This one I thought was pretty easy if you are a geek. And seeing as my blog is pretty tech related, I figured that a lot of people would get this one. Maybe its just me, but when I see certain encoded lines, I can pretty much guess that they are encoded with base64. Maybe I’ve been around email too long.

So if you took our fabulous line and pasted it into any one of a million base64 decoders out there, you would get the following:

With faith and hope, the dream begins anew

It was also a somewhat recent facebook status of mine. The new cryptogram will be coming out in a few days. Stay tuned!

Without further ado, here is the first cryptogram.

V2l0aCBmYWl0aCBhbmQgaG9wZSwgdGhlIGRyZWFtIGJlZ2lucyBhbmV3

Good luck!

For each cryptogram, the solution will be posted the following Monday.

Update: Answers are posted on Wednesday, not Mondays.

Today was another day for battle. And an interesting battle it was.

So here is the situation that I was running into. Within my code in the customer portal, I have a notification that is sent out that has a full back trace of what happened on the system, what was inputted and what was the error message that was returned. I of coarse try to give the user a friendly version of the error message to the screen before sending off this plethora of valuable detail. Out of this pile of data, I find the following error message has been returned:

“A device attached to the system is not functioning”

Really? Let’s look at that again. Because surely no one in their right mind would return such a generic error!

“A device attached to the system is not functioning”

Hmm, my clue-by-four hasn’t been brought out recently and plane tickets to Redmond aren’t that expensive right now. I guess I could go out there and start handing out clues. But why would I need to. This error message is clear and concise. A device attached to the system is not functioning. What more could I possibly need from this error message. It gives me everything I want! There’s a device, its one of 30 or so devices in the system, that is not functioning.

HOW ABOUT WHICH DEVICE YOU FUCKTARDS!!!!!!!

So we check out the domain controllers, the MPS servers, the web servers, OCS pools, exchange queues, look at SCOM alerts. Nothing pops out at us. Then I take a look a bit further at the error message. here is the full error message that I get back:


Server was unable to process request. ---> Unable to create 'cn=user@domain.com'./A device attached to the system is not functioning. (Exception from HRESULT: 0x8007001F)/Create Object -- ><response><errorContext description="Unable to create'cn=user@domain.com'./Adevice attached to the system is not functioning. (Exception from HRESULT: 0x8007001F)/Create Object" code="0x8007001f" executeSeqNo="58"><errorSourcenamespace="Error Provider" procedure="SetError"/><errorSourcenamespace="Managed_Active_Directory" procedure="RethrowError_"/><errorSourcenamespace="Managed_Active_Directory"procedure="TryCreateSamObject_"/><errorSourcenamespace="Managed_Active_Directory"
procedure="CreateSamObject_"/><errorSourcenamespace="Managed_Active_Directory" procedure="CreateUser_"/><errorSourcenamespace="Managed_Active_Directory" procedure="CreateUser"/><errorSourcenamespace="Hosted Active Directory"procedure="CreateUser"/></errorContext></response>


The CreateSamObject_ raised a red flag to two. If you search Google long enough you’ll eventually find something from MSDN stating the following:

From MSDN:

User account names are limited to 20 characters and group names are limited to 256 characters. In addition, account names cannot be terminated by a period and they cannot include commas or any of the following printable characters: “, /, \, [, ], :, |, <, >, +, =, ;, ?, *. Names also cannot include characters in the range 1-31, which are nonprintable

Eureka! We have found the issue!!!

The sAMAccountName for our system is pretty generic. Cut down the upn to 16 characters. Add a period and a unique key that we keep for each of our domain names. This way, the chances of you duplicating names both inside and outside of your OU is pretty limited. However, in this case there was an error with retrieving the unique 3 letter key for the end of the name so the sAMAccountName that we were attempting to set looked something like this:

<property name='sAMAccountName' >
<value>user_domain.</value>
</property&gt

This was an easy fix once we found the issue. But man, could there be a crappier error message from HMC? I mean seriously, how do you get from unable to create the sAMAccountName to a device attached to the system is not functioning?!?!?

Anyway, I figured that I would type this up, let the search engines find it and hopefully someone else can benefit from our digging through the depths of HMC.

Background
A long time ago, we had a very crappy provisioning system for our hosted Exchange 2003 platform. It worked ok, but missed a lot of things that we wanted to have set. They also were kind of pricks when it came to licensing so making a ton of money on the platform was hard to do. So, we decided to roll our own. It wasn’t that hard to reverse engineer what was being set for users, groups and contacts. There were a few obstacles of coarse but we were able to get a pretty good provisioning system setup. However, this too had its faults. Sure we had total control over the code and could update things as we needed. But we were still working in a void. We really didn’t know _everything_ that was happening on the system that needed to actually happen. Plain and simple, we were missing things. Not to mention future services would require the same amount of dev time reverse engineering what needed to be set. That’s not a scalable solution.

So, when it came time to roll out our Exchange 2007 environment, we have moved over to HMC and for the most part, things have been a lot happier.

The Issue
Since we have this shiny new 2007 platform, we thought it was in our best interest to start migrating our users from the 2003 platform and away from the old clunky provisioning. So far we have moved some smaller customers and everything has gone pretty smooth. Certain customers have required the migration to happen in stages so we have come up with a decent solution to make this as smooth as possible. We define the list of users to migrate, setup a temporary domain on the 2003 platform, add smtp aliases to the users on the 2007 platform and then enable forwarding on the 2003 platform to the 2007 temporary smtp alias. All mail still flows as it did before, its just that some users happen to be on the 2007 platform getting their email. Easy as can be right?

Well, the users that we have moved so far have been fairly small customers. So the need for automating certain aspects of the move have been put off. There is a lot of automation that happens, but some of the tasks were put off such as the setting of the forwarding address.

That is, until last week. Last week we were starting to move one of the bigger customers so I setup a script that would take the users that were being moved and automatically set the forwarding address. Here is the code that I had in place to figure out the forwarding address:

// need to add forwarding address here.
list($tuname, $tdmn) = explode("@", $user['mail']);
// new address
$fwd = "{$tuname}@{$newdomain}\n";

Notice the $fwd variable. This is where the trouble begins. You can ignore the {} as those simply tell the parser that these are valid variables contained within the string.

No, the real issue is at the end of the line. Specifically, the \n. Technically, you can set the AD object to whatever you want. It will take this as a value. However, Exchange does not like this. With forwarding in exchange, you set the forwarding to an object. Typically another user, group of contact. Since we allow for users to forward to multiple people, we create a group automatically and populate that with one or more users, groups or contacts.

Now for the really bad part. I’m not sure if this is just Exchange 2003 or if others are affected as well. But when you forward to a group that contains a single contact object that has invalid characters, your email message with be lost in the ether. Gone, Kaput, Not even an NDR will be generated. We were unable to even find logs that the message came in it failed that spectacularly.

Conclusion
So the moral of the story is, don’t do what we did. Microsoft will tell you the exact same thing. Its dumb to do what we did. You should not be messing with the AD attributes directly in this instance. There is a certain level of error checking that must take place at the upper levels which were missed by both my script, and the provisioning system. But in the same breath, I can’t say for sure that HMC was mature enough to use when we first rolled out the 2003 platform. So whether it is you editing AD directly or someone else doing it, its just as bad. It just depends on how much control you want over the gun pointed at your head.

Various automation scripts have been put in place that make it easy for the user to see who has BlackBerry enabled for their account, add additional users and so on. Today, we discovered a rather annoying feature that exposed a bug in our code. Not a horrible bug, but one that did affect the user and their experience with the customer portal.

Here is the basics of the bug. We use the BESUserAdminClient.exe program with the find option to find users. We then search the results for something along the lines of “(bar@domain.com) 1 results found.” Unfortunately, we were getting false positives on our searches. bar@domain.com does not exist on our BES system. However, foobar@domain.com does. So if you search for bar@domain.com, what you are really search for is *bar@domain.com* I can’t say the last wild card is there, but the first definitely is.

What we found was that in order to improve our search, we needed to add a -v flag to the search string. That returned our “(bar@domain.com) 1 results found.” as before. But this time we found the results also returns a CSV result that had a whole bunch of information such as: “User name,MailBoxDN,ServerDN,PIN,Device Type,State,Message Server,Forwarded,Sent,Pending,Filtered,Expired,….” This also exposed that the result that we were getting was actually foobar@domain.com!

The solution was to now search the verbose (-v) results for SMTP:user@domain.com and we would now get the desired result back. We would no longer find foobar@domain.com when we really wanted to see if bar@domain.com exists.

I can’t really call this a bug per se. But I consider it an over site in the documentation of the function. It would be nice if there was a flag that I could pass it that would force it to only search for bar@domain.com and NOT *bar@domain.com*

In her latest post, she talks about writing a plugin for Django. If you are unfamiliar with django, it is a web framework written in python which loosely follows the model-view-controller design pattern (source).

Before I go on trashing the comments in the post, I’d like to note, I’m not a django developer and never have been. But I think that my overall points come back to good design and practices.

Ok, May I direct your attention to this comment made by Leah.

Let’s take the only advantage first, “can update on the fly, no server restart”. This is a web framework correct? Why the hell are you restarting!?!?! I’m clearly missing something here but for all the web apps that I have created, a restart isn’t required. A reload of my web browser is, but I’ve never had to restart my application or web server. I’m really not sure what she is referring to here exactly so I’m guessing I’m missing something major here. Maybe the application she is developing for requires an application server that needs to be restarted in which case it would make sense. But for some reason, I’m not thinking that is the case. Someone please explain this one to me in the comments.

In the disadvantages of using a DB, I have a big problem with #1, “slooooow”. If your database is slow, it is usually one of four issues:

1. Bad Code/Database Design – This is usually where people screw up. Maybe they have never run an application where there are several million inserts in a day. Or maybe they’ve never seen the affects of table vs row level locking on updates. Maybe they don’t understand why their query doesn’t match any of the indexes that they have setup. The developer may not understand what an index even is! This is why developers and DBAs need to be on the same page in the database / code design. Even if you don’t have a DBA, there are plenty of web sites out there that can help you figure out how to tune your application and find slow points in your database code.
2. Improper Database Tuning – This is where a skilled DBA can save your ass. If you don’t have one on staff, contract this out. There are consultants out there that are worth it. Find a good one, pay him his price and you will be amazed at what they can do. If you happen to have a development crew that is fanatical on code optimization and speed, they will probably make up for having a DBA on staff. But it never hurts even to bring a DBA in for a day or two, have him look at the DB, make some suggestions and turn it into a training session to help your developers grow.
3. Database Load – Let’s face it, some databases are very large and have grown to the point where it is time to expand the design.
4. Slow/Old DB Server – At a certain point, its not worth your time to spend weeks tweaking every query on a server that is 2-3 years old. Throw new hardware at it and let the improvements there increase your performance.

I don’t really have a major issue with the rest of her list, they all seem to be fairly logical. But I just didn’t understand the advantages fully and the first disadvantage, well, as you can tell it drove me up the freaking wall. If the database is slow, there is a good reason for it all of which are fixable.

Now, with all that being said, I do kind of agree with her. IF the data is not going to change, why store it in a database. Having a flat config file is not the end of the world people. Its fast, saves a query, and never changes! But that last part is pretty critical. If the data may expand which very well could in this instance, it proabably makes sense to put it in the database even though it doesn’t fully seem like it needs to go there. if you have your database design in order, you should be fine and never notice a performance hit getting this data.

Here’s the run down of the list.

1. Edit two or more parts of a document at the same time.
2. Use OpenOffice.org to open legacy documents.
3. Play a vintage Space Invaders game.
4. Turn off the blinking light bulb.
5. Save files in Office formats by default.
6. Automate actions easily.
7. Fix those single quotes.

Looking through the list, #1 seems like a good one, #2 is very useful when digging through old files, #3 wait…what the f*ck?!?

Why is #3 there? Why is that released code? I know that some developers think it is cute to hide easter eggs in their code. I’m not one of them. I believe that code should be lightening fast and this extra crap just annoys the crap out of me. You’re taking up hard drive space and resources. Oh sure, everyone has several terabytes of data on their PCs…not true jackass!

OpenOffice needs to be a serious tool and start leading the word processing, excel, presentation fight. Apple is making a good stab at the Microsoft juggernaut. But the OpenOffice developers need to cut out the crap, optimize the hell out of their code and start kicking ass and taking names!

This attribute specifies the different options that are enabled for the user or contact object. This attribute is a bit-mask value of type integer. Each option is represented by a bit. This attribute is marked for Global Catalog replication.

source

Unfortunately, in my searching I found not only the technet article, but I also found this

Here a sample of some of the code that you’ll find….

if strOptionFlag = "" then
objUser.Put "msRTCSIP-OptionFlags", "16"

‘If user not enabled then do not enable OCS
if strOptionFlag = "0" then
objUser.Put "msRTCSIP-OptionFlags", "0"
‘If user is enabled for Public IM then keep Public IM enabled and enable RCC
elseif strOptionFlag = "1" then
objUser.Put "msRTCSIP-OptionFlags", "257"
‘If user is enabled for RCC then keep RCC enabled and enable Enhanced Presence
elseif strOptionFlag = "16" then
objUser.Put "msRTCSIP-OptionFlags", "272"
‘If user is enabled for RCC and Public IM then keep RCC & PIM enabled and enable Enhanced Presence
elseif strOptionFlag = "17" then
objUser.Put "msRTCSIP-OptionFlags", "273"
‘If user is already enabled for RCC and Enhanced Presence then keep settings
elseif strOptionFlag = "272" then
objUser.Put "msRTCSIP-OptionFlags", "272"
‘If user is already enabled for RCC, PIM and Enhanced Presence then keep settings
elseif strOptionFlag = "273" then
objUser.Put "msRTCSIP-OptionFlags", "273"
end if
end if

All I have to say is wow! You’ve got to be freaking kidding me. Are there programmers out there that don’t understand what a bitfield is supposed to be or how to do bitwise operations? That’s like the first freaking class in a Computer Science degree. This is where you learn about Big 0, Binary numbers, loops, variables. If you are a programmer reading this blog and you don’t know what a bit field is and how to us it. Google it, read up, and rid the world of ugly ass code like what I found above.

Now technically what this person is doing would “work” since it is setting the integer with an appropriate number. But wow is this the WRONG way to do it. I’m afraid to see this persons code for when they need to check and see if the RCC bit is set for the user. Technically, they should be able to do a simple bitwise operation and check it something along the lines of:

if(($msRTCSIP-OptionFlags & 0x0010) != 0)
{
// RCC is set
}

I have a feeling that this person is doing for the following:

if(value == 273)
{
X is set
Y is set
Z is set
}
else if(value == 257)
{
Y is set
Z is set
}

This is a very simplistic psuedo-code example. But wow…I’m still in shock that this type of code is out there…and posted somewhat recently in October of 2008!

I really hope I run into this guy some day so I can beat him with the clue-by-4.

I’ve had a few issues with it and various hoops that I have had to jump through. Many of which I have not had a chance to document on this blog. Those will hopefully come out in the coming months.

Today, I was dealing with a speed issue that we have been having in our customer portal that hits HMC. The page is pretty basic, it gives a listing of all the users, the name, login address, what package they are assigned and then some actions that can be taken on the user such as edit, delete, disable. This is all in house code that shows this information with calls being made to HMC to get the data.

Unfortunately, I made a mistake in my initial development. Originally, I got a listing of all the users and had 90% of the information that I needed. Another call was needed to get the assigned package for each user. If you have 5-10 users, this isn’t a huge deal. Try it with 100, or 1000. It gets really ugly really fast.

On one particular customer that I was looking at, they have 120 users. Their page was loading in 41 seconds. 41 freaking seconds!!! 7 seconds for the AD search to grab the users with mailboxes. Then somewhere between .1 and .3 seconds per user to equal 34 seconds of the page load.

The solution, remove the package display code.

What? But doesn’t the user want to see this data?!?! Maybe. But seeing as they have to go to the edit page anyway to change the package, it really isn’t needed on the account listing page. So why display it there. It slows down the user experience which is more of a negative than having it on the page.

It wasn’t an easy decision to remove this information. I thought of a whole bunch of ways where I could tuck that data away so I could grab it more efficiently. But in the end, less is less. Removing that data cleaned up the look of the page and vastly improved the load times. Its only been in the wild for a for hours so we’ll see what the users have to say about the change.

This worked out for a while and I had a pretty basic CMS built that I could plug in where needed. But, as with everything, the feature set that I needed kept growing and I was pretty short on time to implement the features that I needed.

To solve this, I started looking at the various blogging engines that were out there. The one that seemed the easiest to pick up, was pretty popular, and had a ton of plugins for the things that I was looking for was Wordpress.

As a blog engine, it does great! It is actually what is powering the site that you are reading now. As a CMS, it does OK. I can create static pages, setup some assemlance of structure with sub pages and decent navigation. There are a ton of themes out there and a lot of people have tutorials that can tell you how to hack them up to make them look the way that you want. But there is one major thing that is bugging me. The code!

Seriously, have you looked at it? Maybe I’m anal retentive. But there is html and PHP mixed together all over the place. The code looks like it tries to implement some sort of MVC where the view is in the theme. But good god, do not go looking through that pile of poo.

Here is an example of what I am talking about:

I couldn’t even do that big of a snippet due to all the hell it causes when you post wordpress code on a wordpress site. But the <?php ?> tags are scattered all over the code base. Its a royal mess.

What Wordpress needs to do is come up with some sort of code standard or guideline. Then reject anything that doesn’t meet that criteria that they have linked up on their site. This is a full review of all the plugins and themes that they have.

Yes, I’m serious about this!

It will take a long time to do. It will take a lot of man hours to complete. But in the long run, the code will be easier to maintain, extend, and quickly allow users to join the rank and file wordpress developers. It will also allow the hacks out there to become better programmers. Which is something that the code base desperately needs.