. That behavior changes in SP1 so that all folders are restored to their previous positions.”

Forget dynamic memory and RemoteFX, this is what I’m missing! :-)

ColdFusion Bugtracker Bug

How does one submit a bug about a bug submitting tool? Below, the ColdFusion Bugtracker after completing a 2 page form.

I tried this twice, logging in again the second time just to make sure I was logged in. Booo. Now I have 2 bugs to report to Adobe!

Sessions never expire bug in ColdFusion 8.01

A couple of times a year I’ve encountered a strange problem in our ColdFusion servers where sessions mount up and aren’t removed after they should have expired. Just today we had 100’s of sessions left in memory with all of the session scope variables still there at the end of the day, hours after they should have been deleted. Automated session housekeeping ceased to be.

Two other symptoms drew my attention to the above problem which must surely be related. Emails stopped being sent, the spool directory filled up without any cfmail files leaving. And from the website CF sporadically threw the error “The session is invalid” which was temporarily resolved by closing the browser and logging into the app again.

Restarting the CF services doesn’t resolve the situation because the service refuses to stop if asked politely. A full reboot is the only way to restore normality with confidence.

You’re probably thinking what good is it complaining now because 8.01 isn’t the current release and we should upgrade to 9.x. Well how do we know that 9.x has fixed this problem? Are Adobe aware of the issue? We could run a 30 day trial of 9.x on a test server but we’d have to run it for at least 6 months with a constant load to mimic our production server keeping in mind the rare appearance of the bug.

If you have encountered this problem before or know how to fix it then please let me know.

Windows 2008 Hyper-V / VSS / Backup Bug Part III

Good news! We’ve been issued by Microsoft with a public release of the hotfix KB982210, as it will be known. The fix will only work on 2008 R2 and not with any previous releases of the OS.

So how does the fix work? First let me explain the problem more clearly than in previous blog entries. Whenever a device is attached to Windows the Plug & Play Manager creates an entry for that device in the registry. If it’s a USB device, for example, and you unplug it then its entry will remain in the registry so when it’s plugged back in the computer will recognise it and any settings that have previously been set up for it. The same is true for snapshots created by VSS, the Volume Snapshot Service. A snapshot is treated like a device so one a new snapshot is created so too is a registry entry for the device.

Now here’s the problem. The registry entries are not removed – ever. While many users will never have a problem with that there are a number of power users who generate 1000’s of snapshots over a short period of time. For example, in our case where we use Windows Server Backup (WSB) with a backup schedule set to every 30 minutes which includes backing up 14 VHDs used by several VMs on Hyper-V. VSS will create 14 snapshots (one for each VHD) every time a backup is run. That’s 14 snapshots every 30 minutes. That’s 672 a day and over 20,000 per month. See how quickly they mount up and none of the device entries in the registry are being removed.

Severe problems manifest when the host server is rebooted and the registry is processed, analysing tens of thousands of devices, causing the server to look as if it has hung. It freezes for 2 or 3 hours, possibly more if I had let the server carry on taking more backups.

The registry key you need to check in Windows 2008 R2 is:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\STORAGE\Volume

There should be 10 to 50 entries in there for a normal healthy machine, depending on how many devices you have attached. On our server we had 28,000 entries!

Now, how does the fix work?

The new hotfix from Microsoft makes a change to the Plug & Play Manager that adds a timestamp (or a tombstone date as they prefer to call it) for each new snapshot device that’s created. This means Windows is now aware of exactly when a snapshot was created and can make a decision to fully remove the device’s entry from the registry after a certain period of time. I’m not sure how long it waits but from our experience it can be counted in minutes rather than days or weeks.

So well done to Microsoft for creating a smart solution to a critical problem. It took a massive amount of effort to get our case brought to the attention of the right person. Before that I had spent weeks working with a Microsoft support team in India by phone and remote desktop trying to explain what the problem was (and no, the problem will not be resolved by re-installing Windows, thank you!). It wasn’t until a Premiere Support case was opened and a Microsoft account manager from the UK got involved who contacted the right technical person that we started to make rapid progress. Microsoft had been aware of the technical issue for a while but our case seemed to have given them the incentive to fully investigate it. And we are grateful that we were finally listened to and some very expensive new servers can finally be put into service.

Cleaning up the registry

The only problem that remains is for other people experiencing this. You need to clean up your registry before applying the hotfix otherwise the freezing symptom will persist. To do this you need a tool from Microsoft called devnodeclean. Sadly this is not available anywhere on the Internet to download based on my Google and Bing searches. Microsoft should be able to email you a copy if you open a support case with them and refer them to KB982210 and this blog entry for good measure. Run devnodeclean without any switches at first to see what it makes of your registry, then use the /r switch to force it to remove the unwanted devices from the registry.

Next you may need to compact your registry if it has become huge, anything over 50MB I would say. Ours peaked at over 450MB. The “system” hive (found in C:\Windows\System32\config\) can be compacted using regchk using the switches /l /c /r /v. Again, chkreg is only available by request from Microsoft and was in fact developed to repair the registry in Windows 2000 but amazingly still works for 2008 R2. Please note that regchk cannot compact a live “system” file. You need to back up your system settings first and run chkreg on a restored copy of the “system” file (restore it to a new folder somewhere else). Then boot up from the Windows setup DVD and enter the recovery console. Rename “system” to “system.old” and copy the compacted system file into the config directory. Then reboot into Windows.

Nasty Bite From the Apple

Apple have gone bonkers. They have changed their developers license to make sure that Flash can’t run on iphone, itouch and ipad devices. Do they really have it in for Adobe Flash or are they just trying to hide the possibility that they’re going to launch their own software in competition to Flash, or maybe their devices will run really slowly if they were to support Flash?

Considering that Flash is on 98% of all desktop computers and most of the best or most visited websites use Flash this is very strange behaviour exhibited by Apple.

But you know what, I don’t care! Why? Because I don’t own any Apple kit. I never have done and I’m not sure if I ever will. You see, Apple produce fashionable portable devices and I’m not one to follow fashion, especially if it looks far better than it actually performs as far as features are concerned. (I admit the UI is good but the rest of the world is catching up – seen Windows 7 Mobile?) And denying i(pod|pad|touch) users the ability to tap into Flash is denying them a fair bit of functionality. But do the users really care? Probably not since millions of people have already spoken with their wallets.

Windows 2008 Hyper-V or Volume Shadow Copy Bug Part II

Following on from the problem I blogged about a couple of weeks ago, this is definitely a bug in Windows. From what we’ve been told it’s an inheritary, built-in limitation with VSS that prevents it from cleaning up after itself once 9,999 snapshots have been created. Therefore it only manifests if your server has created that many snapshots, so the explanation goes.

Now, not many people run snapshots frequently enough to encounter the problem but since our servers are running a backup every 30 minutes and there are 14 VHDs connected to Hyper-V we would run into the problem in just 15 days. That’s the explanation we were given but that doesn’t explain why after cleaning up the registry using devnodeclean and chkreg the registry will immediately start to bloat during the next backup. Hmmm. And we encountered symptoms (freezing) only after the first week – that’s less than 9999 snapshots. Hmm.

I’m hoping the engineers investigating this can come up with a permanent fix very soon.

2008 Server Freeze, Hyper-V or Volume Shadow Copy Bug?

We have been scratching our heads over a very strange problem for the last 4 weeks which causes two new servers to lock up for up to 2 hours after logging on after a reboot. They’re running Windows 2008 R2 with Hyper-V and Windows Server Backup roles installed.

After trying plenty of ideas to eliminate the problem it was pointed out to us by a Microsoft support guy that our System hive file was 343MB in size. It’s only supposed to be 15 to 20MB. I exported it as an ASCII file from regedit and opened it in Notepad. I counted 24,000 entries for VSS Snapshot devices! When Windows boots it tries to process 24,000 devices which causes it to choke killing the server for two hours – although the VMs limp on underneath and the host responds to pings but both the remote and local console is completely frozen.

Example registry entry:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{533C5B84-EC70-11D2-9505-00C04F79DE2F}\0349]
"InfPath"="volsnap.inf"
"InfSection"="volume_snapshot_install"
"InfSectionExt"=".NTAMD64"
"ProviderName"="Microsoft"
"DriverDateData"=hex:00,80,8c,a3,c5,94,c6,01
"DriverDate"="6-21-2006"
"DriverVersion"="6.1.7600.16385"
"MatchingDeviceId"="storage\\volumesnapshot"
"DriverDesc"="Generic volume shadow copy"

Trying to delete the snapshots using vssadmin from the command prompt threw this error: “Error: Snapshots were found, but they were outside of your allowed context.  Try removing them with the backup application which created them.”

So the question is what is causing 1000’s of VSS (volume shadow copy) snapshots to be created? A clue was found in the system event log when Windows Server Backups runs: “Failed to delete the shadow copy (VSS snapshot) set with id '1A1938A0-1590-4BF4-8173-20DF5FD69E36' in the running virtual machine 'MGT01': Unspecified error (0x80004005). (Virtual machine ID A3F941F1-ED7F-48E9-9CD7-CB7C28A6604A)”

We’re using Windows Server Backup (WSB) to take incremental backups every 30 minutes for a bare metal restore of the host and its Virtual Machines. That’s 48 backups a day of 14 VHDs for 42 days that the servers have been running for. Do the maths and that comes to 28,000 VSS snapshots. Taking into account that some backups failed to run and we stopped backups for a few hours here and there, this tallies with the 24,000 devices I counted in the registry. Bingo!

So the bottom line is that the VSS writer creates a snapshot for each VHD at backup time but for some reason isn’t deleting the entries from the registry, although it is deleting the actual snapshots otherwise we’d have run out of disk space by now. Everything points to a bug in either the VSS writer or perhaps WSB or Hyper-V. They’re so tightly integrated during the backup process it’s hard to say which of the 3 is the culprit.

Since this problem is reoccurring on two new servers from Dell we are sure this isn’t a one-off freak incident. There is only 1 other similar incident reported on the web and that was a year ago on a HP server using BackupExec with the Hyper-V aware option. I’m waiting for Microsoft to get back to me, although I’ve been warned that even if they admit it’s a bug it could take a long time to produce a fix. We’d love to know why 1000’s of people who use Hyper-V and take frequent backups aren’t experiencing the same problem. There is no other software installed on the host apart from standard Dell drivers. Weird!

CF Admin SQL injection flaw

Nathan Mische has blogged about a surprising ‘flaw’ in the ColdFusion Administrator that’s supposed to allow you to disable SQL commands coming from CF such as delete, drop, alter, update, etc. Apparently this is ineffective against multi-line SQL injection attacks – the most common sort of injection.

Perhaps ‘flaw’ is the wrong word, but these settings do lead you to believe that any sql with delete, drop, etc in it would be prevented from being sent to the database.

The bottom line is to always use cfqueryparam or stored procedures and sanitise user input from forms and urls. Don’t trust users – assume they’re all up to no good! ;-)

ColdFusion 9 is out. Upgrade? Not this time.

After nearly a year of alpha and beta testing the latest release has hit the streets. It’s available to download as a 30 day trial or as a free developer edition (limited to 2 IP addresses as per usual). The new features are listed on the Adobe site.

The license has changed for the better which allows you to run the full version of CF on your development and test environments for free providing you’ve bought a new CF9 license for your production environment. Therefore if you were previously limiting your dev and test systems to 2 pesky IPs you can lift that restriction, but the new license only applies to CF9, it cannot be retrospectively applied if you own CF8 and earlier editions. Well done Adobe!

The question everyone is asking is shall I upgrade our existing servers to CF9? I made the decision a while ago to skip this edition. You have to ask yourself what business benefits it will bring to the table and if that will enhance your apps sufficiently to pay for itself. Here’s my take on the new features. Obviously it’s different for every app and every business, but needless to say our new apps being launched in the months to come will be using CF9, but our existing ones will not.

• cfspreadsheet: Let’s you read from Excel files and update them too. Good if you work with xls files. I can see benefits for intranet apps. Previously to create xls files you had to create data as an HTML table but CF8 was unable to read or update existing Excel created files.
  
• Word to PDF: I really like this conversion facility but it does not officially support Office 2007 or 2010 docx files which is somewhat of an oversight. However, it will make a reasonable attempt at converting them but chokes on the more elaborate docx files as explained in this blog. OpenOffice needs to be installed for this feature to work. (While OpenOffice is free I’m not comfortable installing a bloaty desktop app onto production servers)
  
• ColdFusion as a service: Access CF features such as cfhart, cfdocument, cfimages, etc, as a web service. Perfect for offloading tasks to other servers or opening up CF features to .NET or PHP apps.
  
• Adobe AIR database synchronisation: If you’re into AIR this sounds like a useful addition.
  
• Virtual file system: Save files to RAM as if it were an ordinary hard drive. Good if you have a load of files that need to be regularly written to or read from or if your network drives are already a bottleneck for performance. Don’t forget all files in the virtual file system are wiped when the server is rebooted or crashes.
  
• Integration with CF Builder: If you’ve tried the beta of Builder (the new IDE from Adobe) then it will work better if you have CF9. I don’t like Builder. Sorry. I wish they had enhanced Dreamweaver instead because I also need access to design tools as well as coding tools, plus DW has a very good GUI.
  
• ORM: It sounds clever – CF will interface with your database without having to write a single line of SQL. Admittedly I haven’t got into this too deeply but I fail to see how it can write SQL as intelligently as a human or work with the many complexities of our stored procedures and data intricacies. I like to know exactly what’s happening at the CF<>SQL layer so ORM would worry me. Maybe ORM is for non-enterprise apps and RAD? I’m sure someone will enlighten me.
  
• New AJAX controls: I have a real problem  with this. Why are Adobe wasting their time adding a CF layer for JavaScript when the JavaScript library becomes outdated within a matter of months? If developers use a highly flexible JavaScript framework such as jQuery (which is really easy to learn and oh so sexy) then they can always keep their apps up to date with the latest features instead of having to wait a year or two for the next CF update (which also updates the built-in Ext JS library). jQuery is less bloaty and give developers much finer control over ajaxy things, ready-to-go menus, slick UI panels and interactive data tables etc.
  
• SharePoint integration: This is fantastic if your business or client uses SharePoint. It makes it so much easier for CF apps to take part or become the hub of new SharePoint apps. My biggest client has made a massive move to SharePoint which would have got me excited if they hadn’t banished all non-Microsoft technology from their organisation. Doh.
  
• Server Manager: Administrate multiple CF servers from a central console. Very useful if you have a large server farm or regularly tinker with the Administrator on a couple of servers. Definitely good for rolling out new CF servers. Otherwise check out Merlin, an AIR based administrator for managing multiple servers running CF 7, 8 or 9.
  
• Enhanced Flash Remoting: Never used Flash Remoting or Flex, I am not a Flash developer as I find using DHTML/jQuery fast and effective for enhancing the user experience, but obviously this is welcomed by those who use Flash Remoting. (I wonder what percentage of CF developers do use it?)
  
• Speed enhancements: Other blogs have run tests to show that CF9 is faster than CF8. So if your current server is under strain maybe you can buy it some breathing room by upgrading? But realistically, new server hardware may be cheaper than a CF upgrade and if your server is 3+ years old a new Intel 55xx based server could quadruple your server’s speed and/or capacity. (We’re going down the hardware upgrade route)
  
• 64 bit Edition for CF Standard: Yay!
  
• Cache enhancements: The popular Ehcache technology is now integrated into CF. Rob Brooks-Bilson talks about this in detail over 4 blog entries so I’ll leave him to explain since he’s done such a fantastic job. Part 1. Part 2. Part 3. Part 4.

Finally, Adobe have produced a useful product matrix showing the differences between CF7, 8 and 9 for both Standard and Enterprise editions of each version.

Validity – flexible jQuery form validation

I was looking for a form validation plugin for jQuery that offers enough flexibility to hook in to my own rather complex forms and existing JavaScript. After auditioning several plugins I came across Validity which has seriously impressed me.

Validity, by Wyatt Allen, offers the key following features:

1. Built-in validators for email, number, url, date, range, length, etc.
2. Equal(), distinct(), sum(), etc, methods for advance validation.
3. Use jQuery selectors to create rules for which fields to validate and compare.
4. Easily extendable using your own regular expressions or js functions.
5. Fully chainable validation. e.g. $("#lastname").require().minLength(2).maxLength(40).nonHtml();
6. Optionally provide your own validation error messages.
7. Multiple validation error display modes: Creates neat arrowed validation messages by each field with an error, or Modal mode, or Summary mode, or create your own! e.g. javascript text based alert, or outline error fields in red, or display errors at top of page, etc.
8. Automatically picks up the name of each form field or use a friendly name with the title attribute. e.g. <input type=”text” id=”firstname” title=”First Name”>
9. Validity can intercept the submit button or be called when you want it to (if you use ajax for example).
10. Only 9KB in size

Some example uses:

$("#title").require().minLength(25).maxLength(250);
The title field is required, min char length is 25 and max length is 250.

$("#duration").require().match("integer").range(1,400);
The duration field is required, must be an integer, and numbers from 1 to 400.

$("#email,#email_confirm").require().match('email').maxLength(70).equal("Email addresses do not match");
Applies to both the email and email confirmation fields, both required, must be a valid email address up to 70 chars, and must be equal to each other. My own error message will be shown if they are not equal.

$("#postcode").require().match(/^([a-z][a-z]?\d\d? ?\d[a-z][a-z])$/i,"Postcode is invalid");
The postcode field is required and must match my own regex for UK postcode validation and will display my own message if it’s invalid.

Here’s the documentation with a couple of little demos. The home page is here and you can download the plugin from Google Code.

Well done Wyatt, this is a brilliantly thought out plugin leaving ample room for developers to customise their own validators, messages, and display rendering. Perfect! :-)

Windows 7 Annoyances & Backups

Up until now Windows 7 was just running on my laptop, a non-critical machine I use to run presentations on. Now that the final code is available to developers and my shiny new Intel SSD “G2” drive has arrived I thought it was a perfect opportunity to upgrade my main desktop PC to Windows 7.

It was a fresh install using the new SSD drive. It took 4 attempts before I had a stable install; the installer hung once, after one successful install the drive refused to boot up, the “repair Windows” option failed, yadda yadaa. 24 hours after it all appears to be working my fingers are still crossed.

Now, onto the issue of this post. When I shut down my PC at night I want to carry on working where I left off the following day – at least I want all the folders to be open up at the same place. Therefore, on XP I had both these options checked in Tools/Folder Options: “Restore previous folder windows at login” and “remember each folder’s view settings”. Windows XP obeyed this command like a faithful dog, but Windows 7 doesn’t play ball. On rebooting it opens all my previous windows on top of each other, in a pile. What a mess! I then spend a minute rearranging them all, dragging them to their correct position and resizing them to how they should be. What a pain!

Furthermore, Windows 7 forgets they layout options for each window. The option “remember each folder’s view settings” that was in XP is missing in 7! A couple of my windows list files that I frequently access so I don’t want to see the navigation pane, just the file list. I use another window for managing files so I always want the navigation pane displayed. XP obliges by 7 is so stupid it can only remember 1 folder setting and applies it to all of them, so on reboot the windows are either all with navigation panes or without, not the customised mixture that XP used to respect.

For those reasons I find Windows 7 very frustrating. Someone suggested using hibernate or suspend instead of shutting down. That may be okay if Windows doesn’t refuse to recover from hibernation, but it shows an error on resume and reboots.

Remembering folder views and locations is a very, very simple function for an OS but Windows 7 has taken a huge leap backwards here. It does not compute. Windows 7 has been given the memory of a goldfish.

Backups – Aargh!

I want to back up my C (boot) drive which is 80GB onto an external 200GB drive. No, it can’t do that because Windows has decided that the backup has to include my D drive which is a massive 1TB internal drive. What? I can’t back up my boot drive because Windows insists that the D drive is also included? How stupid is that. I do not want to back up my entire 1TB “D” drive, just the critical C drive.

Admittedly I have installed non-essential apps onto the D drive such as Firefox, Visio and Dreamweaver, plus I changed the location of My Documents from the C drive to the D drives to save disk space on the precious 80GB SSD. But those files aren’t critical to restoring Windows should the need arrise.

I’m now testing out other backup options. My key requirements are:

• Volume Shadow Copy – so open files can be backed up like Outlook’s .pst files
• Back up specific files from any of my drives without having to backup the entire drive
• Option to back up files into zip files so the backups are completely independent and not proprietary files formats.
• Additionally create an image backup of a drive (to quickly restore my boot drive onto another drive should it die)
• Incremental backups so only changes are backed up on a daily basis
• Windows 7 bit-bit compatible

Cobian Backup has always been perfect for file backups (it’s a brilliant free app) but sadly it’s only a 32 bit app which means it can’t do volume shadow copies on a 64 bit OS – which is what I’m now running to utilise the full 4 GB of ram in my PC.

So I will now evaluate the following free or cheap alternatives:

1. Acronis True Image Home 2009 (commercial, £40/$60, or half price here)
2. GFI Backup Home Edition (free)
3. Macrium Reflect Free Edition (free)
4. Macrium Reflect (commercial, £20/$30)

Acronis is not yet fully Windows 7 compatible which is a shame as it has some very powerful features. GFI Backup sounds great as a file-only backup solution (it doesn’t do drive imaging, same as Cobian Backup). Macrium Reflect (commercial) does both file and disk imaging but backs up to its own proprietary file format.

I think I may use two apps for a separate disk imaging and file backup strategy.

8x ColdFusion Hot Fixes in just 2 weeks!

First there were 7 hot fixes rolled out on the same day on 17th August – all to do with security vulnerabilities. Adobe’s documentation was sparse causing problems and lots of questions to be raised by early adaptors of the hot fixes.

Today, 1st Sep, Cumulative Hot Fix 3 has been released for CF 8.01 that fixes 21 new bugs as well as the fixes contained in the previous 2 cumulative hot fixes. This does not include fixes for the aforementioned 7 security vulnerabilities.

I can’t say I’ve encountered any of the bugs listed for Hot Fix 3 and they’re not security related so we’ll put some thought into whether to deploy it or not as I’m a great believer in “if it ain’t broke, don’t fix it”. Do read through the list of fixes to see if any issues are relevant to you. Maybe some of the descriptions will explain some strange errors you’ve encountered with your apps?

I notice there’s no fix for the mail spool bug I reported over a year ago.

Now, back to the 7 security hot fixes. The original documentation was, let’s face it, terrible. But on 28th Aug Adobe updated the text to make it clear that hot fix 1876 must only be applied if you’re running Apache. Do not apply it if you’re running IIS which is what I did on a test box. Luckily I held back on applying it to the prd servers before receiving confirmation that it’s not for IIS. The test box happily accepted the hot fix anyway and doesn’t seem any the worse for it.

Hot fix 1875 and 1878 are byte for byte absolutely identical which is really weird. Why didn’t Adobe roll them into the same hot fix instead of listing them separately and making people install two hot fix files which are the same in all but file name?