“Huge Web hack attack infects 500,000 pages - Microsoft's IIS Web server may be to blame, says researcher” read the headlines today.

But it looks like he’s jumped the gun with his finger pointing…  This particular attack like so many before it (but admittedly at a much higher scale than many previous attempts) is due to a compromise known as a SQL Injection Attack.

The vulnerability is due to poorly-written SQL code that does not properly examine user input from a Web page form and allows commands to be “injected” and execute directly against the database with the same privileges as the sites own code.

What scares the heck out of me though is it’s spread to half a million pages already (though one attack targeted at, say, a shopping site with 10,000 pages would rack up a pretty big number very quickly!) because it implies a lot of fairly sloppy code is in production and not being maintained very well.

This attack – typical symptoms include pages with the code <script src=http://www.nihaorr1.com/1.js> embedded somewhere on them – is particularly neat because it’s self contained… the server is hit with a modified URL, the code is injected and updates the server all in one hit (so very hard to look out for and track). Older injection attacks normally looked for a vulnerability and then came back to exploit it.

The researcher in question seems to have jumped to a conclusion looking for some sensational PR coverage – which does make me a little skeptical about any claims they make around the level of protection they can offer ;) SQL Injection attacks are equally likely for MySQL, Oracle, SQL Server or any other database if the queries you feed to them are not sanitized. It’s not a new problem, and there has been good advice around for a long time to help developers avoid the problem.

The Register has a good write-up outlining the scale of the problem, and how hard it’s going to be to clean up…

One thing that it does go to prove though is that for users you can’t really trust anywhere you visit on the web – there’s always a risk than an attack will find a way to compromise a page you think is safe. If you don’t keep your system up to date with security patches for your client operating system, and run current anti-virus / anti-malware / anti-spyware (call it what you will) then you’re taking more risks than you need to. Personally I’m a fan of OneCare but NOD32 is another really good package. If you don’t want to pay a few bucks for insurance AVG Free does a really good job.

Update Apr 27: Read the update from the Microsoft Security Response Center on this issue, some recommendations on how to avoid SQL Injection attacks and some more handy tips from Bill Staples (the head of the IIS team, so he should know what he’s talking about). Also if you want a good background on why security matters and should be part of the initial design, not some random after thought you should read this blog.

I've been using SQL in various forms for 20 years a very long time but I still don't consider myself to be a particular export. I've found out the hard way some pretty handy performance guidelines and helped folks over little hurdles but I love it when I'm trying to sort out a problem and discover something I didn't know (but it's probably really obvious if only I ever read a manual!)

Todays little challenge was fun. I wanted to display all records in a table where we recorded a total vote and the number of votes in descending order of average vote.

The problem was I needed to calculate that average (total vote divided by number of votes) but some of the rows had not received any votes so the result would be a divide by zero error.

The solution turned out to be a CASE statement inside the SELECT. I've used COALESCE before to zero out a null column in a query but this is so handy I wish I'd known about it before!

So, an example of using the case statement in a query to solve my problem. The rate_total and rate_vote_count columns are both integer in the database so I needed to cast them to decimal firstly so the math would return a decimal and then truncate as I only cared about one decimal place.

My query ended up something like this:

SELECT     rate_id, CAST(CAST(rate_total AS decimal(8, 1)) / 
        CASE WHEN rate_vote_count = 0 THEN 1 ELSE rate_vote_count END
        AS decimal(2, 1))  AS rate_avg
FROM         upload_rate WITH (nolock)
ORDER BY rate_avg DESC

It's not the pretties code by any stretch of the imagination but the magic is on the second line....

if the rate_vote_count is zero then the CASE returns 1 (to avoid a divide by zero error, but 0/1 is the same as 0 so the query works as wanted) and if it's 1 or greater than it returns the value in the column enabling the maths to be performed correctly.

Another handy thing to file away

Back in my old life I worked on some projects where getting the best performance out of SQL Server and ASP was pretty critical given the traffic load and the amount of hardware we had (or didn't have) to throw at the problem.

I learnt some pretty rough and ready rules, especially around SQL Optimization, the hard way and I'm always keen to find other resources that help ensure the smoothest end user experience for a web property without throwing unnecessary (and expensive) hardware resources at the problem.

It's nice to be able to learn some lessons from the folks with the biggest problems, especially when there are some nuggets in there that you can apply to sites even way down the scale.

One of my fellow Evangelists has posted a couple of really great case studies on using Visual Studio Team System to test and optimize a couple of sites who really do have to cope with scale in a very big way.

I know a little bit about making SQL work for a dynamic website, but I'm no world renowned expert, so I was really interested to see FrankArr post about a new service called AskaSQLGuru.com.

The concept of this free service is that if you have a SQL Server question simply Skype your question to askasqlguru (or call them on 877.443.3893) and they will create a personalized screencast with an answer to your question.

Check out their blog for some sample screencasts and handy tips, and see why these guys have MVP status.

Because the service pack for SQL 2005 is now available (for testing) that lets it run under Vista I thought it was worth trying this new OS out for real.

So far the experience has been very nice. It's stable, it's visually a huge improvement on previous versions and most of the beta niggles that I was worried about have gone away.

The security stuff is annoying, confirming things several times (but I'd prefer that to getting infected or compromised) and some hardware vendors are not on the ball with hardware/driver support yet but I really notice the improvement when I pick up the old WinXP machine.

It is however not perfect. Although the personal niggles are very minor (and probably won't even get on the radar) they're the sort of thing that I keep noticing.... and I wonder how many others do but don't say anything...

• In IE7 why do I now have to type http:// in front of URLs. In IE6 (and IE7 on WinXP) it's assumed. I like that assumption. I'm sure there's a registry fix or a deeply buried property but I want it really obvious (there's annoying dialogues for everything else to confirm how I want it to behave). Even more annoying is that it's not consistent. Sometimes it's fine. Other times it won't play. I'm starting to suspect it's playing tricks on me ;)
• Also in IE7 why does it have to open separate zones (Internet, Trusted etc) in separate windows. Wouldn't tabs be good enough or doing something graphical to the chrome. If I wanted a dozen windows on my desktop I'd not have been one of the millions yelling for tabbed browsing. I'm sure it's something security related but it annoys me
• Why can't I autohide the sidebar. I can make the taskbar do it (and some would argue that the taskbar is more critical) and it bugs me I can't do the same with the sidebar. Also when I'm running dual monitors why can't it be smart enough to go hang out on the second monitor?
• The snipping tool is great. But why does it snip to bitmaps for the clipboard version - it means when I paste it into Word or Windows Live Writer it's not the most efficient format. Sure I can save it and insert in the target but that's too many steps for me!
• Why no DivX/Xvid codecs out of the box? Especially with Ultimate Vista is supposed to make the whole computing experience easier. There's a whole lot of material out there encoded in formats other than WMV (and we're not just talking BitTorrent and Limewire - I have a bunch of family videos re-encoded as Xvid AVIs). Not including it means users have to venture of into scary backwaters to download packages full of all sorts of unknowns... And it's not just video. WMP11 treats a CD ripped via iTunes (as .m4a) as ascond class "other" media not music - which means playlists area real pain to maintain if you were foolish enough to have used anything but MP3 or WMA as music formats (I know that's not a Vista thing specifically but WMP11 was the first of the "Vista" skinned products to ship so in the mind of a large segment of the audience the two are going to be very much linked)
• On the subject of Codecs... in Enterprise a couple of people I've spoke with (myself included) couldn't play commercial DVDs (get an unexplained "out of memory" error!) but upgrading to Ultimate and all was good
• Why can't I upgrade from a lower version to higher. I went from Enterprise to Ultimate but... as there's no update path I had to rebuild my machine :( If a customer want's to pay some $ to upgrade from a pre-install or corporate version to the best and shiniest it would be nice if the option existed and was pain-free. I thought that's what Anytime Upgrade was all about.
• It annoys me there's no Win+ shortcut to hibernate my machine (or to have the old 'prompt' option in power management for when I hit the power button). There are some really useful Win key combinations (I especially like Win + a number) but a simple Hibernate option isn't to be had. I know I can type Ctrl-Alt-Del, alt-s, h but it's clunky. It's actually going to be better when Sony do ship the Vista drivers - hopefully my laptop hotkeys will then work and I can do it with Fn+F12
• Power Management on my Vaio is a bit of a problem. It eats batteries and gives me pretty much no warning when it's about to hibernate. This is possibly also because of the missing Vaio drivers from Sony. I'm still hoping ;) But I still get better life on my new machine that I do on the previous Vaio (with new non-exploding battery) running WinXP.
• I've still not got Visual Studio and SQL Server 2005 running quite happily on Vista but that's probably user error!

By the way, if the start menu bugs you (and I still remember OS/2 Warp and it's LaunchPad fondly) there's a good app called VistaStartMenu to give you a different feel and way to get programs, settngs and functions.I'm growing to like the new start menu (especially the abiity to search for a program by tapping a few characters of it's name - similar to QuickSilver which I love on OSX, and spotlight which was Apples attempt to make something as clever as QuickSilver) .

Performance in Vista with Aero turned on is pretty good. It feels crisper and slicker than WinXP and I'm not alone in that feeling. 

I'm sure there's going to be more - after all I've only been using it a couple of days - but the interesting thing is that there are incredibly few major issues... everything is pretty much related to my personal way of interacting with the system (which I've often been told is slightly off the curve!) and comparing it to OSX and a WinXP build I've had several years to tweak and customize.

Oh, and please note.... I'm in no way agreeing with this mob. I, like many others, choose to use Vista. A few cosmetic things aside there is nothing intrinsically wrong with Vista as a tool for my day to day use. Certainly nothing that would make OS X or Ubuntu a logical move.

Update: in what's probably the first of many "tweaking Vista" articles, Chris Pirillo has some very good suggestions.

I encountered an interesting problem today. A function that needed to be run on a webserver (as an aspx page) but it did a huge amount of processing based on the users input - lots of file reads and database updates. It was dragging performance on the rest of the site down while it ran.

In a normal scripting environment for a Windows application it's easy - the sleep({seconds to sleep}) command is your friend. But you can't do it in VB.NET for a webpage.

Unless, that is, you have SQL Server 2005 or another database that supports the WAITFOR DELAY {time to delay} command. 

Sub sleep(sec as integer)
Dim con_timeout, sql
    ' indicate a number of seconds, up to 59 
    ' if you need more than 59 seconds, you will need to adjust the SQL below 
    If sec > 59 then
        sec = 10 
    End if
 
    ' make sure timeout doesn't expire!
    ' assumes we have an already active connection to the database called "con"
    con_timeout = con.commandTimeout
    con.commandTimeout = sec + 5 
 
    sql = "WAITFOR DELAY '00:00:" & right("00" & cstr(sec),2) & "'" 
    con.Execute(sql,,129)

    ' put the timeout back
    con.commandTimeout = con_timeout
End Sub

Now the script may take a fair bit longer to operate, but the judicious use of sleep(2) within the more tightly looping and time consuming bits of code means that the server can spare some cycles to answering other demands on it.

Of course, you then need to make sure that your script doesn't timeout, so careful use of Server.ScriptTimeout to balance it is also called for

I encountered an interesting problem today. A function that needed to be run on a webserver (as an aspx page) but it did a huge amount of processing based on the users input - lots of file reads and database updates. It was dragging performance on the rest of the site down while it ran.

In a normal scripting environment for a Windows application it's easy - the sleep({seconds to sleep}) command is your friend. But you can't do it in VB.NET for a webpage.

Unless, that is, you have SQL Server 2005 or another database that supports the WAITFOR DELAY {time to delay} command. 

Sub sleep(sec as integer)
Dim con_timeout, sql
    ' indicate a number of seconds, up to 59 
    ' if you need more than 59 seconds, you will need to adjust the SQL below 
    If sec > 59 then
        sec = 10 
    End if
 
    ' make sure timeout doesn't expire!
    ' assumes we have an already active connection to the database called "con"
    con_timeout = con.commandTimeout
    con.commandTimeout = sec + 5 
 
    sql = "WAITFOR DELAY '00:00:" & right("00" & cstr(sec),2) & "'" 
    con.Execute(sql,,129)

    ' put the timeout back
    con.commandTimeout = con_timeout
End Sub

Now the script may take a fair bit longer to operate, but the judicious use of sleep(2) within the more tightly looping and time consuming bits of code means that the server can spare some cycles to answering other demands on it.

Of course, you then need to make sure that your script doesn't timeout, so careful use of Server.ScriptTimeout to balance it is also called for

There's been a lot of talk about how virtualisation and portable apps are going to change the way that the world works recently. Everywhere I look there are new initiatives and technologies that are going to bring about a revolution in ease of use, safety and stability.

I agree that the wave is coming, but I'm not sure it's here just yet.

I set myself a little challenge. To build a totally portable environment that could live on my iPod and plug into a friends computer, a spare machine at home or an internet cafe and allow me to work as though I was at my desk.

That meant I needed:

• IIS: or similar webserver, capable of delivering ASP.NET 2.0 - so needed all the relevant frameworks etc
• SQL Server 2005: Pretty much any of the editions, as long as it had the management console and was 100% compatible with the features we're using in our live environment
• Development IDE: Visual Studio would be a major bonus, but EditPlus would have cut it.
• Browsers: IE (6 or preferably 7) and Firefox are a must for testing. ideally independent from the host OS so I know what plug-ins and add-ons are in place
• Drawing tool: Designers insist of making me look at graphics. Apparently the world looks prettier in technicolor and with curves. Don't they realise how much overhead that puts on the text! Luckily for y'all I'm in the minority and I bow to Cats wisdom when she tells me that a picture is worth a thousand words (and if I build websites that don't have pictures I won't get paid for those words either!). Luckily for me Paint.Net is simple enough for me to use and good enough to do what needs to be done
• MS Office: Or something 100% equivalent. OpenOffice and Evolution come close but I did say 100% didn't I! Specifically the 2007 B2TR version because I just don't want to go back to its predecessor
• Music player: Because I can't work in silence. Ideally able to access the music stored on the iPod without needing duplication. SongBird, iTunes or WMP are all acceptable for this
• Utilities: Windows Live Writer, Messenger, Skype, Anti virus/spyware to keep the device safe and the ability to connect to the office VPN are all a must for the environment to receive the final tick.

So... how did they do?

The first things to spring to mind where VirtualPC and Parallels. I've used VirtualPC on the Mac before to set up a Windows environment and it was okay. I've also used it for testing on the PC. But VirtualPC and Parallels don't give me a portable environment... I still need to lug the laptop around so they're not contenders for this little challenge. I would have included VMware in the write-off but for the Moka5 tool. But more of that in a moment.

So next I had a look a the mindset leader - U3. And wrote it off (along with PowerToGo and Ceedo) very quickly. Not because it was bad but because most of what I wanted to run wouldn't in that environment (though if you can use the portable versions of OpenOffice, Firefox, Evolution etc they are a perfect answer)

The Linux LiveCDs (and also the BartPE WinXP LiveCD) also didn't make it because the former is Linux and the latter requires a reboot of the host (and being CD based limits me in what I can do/run)

That left me with two contenders. MojoPac and Moka5.

MojoPac has a lot of promise. Works with any USB 2.0 device. Supports most Windows applications. MojoPac works as a new virtual user on the host PC so you use a lot of the underlying PCs functionality (browser, operating system, shared apps etc) but keep your settings and data totally separate. You can also install applications on the MojoPac so they are always available. While it did work fine on my iPod it was very limited. It doesn't support Vista (I know it wasn't a requirement but it's a worry nevertheless), IE7 on the host machine (in fact ever IE6 seemed temperamental) and anything that messes with the OS - including things that need specific services to be running, or to install new services (IIS and SQL have problems there), or that check to see if your copy of windows is valid - WGA won't run (in fact, the entire Windows Update function is unavailable).

After a lot of wasted time I got the .Net 2.0 frameworks, Paint.Net and Office installed. But I was still without a database or a webserver and I was bored of being right on the bleeding edge. Given their claims I thing for a US$30 product (and no early-adopter discounts, life-time licence's etc) it's rather limited. You don't need to buy a Windows licence to use it, but it doesn't offer much over the U3 / Portable Apps type setup for it's price. Maybe by release 2.0 it'll be what I need.

That left me with Moka5. A very interesting idea, and potentially pretty limitless. Moka5 is an extension on the VMware virtualisation player. They allow you to use shared streamed (pre-tested and configured) environments on your local device, storing updates/personal data locally but always having access (assuming you're online) to the latest build of the environment itself. If you're offline a lot you have the ability to cache the environment. You can also build and manage your own environments.

I set up a WinXP Pro environment within the player and fairly quickly was able to install pretty much everything from the list above (I stopped when I'd proved that the hard things worked!) Because it's a virtualisation engine it creates and manages a dedicated stand-alone environment. Just for fun I also created a Ubuntu 6.06 environment on the same iPod so that I could toggle between them. At the moment it still needs a Windows host machine, but as VMware player is cross platform it will be interesting to see if that evolves over time...

The downsides of Moka5 are cost - because it's a full WinXP environment you're into the world of licensing fees which may preclude this option for some. I also found the Windows environment to be very slow (part of the reason for the Ubuntu install was to compare the two) - In Ubuntu the mouse moved fairly smoothly and menus were responsive. With the WinXP virtual machine I often found myself  ducking back to the host to check my email while I waited for something to happen.

So sadly for the moment at least I'm still lugging my laptop. Both Moka5 and MojoPac show great promise for portable developer/testing environments.

MojoPac would also be great for students of people who are able to use Open Source portable apps (but then again they may be better off with a standard USB key and a free portable versions of those Open Source apps).

Moka5 is an awesomely flexible platform. I'll probably keep working on trying to get acceptable performance out of the WinXP install, and I'll certainly keep the Ubuntu installation there for testing.

Both Moka5 and MojoPac are early iterations of this technology and both show great promise. I'll be watching with a keen eye.

What I'd love to see however is something that lets me carry an ultra portable device (either one of the new UMPCs, or a more contemporary replacement for my Vaio C1MT Picturebook, or something the size of my K-Jam that can run WinXP Tablet Edition!) but plug into a network/USB connector/Docking Cradle at home/the office/client site/internet cafe and have the data immediately available on the more powerful machine and carry on working with the resources of both machines at my disposal...

The final irony. The Internet Cafe were I normally testing things like this for real portability have just 'upgraded' their kiosks... they no longer have customer accessible USB ports! Now that's a major crimp in my plans for world domination!

There's been a lot of talk about how virtualisation and portable apps are going to change the way that the world works recently. Everywhere I look there are new initiatives and technologies that are going to bring about a revolution in ease of use, safety and stability.

I agree that the wave is coming, but I'm not sure it's here just yet.

I set myself a little challenge. To build a totally portable environment that could live on my iPod and plug into a friends computer, a spare machine at home or an internet cafe and allow me to work as though I was at my desk.

That meant I needed:

• IIS: or similar webserver, capable of delivering ASP.NET 2.0 - so needed all the relevant frameworks etc
• SQL Server 2005: Pretty much any of the editions, as long as it had the management console and was 100% compatible with the features we're using in our live environment
• Development IDE: Visual Studio would be a major bonus, but EditPlus would have cut it.
• Browsers: IE (6 or preferably 7) and Firefox are a must for testing. ideally independent from the host OS so I know what plug-ins and add-ons are in place
• Drawing tool: Designers insist of making me look at graphics. Apparently the world looks prettier in technicolor and with curves. Don't they realise how much overhead that puts on the text! Luckily for y'all I'm in the minority and I bow to Cats wisdom when she tells me that a picture is worth a thousand words (and if I build websites that don't have pictures I won't get paid for those words either!). Luckily for me Paint.Net is simple enough for me to use and good enough to do what needs to be done
• MS Office: Or something 100% equivalent. OpenOffice and Evolution come close but I did say 100% didn't I! Specifically the 2007 B2TR version because I just don't want to go back to its predecessor
• Music player: Because I can't work in silence. Ideally able to access the music stored on the iPod without needing duplication. SongBird, iTunes or WMP are all acceptable for this
• Utilities: Windows Live Writer, Messenger, Skype, Anti virus/spyware to keep the device safe and the ability to connect to the office VPN are all a must for the environment to receive the final tick.

So... how did they do?

The first things to spring to mind where VirtualPC and Parallels. I've used VirtualPC on the Mac before to set up a Windows environment and it was okay. I've also used it for testing on the PC. But VirtualPC and Parallels don't give me a portable environment... I still need to lug the laptop around so they're not contenders for this little challenge. I would have included VMware in the write-off but for the Moka5 tool. But more of that in a moment.

So next I had a look a the mindset leader - U3. And wrote it off (along with PowerToGo and Ceedo) very quickly. Not because it was bad but because most of what I wanted to run wouldn't in that environment (though if you can use the portable versions of OpenOffice, Firefox, Evolution etc they are a perfect answer)

The Linux LiveCDs (and also the BartPE WinXP LiveCD) also didn't make it because the former is Linux and the latter requires a reboot of the host (and being CD based limits me in what I can do/run)

That left me with two contenders. MojoPac and Moka5.

MojoPac has a lot of promise. Works with any USB 2.0 device. Supports most Windows applications. MojoPac works as a new virtual user on the host PC so you use a lot of the underlying PCs functionality (browser, operating system, shared apps etc) but keep your settings and data totally separate. You can also install applications on the MojoPac so they are always available. While it did work fine on my iPod it was very limited. It doesn't support Vista (I know it wasn't a requirement but it's a worry nevertheless), IE7 on the host machine (in fact ever IE6 seemed temperamental) and anything that messes with the OS - including things that need specific services to be running, or to install new services (IIS and SQL have problems there), or that check to see if your copy of windows is valid - WGA won't run (in fact, the entire Windows Update function is unavailable).

After a lot of wasted time I got the .Net 2.0 frameworks, Paint.Net and Office installed. But I was still without a database or a webserver and I was bored of being right on the bleeding edge. Given their claims I thing for a US$30 product (and no early-adopter discounts, life-time licence's etc) it's rather limited. You don't need to buy a Windows licence to use it, but it doesn't offer much over the U3 / Portable Apps type setup for it's price. Maybe by release 2.0 it'll be what I need.

That left me with Moka5. A very interesting idea, and potentially pretty limitless. Moka5 is an extension on the VMware virtualisation player. They allow you to use shared streamed (pre-tested and configured) environments on your local device, storing updates/personal data locally but always having access (assuming you're online) to the latest build of the environment itself. If you're offline a lot you have the ability to cache the environment. You can also build and manage your own environments.

I set up a WinXP Pro environment within the player and fairly quickly was able to install pretty much everything from the list above (I stopped when I'd proved that the hard things worked!) Because it's a virtualisation engine it creates and manages a dedicated stand-alone environment. Just for fun I also created a Ubuntu 6.06 environment on the same iPod so that I could toggle between them. At the moment it still needs a Windows host machine, but as VMware player is cross platform it will be interesting to see if that evolves over time...

The downsides of Moka5 are cost - because it's a full WinXP environment you're into the world of licensing fees which may preclude this option for some. I also found the Windows environment to be very slow (part of the reason for the Ubuntu install was to compare the two) - In Ubuntu the mouse moved fairly smoothly and menus were responsive. With the WinXP virtual machine I often found myself  ducking back to the host to check my email while I waited for something to happen.

So sadly for the moment at least I'm still lugging my laptop. Both Moka5 and MojoPac show great promise for portable developer/testing environments.

MojoPac would also be great for students of people who are able to use Open Source portable apps (but then again they may be better off with a standard USB key and a free portable versions of those Open Source apps).

Moka5 is an awesomely flexible platform. I'll probably keep working on trying to get acceptable performance out of the WinXP install, and I'll certainly keep the Ubuntu installation there for testing.

Both Moka5 and MojoPac are early iterations of this technology and both show great promise. I'll be watching with a keen eye.

What I'd love to see however is something that lets me carry an ultra portable device (either one of the new UMPCs, or a more contemporary replacement for my Vaio C1MT Picturebook, or something the size of my K-Jam that can run WinXP Tablet Edition!) but plug into a network/USB connector/Docking Cradle at home/the office/client site/internet cafe and have the data immediately available on the more powerful machine and carry on working with the resources of both machines at my disposal...

The final irony. The Internet Cafe were I normally testing things like this for real portability have just 'upgraded' their kiosks... they no longer have customer accessible USB ports! Now that's a major crimp in my plans for world domination!

thanks to a pressing need to re-install my laptop over the weekend I tool some time out for a play with the latest Vista RC2.

(The laptop was just getting sluggish and badly behaved. It's been 18 months since the last total rebuild so it was time to have a 'back to the bone' tidy-up. I'll have to post my essential apps list now it's rebuilt and I've got the things I can't live without up and running - the rebuild and catching up on work has been why posting here has been a little slow)

Anyway, back to Vista.

I'd had a look at some of the pretty early builds and hadn't been totally sold although it looked promising. RC2 is quite a huge leap in both polish and stability and ease of getting it up and running.

I was expecting problems installing on my Vaio VGN-T27GP but with one minor exception I was really pleased with how well it went. The hardware discovery was flawless and much to my amazement on the first run-through on the process everything worked perfectly. Apart from the minor problem that even with the WinXP drivers for the media keys (play/pause, stop, ffwd, rwnd and the volume buttons) I could not get anything apart from the standard keyboard functionality.

Vista setup is a lot slicker than WinXP and it appears a lot of thought has gone into making it easier for a newbie yet powerful enough to keep the tech savvy happy.

I wasn't as happy with the constant prompts to see if I really wanted to do something though. Once I've told the OS that I want to run a program or perform a manually trigger action it should let me save that permission (but that's a niggle I have with Windows Defender - I shouldn't have to approved it every time my backup program runs and re-writes it's registry run key with the last update time.)

It appeared faster than WinXP on my laptop which was interesting. The Vaio doesn't have the grunt to run Aero so I was getting the standard UI experience - but it bodes well for how it will perform on some of the new Vista optimised machines starting to surface. Even so, it looks really pretty. IE, WMP and Office 2007 all blend much better than they do in the current is-it-WinXP-or-Vista design mash-up. Compared to my current MCE rig the new Vista Media Centre interface might take a little getting used to, but I think it'll grow on me. Assuming there's stil any decent free-to-air TV in Australia to care about watching ;)

There's a million reviews out on the web about the good, the bad and the ugly of the Vista UX so I probably don't need to add to the background chatter, apart from mentioning that I really enjoyed it and, but for one thing, am really looking forward to joining the ranks of early adopters.

That one thing is pretty much a show-stopped for me. Until SP2 turns up for SQL Server 2005 I can't run it on Vista. If I'd been able to get it installed and running I'd still have Vista configured as my day-to-day OS and be spending a lot more quality time with it. As it is, Vista has been relegated back to the "to do" list (not enough space on the Vaio for a dual-boot setup - Vista has a much larger default install footprint than WinXP) for the time being.

On, I know I wasn't going to mention specific features but... while I think the Sidebar looks like being a great addition it's a bit sparse at the moment. The CPU meter isn't interactive (I can't get to, say, TaskManager from it), there's no Network meter and handy things like a dockable MSN Live Messenger contact list are missing. I hope that when the real deal comes out there are more gadgets and things like the Outlook 2007 Calendar is integrated with the Vista Calendar and I can tear the To-Do Bar out of Outlook and dock it in the sidebar...