Posts Tagged

critical

A large – but manageable – February Patch Tuesday brings critical browser updates

With 99 reported vulnerabilities and patches to both Microsoft browsers, Office and Windows, this month’s Patch Tuesday update is not as large an administrative burden as you might initially think. We’ve rated the browser updates as a “Patch Now” update due to issues with the Chakra engine, but both Office and Windows can be scheduled according to a regular patch cadence. Unfortunately, we have another Adobe Flash update to deploy, but no critical development updates for February.

You can find more information in our helpful infographic here.

Known issues

Each month, Microsoft includes a list of known issues that relate to the operating system and platforms included in this update cycle. I have referenced a few key issues that relate to the latest builds from Microsoft including:

  • Microsoft Cluster Shared Volumes (CSV) can still generate the error message,” “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).” Microsoft is still working on a solution. Until a fix is released, you can try the operation as an administrator or try to “own” directories in question before the operation.
  • After installing some Asian language packs you may still (see KB4493509) receive the error, “0x800f0982 – PSFX_E_MATCHING_COMPONENT_NOT_FOUND.”

Microsoft has been working on a fix for both these issues for a while now; we don’t expect a resolution any time soon.

Major revisions

This month, two CVEs have undergone a major revision increment:

  • CVE-2019-1332: CVE information revised to announce the availability of Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (CU) and Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR).
  • CVE-2019-8267: Microsoft revised this to include Internet Explorer 11 installed on all supported editions of Windows 10 Version 1809, Windows Server 2019, Windows 10 Version 1903, and Windows 10 Version 1909 because they are affected by this vulnerability. This change may affect your server update cycle

Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings:

  • Browsers (Microsoft IE and Edge)
  • Microsoft Windows (both desktop and server)
  • Microsoft Office (Including Web Apps and Exchange)
  • Microsoft Development platforms ( ASP.NET Core, .NET Core and Chakra Core)
  • Cloud and Devices
  • Adobe Flash Player (to be discontinued)

Browsers

Microsoft has released nine updates to both browsers (Internet Explorer and Edge) this month, with five rated as critical, two as moderate and the remaining two as important. The biggest concerns are the four critical updates to the Chakra core scripting engine that could lead to remote code execution.

Microsoft advises that these four critical vulnerabilities could lead to a scenario where “An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”

Add this update to your “Patch Now” schedule.

Microsoft Windows

Ok, this may sound like a lot of updates: Microsoft has released 79 patches to the Windows desktop and server ecosystem. Five of these updates are rated as critical and the rest are all rated as important by Microsoft. It sounds (and feels) like a lot of patches, but other than the critical updates to the Remote Desktop (RDP) platform, the administrative burden is not that great.

This patch cycle feels more like an administrative cycle than that one that addresses critical or exploited vulnerabilities. It’s “clean-up” time for Microsoft after the Christmas break and a very light January patch cycle.

Add these updates to your standard release schedule. 

Microsoft Office

Microsoft has released six updates to Microsoft Office – all rated as important. The most serious for this month affects Microsoft Excel with a potential (but difficult-to-exploit) remote code execution scenario involving how Excel handles objects in memory. All of this month’s reported vulnerabilities require access to the target system and require users to take explicit action on vulnerable systems. There is an update this month to Microsoft SharePoint server which will require a reboot of all affected servers.

Add these Office patches to your regularly scheduled updates

Microsoft development platforms

This month, Microsoft has not released any updates to the many variations of .NET, but we do have one update to SQL Server that has been rated as important. CVE-2020-0618 is relatively difficult to exploit, as it requires access to the SQL server instance and requires specially crafted pages sent to the SQL Server Reporting services.

Add this update to your regularly scheduled patch release cadences.

Cloud and Devices

We have allocated this space to the recent cloud (Azure) and device updates from Microsoft. This month, Microsoft has not released any Azure related patches, but has published a Microsoft Surface (device level) patch (CVE-2020-0702) that has been rated as important (and difficult to exploit).

Add this device related update to your regular patch cycle.

Adobe Flash Player

I thought that we were done with critical Adobe Flash Player updates from Microsoft. I even instructed our development team to remove this section from our internal bulletins. Well, they (Flash Player) updates are back, with a vengeance.

This month, we see another ActiveX flaw in Flash Player (ADV20003/CVE-2020-3757) that could lead to the execution of arbitrary code on the compromised computer. According to the Adobe security bulletin, “The vulnerability exists due to a type confusion error when processing Flash content. A remote attacker can create a specially crafted .SWF file, trick the victim into playing it, trigger a type confusion error and execute arbitrary code on the target system. Successful exploitation of this vulnerability may result in complete compromise of the target system.”

Microsoft has documented a potential work-around relating to the Flash ActiveX control which includes making the following registry changes:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{D27CDB6E-AE6D-11CF-96B8-444553540000}]

“Compatibility Flags”=dword:00000400

[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftInternet ExplorerActiveX Compatibility{D27CDB6E-AE6D-11CF-96B8-444553540000}]

“Compatibility Flags”=dword:00000400

Add this update to your “Patch Now” release schedule.

Copyright © 2020 IDG Communications, Inc.



Source link

Critical updates to Excel and publicly disclosed exploits make for an urgent November Patch Tuesday

It doesn’t always take the drama of a zero-day vulnerability like we saw in September to get our attention. Make no mistake: This is still a really big update for the Windows platform. Two vulnerabilities deserve our attention. The first (CVE-2019-1429) relates to a vulnerability in the Microsoft Script Engine which has been reported as publicly exploited. And the second, (CVE-2019-1457)  is a publicly reported exploit in Microsoft Excel. We also think that the critical update to Exchange Server (CVE-2019-1373) will require immediate attention.

Though we are getting some pretty urgent patching requirements for older builds (especially Windows 7), Microsoft appears to have learnt from past lessons, as most later builds are largely immune to these attacks. This has two real benefits. First, having more secure systems is generally a good thing. Second, the IT department doesn’t have to rush out urgent fixes and can take the time to properly test and stage their desktop and server platform changes. You can find out more with our helpful infographic found here.

Known issues

Microsoft has documented a few known issues for this November Patch Tuesday, which we have broken down into two sections including:

Office update issues:

  • 4484113: After installing this update, you may see a “File failed to upload” error when saving files to a network location. To fix this issue, install KB 3085368
  • 4523171: Exchange services may remain in a disabled state after you install this security update. This condition does not indicate that the update is not installed correctly. This condition may occur if the service control scripts experience a problem when they try to return Exchange services to their usual state.

Windows 10 and Server 2019:

  • 4523205: There are a number of issues relating to Input Method Editors (IME) and Asian language packages for the Server installation process. For more information on these issues please refer to KB4026923.

Also, we are still seeing reports of the following error message: “Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”. Microsoft has been working on this issue for four months now, and there is no fix expected soon.

Major revisions

No major Microsoft update revisions (at the time of writing) have been published.

Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings:

  • Browsers (Microsoft IE and Edge)
  • Microsoft Windows (both desktop and server)
  • Microsoft Office (Including Web Apps and Exchange)
  • Microsoft Development platforms ( NET Core, .NET Core and Chakra Core)
  • Adobe Flash Player

Browsers

The core Microsoft Scripting Engine (including VBScript) appears to be the concern this month, with the three critical rated patches (CVE-2019-1429, CVE-2019-1390 and CVE-2019-1427) and three other patches rates as important. For the past few years, we have seen too many patches to both Scripting engines – most leading to relatively exploitable remote code execution scenarios. Unfortunately, this month there has been reports of a Microsoft Script engine vulnerability exploited in the wild (CVE-2019-1429) and that like the other related vulnerabilities could lead to arbitrary code execution in the user’s security context. There is even an ActiveX web-based attack for this vulnerability , which I thought was not really “allowed” anymore. Add these Microsoft browser updates to your “Patch Now” release cycle.

Windows

Make no mistake, this is a big update for the Microsoft Windows platform, with 57 patches, six rated as critical. The six critical patches could lead to a remote code execution scenario, with Microsoft’s Hyper-V virtualization platform receiving the most attention this month. Given our experience with these types of updates in the past, we believe that the Windows font library patch (CVE-2019-1441) could be a likely candidate for potential application compatibility issues. If you are running Windows 7, this is a Patch Now update. If you are running Windows 10 (preferably later than 1803) then there are significant changes to the Hyper-V platform that will require testing. Schedule this Windows update, with a staggered release schedule for your Windows 10 desktops.

Microsoft Office

This is an unusual month for Microsoft Office updates. As usual, Microsoft has released (this month – nine) updates for Office that affect Exchange Server, Excel and Office Online. As usual, there are a number of Spoofing (CVE-2019-1445 and CVE-2019-1447) and Security Feature Bypass vulnerabilities (CVE-2019-1442 and CVE-2019-1449) addressed in the monthly security roll-up. Unusually, there has been a publicly reported exploit for Excel (CVE-2019-1457) that though difficult to exploit, an attacker can still rely on non-secure Excel macros and the fact that users will still download and open Excel files sent to them from strangers. As a result of this, please add this month’s Microsoft Office update to your “Patch Now” release cycle.

Development tools

This is a relatively quiet month for Microsoft developer tools updates with just two patches (CVE-2019-1370 and CVE-2019-1425), both rated as important by Microsoft. Affecting the open source Open Enclave SDK toolkit and Visual Studio, these two vulnerabilities may lead to an elevation of privilege security issue. Fortunately, the Visual Studio vulnerability has already been separately addressed by two NPM advisories: Arbitrary File Overwrite and the fstream version. Add this update to your regular developer update schedule.

Adobe

No Adobe updates for this month. If this continues into January, we will remove this section from our updates going forwards. But for now, it’s Margarita time.

This article is published as part of the IDG Contributor Network. Want to Join?

Copyright © 2019 IDG Communications, Inc.



Source link

A troubled update to critical browser patches for October Patch Tuesday

It was all going so well. We had a few months of updates that both rapidly and readily addressed security issues without many problems. This October Patch Tuesday is an important but troubled patch release from Microsoft. We have a critical, out-of-band browser update (CVE-2019-1367) that has been widely reported as causing a number of deployment issues. Our advice this month is to wait, test and stage your patch deployments. The only good news here, is that we are not all rushing around trying to extinguish another “screaming-hair-on-fire” Adobe issue. We have outlined this month’s key issues in an infographic for this October Patch Tuesday, found here.

Known issues

This section addresses the known issues from the previous month’s patch cycle, as well as outstanding issues that may persist with older builds of Windows desktop and server platforms.

Last month’s update appeared to be generally problem free, but it appears that a few reported problems were sufficient for Microsoft to respond with an update to previous patches to resolve the following issues:

  • The Keyboard Lockdown Subsystem that may not filter key input correctly.
  • An issue that prevents netdom.exe from displaying the new ticket-granting ticket (TGT) delegation bit for the display or query mode.
  • The security bulletin CVE-2019-1318 that may cause client or server computers that don’t support Extended Master Secret (EMS) RFC 7627 to have increased connection latency and CPU utilization. This issue occurs while performing full Transport Layer Security (TLS) handshake from devices that don’t support EMS, especially on servers.
  • Applications and printer drivers that utilize the Windows JavaScript engine (jscript.dll) for processing print jobs may fail to behave as expected.

And, if you are on Windows 10 builds older than release 1803, then you may also have the following issue with this months’ October update:

  • Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”. This occurs when you perform an operation on a CSV owner node from a process that doesn’t have administrator privilege.

Microsoft has published a handy guide to all known issues for this patch release here: Security update deployment information. In another shining endorsement of the success of Windows 10, Release 1903, there are currently no known (reported) issues with any of the current updates. All previous versions of Windows have issues with updates to both Internet Explorer (IE) and Microsoft Edge.

Major revisions

The following updates were made to existing patches over the past month (patch cycle):

  • CVE-2019-1192 | Microsoft Browsers Security Feature Bypass Vulnerability. This update is an attempt by Microsoft to comprehensively address CVE-2019-1192. Microsoft has released October 2019 security updates for Microsoft Edge installed on supported editions of Windows 10; for Internet Explorer 11 installed on all affected versions of Window 10. This is an update to the August Patch Tuesday update cycle. The rating from Microsoft remains as important.
  • CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. The October security updates Microsoft is releasing on October 8, 2019, address a known printing issue customer might have experienced after installing any of the Security Updates, IE Cumulative Updates, or Monthly Rollups that were released on September 23 or October 3. This is still a critical update.

Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings:

  • Browsers (Microsoft IE and Edge)
  • Microsoft Windows (both desktop and server)
  • Microsoft Office (Including Web Apps and Exchange)
  • Microsoft Development platforms ( NET Core, .NET Core and Chakra Core)
  • Adobe Flash Player

Browsers

Microsoft has released ten updates to both browsers this month, with five rated as critical by Microsoft affecting the Chakra, JavaScript and VBScript engine. If we only had to discuss these patches, then we would have an easy job this month, with a standard schedule for releasing browser patches. However, Microsoft released an out-of-band (OOB) patch to IE in an attempt to resolve a reported vulnerability in the IE script engine (CVE-2019-1367). It’s a proper zero-day issue, with wide reports of exploitation that only require a visit to a specially crafted webpage. It’s a bad one.

This patch is causing problems. We have seen reports of printers not working (Kyocera’s in particular), difficult to troubleshoot line-of-business (LOB) application scenarios and problems with JavaScript scripts (referencing JSCRIPT.DLL). This OOB update caught us all by surprise and I feel at this time that Microsoft could have provided some more documentation in advance. After working with our team, we don’t have a simple prescriptive next step for this update. This does not happen that often. I think that each organization needs to assess the risks of not deploying this update with risks to core applications, and possible (and likely) printing issues. Our advice: test your core applications, test all your printers, and then stage a measured roll-out on a departmental basis.

Windows

Microsoft has released 38 patches to the Windows platform this month, with two rated as critical (CVE-2019-1060, CVE-2019-1333) and a critical servicing stack advisory (ADV990001). Again, we are seeing updates to familiar windows components: Microsoft JET Engine, RDP, HTTP, APPX, GDI and XML Core Services. This month the servicing stack updates include fixes to resolve:

  • a problem with the Secure Boot revocation list (DBX) update experience to avoid multiple restarts when you deploy the DBX update on a device where the Credential Guard service is not running.
  • an issue in which the Secure Boot revocation list (DBX) is not applied when the Secure Boot allow list (DB) update is empty.

With reported problems with Cortana, printing issues, difficult Jscript troubleshooting scenarios or problems with rebooting, this large complex update will require extensive testing. We suggest that most organizations WAIT for a few more days, find out where the troublespots are, and then test extensively before a general deployment.

Microsoft Office

This month’s update brings several updates to Microsoft SharePoint Server with six updates rated as important for Microsoft Office applications. The most serious vulnerabilities relate to a remote code execution scenario in Microsoft Excel 2016. Both CVE-2019-1327 and CVE-2019-1331 are included in a single update that can be found here. As a word of warning, the SharePoint server updates (addressing an XSS issue) cannot be uninstalled. Make a backup of your server before this update. Add these updates (both desktop and server platforms) to your standard, scheduled update release schedule

Development tools

With this update cycle, we are still seeing updates to the Chakra engine, but few patches to core development platforms such as .NET. For October, Microsoft has released a critical update for its Azure App Service (please sanitize your inputs) and two important updates (CVE-2019-1313, CVE-2019-1376) to the SQL Server Management studio (SSMS). I remember a time, when the SSMS was a major management interface and routinely updated. It gets a lot less attention now, and I believe it’s because of the general move to the cloud for many corporate databases. Add the SSMS update to your scheduled update cycle. You don’t have a choice with the Azure platform. Microsoft will handle all these required changes.

In addition to the regular Patch Tuesday security related updates, the Microsoft .NET framework receives regular maintenance updates. For this October, Microsoft has not released any security updates for the .NET platform, but there are bug fixes released for .NET including:

  • Windows 10 1903 and Windows Server, version 1903 (4524100)
  • .NET Framework 3.5, 4.8 (4515871)
  • Windows 10 1809 (October 2018 Update) Windows Server 2019 (4524099)
  • .NET Framework 3.5, 4.7.2 (4515855)
  • .NET Framework 3.5, 4.8 (4515843)

I think that this is the first time that we have a Microsoft update to an open source project with a patch to the Open Enclave project to address an information disclosure issue (CVE-2019-1369). If you would like to read more about this, you can check out the post from Mark Russinovich on the confidential computing consortium. All these changes will require extensive testing, and so add these patches to your standard development release schedule.

Adobe

Adobe has not released any updates for Windows this month. This is good news and it’s now a few months since we saw any updates for Flash or Reader. If this is a trend, it is very welcome. As you don’t have to update Adobe this month, we suggest that you have a margarita.

This article is published as part of the IDG Contributor Network. Want to Join?

Copyright © 2019 IDG Communications, Inc.



Source link

9 critical questions about Microsoft’s first Android phone

Well, gang, it’s finally happened: Hell has officially frozen over.

Didja hear about this? Microsoft, the company announced last week, is making its own Android phone. Let me rephrase that: Microsoft, the once-mortal-nemesis of Google, is building a phone running Google’s operating system. Microsoft, the tech giant that tried and failed to claim its piece of the mobile ecosystem pie with Windows Mobile, is now staking its mobile future entirely on its competitor’s platform.

Man. What a world we live in.

Now, to be fair, Microsoft’s basically been building its own ecosystem within Android for a while already: After years of providing only sparse, subpar versions of its programs for Android, the MS crew started taking Android seriously a few years back. And boy howdy, was that one heck of a shift.

Nowadays, Microsoft maintains a sprawling suite of commendable Android apps — everything from its own custom-made home screen launcher to a popular third-party keyboard it snatched up and then slowly but surely started to, uh, Microsoft-ify. At this point, all it takes is a handful of downloads and a teensy bit of planning to create a complete Microsoft experience within any Android phone.

But that’s the catch: The phone isn’t Microsoft’s — and that means the hardware and the core software experience remain outside of Microsoft’s control. With the newly announced Surface Duo, the company seems determined to take things up a notch and correct that small but significant limitation.

And the craziest part of all? The Surface Duo (which Microsoft insists shouldn’t be categorized as a “phone,” but, I mean, c’mon) isn’t just your run-of-the-mill rectangular Android device. It sports two side-by-side screens that are connected by a thin hinge and able to fold 180 degrees in either direction. It’s a pretty bold gamble for Microsoft to make — one that could either pay off enormously or cause the company to fall flat on its face once more.

Since the Duo isn’t expected to ship until next year’s holiday season, we’re left with some pretty big questions about how exactly it’ll work and what sort of value it will (or won’t) provide. Specifically, as I’ve been chewing over the news and letting it marinate over these past several days, I’ve found myself coming back to the same set of burning questions — the answers to which could collectively determine the fate of both the phone itself and its greater impact on Android.

Think ’em through with me, won’t ya?

1. How much will the Surface Duo cost?

Part of Microsoft’s hesitance to frame the Surface Duo as a phone may come down to the fact that the company’s hoping to avoid positioning the gadget as Just Another Android Smartphone™ and instead have it be seen as a brand new, one-of-a-kind mobile productivity system.

Why? It’s simple: By downplaying the “Android phone” angle and focusing on the “Surface computer” notion, Microsoft can — in theory — set its device apart from the pack and allow it to exist in a category of its own. The company’s explanation of the positioning pretty much spells it out:

“Surface has always been about creating and redefining categories; this is another example of that,” a Microsoft spokesperson told me via email. “Sure, it makes phone calls, but it does much more than that. It’s a dual-screen Surface that fits in your pocket, bringing together the best of Microsoft productivity experiences, Android apps, and Surface hardware design into a single device you can take anywhere.”

See what I mean? And this almost certainly isn’t just about marketing, either; after all, if the Surface Duo isn’t, in Microsoft’s reckoning, a phone, it doesn’t necessarily have to be priced like one.

So there’s our first question: Just how high of a price of this thing gonna command? Microsoft’s positioning of the product as an on-the-go productivity computer for business-minded individuals — not to mention its emphasis on the fact that the (ahem) phone has two 5.6-in. displays that fold out into what’s effectively an 8.3-in. screen — makes me think the cost may be closer to the $2,000 tag of Samsung’s silly Galaxy Fold than the $1,000-ish price of a typical high-end flagship phone.

Will people be willing to pay that much for a product like this? Should they be?

2. How many apps will fully support the Duo’s dual-screen setup?

A key selling point of the Surface Duo’s unusual form is the fact that you can — in theory — use apps across the device’s two screens in some pretty interesting ways. The Duo will supposedly let you drag content from an app on one screen into an app on the other, stretch a single app across both of the screens, and move an app from one screen to the other in a way that feels seamless and natural.

And a key difference between the Surface Duo and earlier Android phones that have attempted this two-screen concept — aside from what appears to be just a better hardware implementation — is the fact that Android 10 actually lays the foundation for this sort of thing to happen on the operating system level. The feature was originally described as being about support for foldables, but its core concept is something Google calls “app continuity.” That really just means it’s a framework for developers to make their apps support a phone with multiple screen areas and be able to exist across those areas sensibly.

Still, it’s up to app developers to implement support for that feature — and we all know how slow and unreliable Android app developers often are to come around to those sorts of standards. Especially given the fact that the number of devices taking advantage of foldable screens or multiple screens are presumably gonna be miniscule for the foreseeable future, will all the cool trickery Microsoft showed off in its Surface Duo demo actually work on any broad level?

If that sort of dual-screen harmony exists only for Microsoft’s own apps and a small handful of others, the Surface Duo’s appeal suddenly becomes significantly less strong.

And speaking of which….

3. What’ll happen with apps that don’t have proper dual-screen support?

No matter how good of a job Microsoft (or Google) does in convincing developers to get ahead of the game and invest resources in creating dual-screen-optimized app experiences, it’s inevitable that a fair number of Android apps are not gonna support the setup by the time the Duo launches.

So what happens when you use what I guess we could call a “legacy app” — one whose developer hasn’t updated its code in order to explicitly support the two-screen configuration? Will there be some sort of reasonably elegant fallback system in place for those instances, or will it be painfully clunky, confusing, and awkward when you try to drag a non-optimized app from one screen to another or try to drag content from a properly optimized app into a legacy holdout?

The answer to that question should tell us volumes about what the real-world Duo-using experience will be like.

4. How advantageous will the whole dual-screen thing really be, anyway?

The entire Surface Duo proposition hinges on the idea that having a dual-screen phone and being able to interact with apps across those two screens is going to be legitimately advantageous and something you’ll actually work into your regular phone-using routine. But once you get past the initial novelty of carrying around a device like this, is that benefit even something you’d tap into and appreciate all that frequently?

I mean, think about it: As it stands now, most of us tend to do little odds and ends on our smartphones and then save the most intensive work for when we’re back at our laptops or desktop computers — right? Will having the ability to stretch (some) apps out to a larger size and to more easily run multiple apps side by side, with dragging and dropping as an option, really be all that compelling in a handheld-device form? How often will you do anything with that setup that you couldn’t accomplish just as easily with the already-pretty-big screen on your regular smartphone — or that you wouldn’t still prefer to hang onto and handle once you’re back at a full-sized computer?

Microsoft Surface Duo (inside) Microsoft

Are two screens really better than one?

Microsoft is clearly banking on the answer being “enough to make it seem worthwhile,” but until we’re able to spend time with this thing in the real world and get past that new-gadget-smell period, we won’t truly know what type of genuine value the form will or won’t offer in day-to-day life.

5. Will using the Duo feel more like a Microsoft experience? Or will it still be Google-centric?

In general, Google keeps a fairly tight grip on Android. Companies that develop devices with Google’s Android software and its full suite of accompanying services have a laundry list of requirements to contend with, not least of which is the emphasis on a Google account for signing in and syncing and the placement of Google services all throughout the operating system.

More than any other Android-device-creating company, though, Microsoft has its own legitimately thriving ecosystem of competing services. Microsoft users are accustomed to signing in with their Microsoft accounts and accessing their Microsoft apps for things like email and office work.

So will the Surface Duo live within the standard Android parameters, where the Microsoft layer is forced to exist within the Google universe — meaning you’ll have to first sign into the phone with Google and then sign in separately with Microsoft? (Awkward.) Will you end up with warring factions of productivity apps angling for your attention? (Unpleasant.) Or will Microsoft, given its clout and the number of business folk it could conceivably bring into the fold, strike some sort of deal for an unprecedented exception that’d let it claim some manner of autonomy over its environment?

The idea of that happening goes against everything Android represents to Google, on the surface, but this is also Microsoft we’re talking about here — so who knows? If Google were ever to bend its rules in any way, this could be the time and place it happens.

The logical next question, then:

6. What will Microsoft’s Android software experience be like?

We’ve seen Microsoft’s take on the Android home screen, courtesy of the company’s surprisingly decent Microsoft Launcher app — but when the company has complete control over the look and feel of the phone’s software, how far will it go?

Will we see an LG-reminiscent take on Android, with ample change for the sake of change and a misguided emphasis on “differentiation” through arbitrary interface meddling? Will Microsoft try to give Android a Windows-like appearance in terms of its menus and other core elements, in order to create consistency across its own various products? Or will the company stick reasonably close to the Android standard and just add in some subtle visual touches to make the software feel less like Google’s and more like its own?

Only time will tell the answer — along with the answer of what the ultimate result will be like to use and whether it ends up being an asset or a liability of the Duo device.

And on a not-entirely-unrelated note…

7. How will Microsoft do with software updates?

This one’s incredibly important, especially for a company like Microsoft: Other than Google, as we’ve discussed approximately 7.4 gazillion times over the years, almost every Android manufacturer is embarrassingly bad about providing timely and ongoing operating system updates to its devices. It’s a problem that never seems to get any better, despite Google’s best attempts to make the upgrade delivery process easier and less resource-intensive.

If any other company were to have the drive and ability to match Google’s software support standard, Microsoft sure seems like it’d be it. Microsoft is laser-focused on the enterprise market and on winning over the trust of serious business users, and no serious business user should be using a phone with software that’s months out of date. Microsoft, of all entities, is keenly aware of this.

So will Microsoft manage to send out both security patches and OS updates as quickly as Google does? Will it do so for a full three years, like Google alone does right now with its Pixel devices? Could it exceed that and set a whole new standard for the platform? Or will it fall into the patterns of other Android device-makers who focus on short-term hardware sales over long-term satisfaction?

More than any other question on this list, this is one I’m eager to see answered.

8. Will the Duo’s single-camera setup be a limitation?

Microsoft may be positioning the Surface Duo as a business-aimed productivity device, but let’s not kid ourselves: Every mobile device nowadays does double-duty and also addresses our personal needs, at least to some degree. And there’s nowhere that’s more apparent than in the realm of mobile photography.

Whether a phone is primarily intended for personal use or for business, most of us expect to be able to whip the thing out at a moment’s notice and snap a good-lookin’ photo in just the right moment. And on the Surface Duo shown off at Microsoft’s event, the phone sports only a single camera — one that resides inside the device, after you open it up.

Microsoft Surface Duo (outside) Microsoft

The Duo’s exterior has no camera. Will that be a problem?

Questions about photo quality aside, how problematic will it be to have to pull your phone out of your pocket and then open it up and flip it over before being able to take a photo? Microsoft has said the device’s hardware is essentially complete at this point and shouldn’t change between now and the Duo’s launch, so this is presumably the same camera arrangement we’ll see when the thing actually goes on sale.

And finally…

9. Will the Surface Duo be an anomaly, or will other companies follow suit?

While Microsoft’s been developing the Duo (a process the company says has been underway for three years, incidentally — and that some recently surfaced concepts indicate has been rolling around on a theoretical level for even longer), other Android device-makers have had their focus on vaguely similar devices with screens that actually fold instead of having a thin hinge between ’em.

Those devices, suffice it to say, have thus far been overridden with asterisks and hardly advisable for anyone to purchase. And based on everything we’re seeing at this point, Microsoft’s small-hinged dual-screen arrangement seems like it could (could) be a much more practical and sensible take on the same basic concept.

So will the Surface Duo kick off a whole new category of mobile devices? Will other companies eventually follow suit and try to create their own similar products? Or will the Duo remain a niche-appeal anomaly — another funky form experiment that ends up offering limited practical appeal?

The answer to this last question will ultimately depend upon the answers to the eight previous inquiries in this list. They’re all answers we’re unlikely to know for several more months yet — but the realities they represent are well worth contemplating as we think through Microsoft’s Android gamble and work to wrap our heads around what’s on the way.

For now, we can say one thing with near-100-percent certainty: Android hardware is about to get really interesting — and whether Microsoft’s first self-made effort ends up being a breakthrough or a bust, the innovation and investment it represents within this platform can only benefit us all in the end.

Sign up for my weekly newsletter to get more practical tips, personal recommendations, and plain-English perspective on the news that matters.

AI Newsletter

[Android Intelligence videos at Computerworld]

Copyright © 2019 IDG Communications, Inc.





Source link

Cameyo: Fixing the Chromebook app critical path problem

Several times a quarter, the same question comes up regarding Chromebooks, usually phrased as to whether or not they’re successful. What made the platform interesting was that even though Google typically has the attention span of a 4-year-old on sugar, they stuck with this platform. But it still mostly flies under the radar – largely because of the lack of native application support and Google’s reputation. Google sells information for a living, making people distrust the brand even…though there’s no evidence Google is compromising the privacy of Chromebook users.

The promise of the Chromebook has been compelling to mostly education buyers. However, interest appeared to fall off sharply as Google waffled on operating system futures (whether they would merge Android and Chrome operating systems) and native application support continued to favor the alternative (Android) platform and, of course, Windows.

Cloud-based solutions from firms like Citrix and VMware increased the cost of their deployments significantly and often, more than offsetting the cost advantages – and Chromebooks largely remained a niche product performing well below their apparent potential.

I recently took a briefing from a relatively young, internally funded company that appears to have a far-cheaper alternative to the existing cloud solutions. And while Cameyo is limited by their size and reach, they do have a solution I think is worth checking out. With the coming of both G5 and Wi-Fi 6, the performance problems associated with running applications in the cloud largely go away so if you can get the cost down for cloud deployments. And Chromebooks would seem to immediately become more attractive.

Cameyo: A more cost-effective desktop virtualization solution

Cameyo’s sustaining advantage is that they are far less complex and far less expensive than alternatives appear to be. In addressing whether a claim like this is true for a small company, I had to rely on reference accounts, and Cameyo provided four of them.

Since Chromebooks have been somewhat successful in education, I’m starting with the education reference. Homer School District had the common problem of what to do with legacy Windows apps when they migrated to Chromebooks. They had to maintain a large (700 PC) stable of outdated (mostly over 8-year-old) PCs that needed to be replaced and the District wanted to go with Chromebooks but couldn’t because they had four apps that had critical dependencies, were unique, and updating and migrating the apps was too expensive.

They wanted to use Google’s cloud, not unusual for a Chromebook deployment and needed a firm that was integrated with the Google cloud solution. The Cameyo solution allowed the school to eliminate a $35K lab that took 80 hours to set up and to move to Chromebooks more effectively. They report full investment recovery in two months largely due to the reduction of related costs.

This is an interesting company in that it provides software for a large number of spas and salons nationwide. The use of a common software solution is common in many industries, including food services (fast food and restaurants), automotive (dealerships), retailers, and entertainment outlets (movie theaters, etc.).

As with most of these industries, the goal is to provide a low maintenance computer solution, like a Chromebook, with a centralized hosted solution that has little or no local maintenance or overhead.

But the ProSolution solution was client-based and to turn it into something that was designed for the cloud was going to cost them between $3 and $5M and take 12-18 months (and of these projects ever fall within budget because folks like to make last-minute changes). They had an even bigger concern; one of their competitors had tried to make this jump and failed miserably. They wanted their product, which worked fine, to work from the web; they didn’t want to create a new app.

They tried RDP but had issues with phones and tablets and found the Cameyo solution met their needs. It was simple, inexpensive, and fast which is what they wanted.

This is an electrical contractor company servicing the Chicago metropolitan (Chicagoland) area region. They had an interesting problem they were using QuickBooks Enterprise, which they liked, but wanted a cloud-based solution. QuickBooks Online didn’t meet their needs, and a hosted version of QuickBooks enterprise cost $150 per user per month, and they had a lot of users.

It still didn’t make economic sense to use Cameyo for QuickBooks Enterprise, but they discovered they could update a large number of apps and streamline their deployments. The added benefit is where they used to have a laptop to access these critical apps, they now can access them with a browser from any device that runs one. Cost for the solution was fully offset by licensing savings, and they got the added benefit of greater mobility.

CompuGroup Medical (CGM)

This organization is a massive eHealth provider covering 400K hospitals and insurers. Unfortunately, this case wasn’t complete as of this writing but will represent what appears to be Cameyo’s largest deployment to date.

The answer you’re looking for?

Often when looking at thin client deployments which are interesting again thanks to the interest in Chromebooks the cost of the solution is the deal killer. Cameyo, based on a case review, for the right kind of customer, maybe a way to offset this and basically have your Windows apps and your appliance like hardware too. While I ran into this solution looking for a lower cost Chromebook option it should work on anything with a standards based full feature browser making it useful for those that need something that is more mobile as well.

If you’ve been struggling with converting to a more aggressively cloud-based alternative to your current desktop deployment check out Cameyo. They are small, but that typically means you’ll get more of their attention. In any case, if a few apps are preventing your tablet, smartphone, or Chromebook deployment, they might have the answer you needed. Best of luck!

This article is published as part of the IDG Contributor Network. Want to Join?

Copyright © 2019 IDG Communications, Inc.



Source link