Obscure Windows commands and features

My previous blog post has become quite popular crossing the 10,000 views mark in just a few days. Given such interest I decided to share a few more useful commands as well as some obscure tricks that I came across over the years.

hh.exe - HTML help

hh.exe has been part of Windows for a very long time. What makes it fun though is that it supports external URLs, so we can make calls like this:

hh http:\\google.com    (notice the backslashes)

This made me curious - what is the user agent string for this "browser"? Running it on a Windows 7 machine:

hh http:\\whatismyuseragent.net

Let's just collectively exhale "Wow... IE7" ;)

But what about Windows 10 I hear you ask. There it is:

Same thing - IE7. Of course this is not the real IE7 - Trident/7.0 is a give away. This is IE 11 running in IE7 compatibility mode. But I still find it funny.

mshta.exe exhibits the same behavior except for the old style navigation bar. But I find the retro "IE6 style buttons" look way more amusing.

I mentioned another effect of HH in one of my earlier blog posts - even if you disable Adobe Flash player in your browsers, it will still be there (as demonstrated by opening a web page in HH).

"God mode"

You can create a directory with a specific GUID extension to enable the so-called God Mode. No, you won't get the BFG 9000. Instead, Windows will populate this directory with a LOT of tools and various management options - all in one spot. There will be nothing new that you haven't seen before - just an interesting way of presenting all of these tools in the same place.

To do this - just create a directory with this specific name ("GodMode" part can be anything but the GUID part is important)

md "GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}

Yet another Recycling Bin?

In case one is not enough ;)

md YetAnotherRecycleBin.{645FF040-5081-101B-9F08-00AA002F954E}

Where-ever you create this directory, it will act as a Recycling Bin. It is the existing recycling bin - i.e. if you already had a few deleted files you would be able to see them in the "new" bin too.

View Reliability History

Buried deep inside, the reliability monitor allows you to have a quick look what happened to your system recently that may have a potential impact on system reliability.

To find it - just click Start -> Run -> and type "reliability"
Or you can choose a more convoluted path: go to Contol Panel -> System and Security -> Review your computer's status and resolve issues -> Maintenance

and then click on "View reliability history" (at the bottom of this picture)

This is probably something that you have never used before. And yet it certainly is a useful representation of what happened on this system recently.

Notepad Log

Did you know that notepad can append a date/time every time you open a document? In fact, this feature has been around for a long time but not that many people know about it.

Just create a new text document and put ".LOG" (without the quotation marks) at the top.

Now every time you open this file, you will see a new timestamp automatically added by the notepad.

Stored Credentials (aka Windows Vault)

Run this command:

control keymgr.dll

You will be able to see all currently stored credentials (and perhaps delete the unused or sensitive ones)

You can use a command line equivalent:

cmdkey /list

When was the computer rebooted last time?

Run this command:

net statistics server 

and check the "statistic since <date time>" line

Find which application will open files with a particular file extension

I know that usually people just search through the registry to get this information. But there is a simpler way to achieve this by using 2 commands. First, we can use the ASSOC command to find the current file association for a particular file extension. And then knowing the file association we can feed it into another command FTYPE to display which application handles this association. E.g. let's try to find out which application will open PDF files:

assoc | find "pdf"
ftype AcroExch.Document.2015

Find all CAs (certificate authorities) in your organisation (Active Directory)

certutil has rich functionality. Here I am going to show you how to find all certificate authorities in your organisation:

certutil -ADCA | find "dNSHostName"

Get a list of all domain controllers

nltest is another powerful utility with lots of useful options. E.g. this is how you can quickly find a list of all domain controllers:

nltest /DCLIST:YourOrgDomainName

How to wipe deleted data using the cipher utility?

I will quote this Microsoft KB article:

When you delete files or folders, the data is not initially removed from the hard disk. Instead, the space on the disk that was occupied by the deleted data is "deallocated." After it is deallocated, the space is available for use when new data is written to the disk. Until the space is overwritten, you can recover the deleted data by using a low-level disk editor or data-recovery software.

The built-in cipher utility can be used to wipe data from the deallocated space making it (almost) impossible to recover. Impossible in the general sense. But I said "almost" - because there are special forensic solutions that can potentially recover data that was overwritten even several times.

In order to clean C: drive, first of all quit all programs. Then run this command against any directory on the target (C:) drive - it doesn't matter which directory you choose. Note, it may take a significant amount of time to wipe large disks.

cipher /w:c:\test

Microsoft uses a multipass approach when overwriting data:

Microsoft’s cipher.exe, writes a pass of zeros, a pass of FFs, and a pass of random data, in compliance with DoD standard 5220.22-M. (US DoD, 1995)

I will stop here. Please let me know if you find posts like this one useful and/or informative. As usual, leave your feedback, comments, command examples etc at the bottom.

The best new space exploration movies

Introduction

The reason why I decided to write this blog post is because I have watched the "Hidden Figures" movie. I was so impressed that I decided to spread the word. For those who know me it won't come as a surprise that I love movies about space. The university I graduated from was preparing specialists for the space industry. I have carried this passion for space exploration throughout my whole life. Combine this with the applied maths degree and you can see why the "Hidden Figures" resonated so well. Trajectory calculations, computer programs, solving tricky mathematical tasks - was exactly what we were being prepared for. But, it's not all. Space exploration is one of the pinnacles of our achievements as humanity.

Image source: http://spaceflight.nasa.gov/gallery/images/shuttle/sts-132/html/s132e012208.html

The International Space Station is the most complex machine ever built. Such achievements cannot be built in vacuum (no pun intended). This is like a pyramid. In order to be able to do X, you need to have all necessary capabilities at level (X-1). And for complex areas like space exploration those pyramids are huge. They contain multiples capability layers from numerous industries when combined result in the fascinating and amazing world of space exploration. Countless institutes and universities worked on various projects contributing to this goal. Thousands of people have been involved directly or indirectly. Thanks to these often unknown heroes we've been able to conquer space, put people on the Moon and send probes to visit all planets in our Solar system. The Hidden Figures tells an amazing true story about the crucial contribution of 3 American women (who worked at NASA's Langley research center) to the success of the early space program.

Young people, who haven't figured out yet what they are going to do in life, should watch this movie - especially girls. STEM is not just for the boys. I would like to see more women selecting IT or Space Technology or any other technical discipline as their careers.

Inspired by this movie I decided to compile a list of new space movies. I have to keep it quite broad - some of them will be about the space travel, outer space or space adventures. Others will explore the psychological aspects of traveling in space or aliens visiting Earth. Perhaps you will find something on this list that would pique your interest. So let's call this list - The Best Space Movies 2016-2017

The best space movies

The book - currently #7(!) on Amazon and the movie	"Hidden Figures" PG - 2016 - Drama film/Comedy-drama - 2h 7m IMDb: 7.9/10   Rotten tomatoes:94% Let me start by saying - if you have a teenage daughter take her to the cinema to watch this movie! This is such an empowering story and these 3 ladies are great role models for the younger generation. I even think that this movie or book should be added to the school curriculum. Watching this movie may spark interest in the STEM subjects. The three "hidden figures" - three American women - worked with the first computers in the 1960s. Their work (calculating trajectories) was extremely important for NASA's early spaceflight.
	"Arrival" PG - 2016 - Mystery/Science fiction film - 1h 58m IMDb: 8.2/10   Rotten tomatoes:94% I felt that this movie was like Inception - so deep that you need to watch it several times to understand the multiple intertwined layers to fully understand what the authors wanted to say. I want to believe that we are not alone in the universe. But how will the first contact look like? Will we be able to understand each other? Will we fail and try to use the military force or will we let science build the bridge between the 2 worlds?
	"The Space Between Us" PG-13 - 2017 - Fantasy/Science fiction film - 2h 1m IMDb: 6.1/10   Rotten tomatoes:18% 18% rating from the Rotten Tomatoes or 86% from Google users - who would you trust more? I think the answer depends on the audience. This is a romantic story combined with science fiction. This film won't win any Oscars. Teenagers will like it. More mature audience would probably enjoy other movies from this list more. Abstracting from the cheesy stuff, I like the idea of a first child born on a different planet (Mars). The boy grows up being able to interact with a very small number of people - knowing that there is the parent planet full of people. And inevitably there will be interesting challenges when a teenager boy finally gets to Earth.
	"Passengers" PG-13 - 2016 - Fantasy/Science fiction film - 1h 56m IMDb: 7.1/10   Rotten tomatoes:31% I am puzzled by the low-ish 31% rating from the Rotten Tomatoes. Their audience score of 67% combined with the 7.1 rating from IMDB I think are a better reflection of this movie's quality. Personally I liked it. I love interstellar, space exploration movies. This day will come when our children will launch spaceships to cross the vast emptiness to reach other stars. It was interesting to see some of the engineering aspects of the space flight. Space debris/meteoroid defense, self healing spaceship ability, medical pods... The only reasonable way to spend years in space is hibernation. But what will happen if you wake up way too early? Alone...
	"Rogue One: A Star Wars Story" 2016 - Science fiction film/Action - 2h 13m IMDb: 8.1/10   Rotten tomatoes:85% Judging by the high ratings most people liked it. I must admit - I am not a big Star Wars fan. The first 3 films were great back in the days. But then Stars Wars have become demonstrations of what can be achieved with the latest computer graphics advancements. The Rogue One was not different in my view. It's a prequel to the first 3 movies and it explains certain parts of the overall story. It's fascinating to see how authors/script writers use their imagination and knowledge of the Star Wars universe to connect the new characters and story lines with the existing ones from the previous movies. It's an eye candy for sure - amazing graphics. If you are a Star Wars fan, you would certainly want to have it in your collection. If you are like me, then watching it once would be the right thing to do.

There are also 2 other movies that haven't been released yet, which I would like to share with you. I hope both of them will be exciting to watch.

Courtesy IMDB

"Life" - will be released on the 24th of March 2017 2017 - Fantasy/Science fiction film IMDb:   Rotten tomatoes First evidence of extraterrestrial life on Mars... Research like this is happening right now in the real world. Remember the "follow the water" mantra? Mars orbiters have spotted traces of methane gas. Methane is unstable - it cannot be there for a long time. It needs to be replenished, but where does it come from? Methane can have both geological and biological origins. Courtesy NASA https://www.nasa.gov/jpl/msl/pia19088/ Mars rovers with each generation carry more and more tools including the ones to perform wet chemistry science. They are looking for organic matter, complex molecules and perhaps even simple microbial life. I am excited about the movie that explores this one of the most important space exploration tasks of the 21st century.

Courtesy IMDB

"Valerian and the City of a Thousand Planets" - will be released on the 21st of July 2017 2017 - Science fiction film/Action - 2h 9m IMDb:   Rotten tomatoes 28th century... Time traveling agent... Galactic empire... Based on the French comic series - it's got all the right ingredients to be a great movie. Let's wait and see!

Did you like this list? Have I missed any of the recently released or upcoming movies? Please leave your comments below. Happy watching ;)

Useful Windows Command Line Tricks

Image courtesy https://blogs.msdn.microsoft.com/commandline/

I needed to run a couple of non-trivial commands from the command line recently. And this brought back some memories when I had opportunities to be more hands-on. Like any industry, IT has its own tricks of trade. As we got accustomed to GUI (more on the Windows side than *nix) the art of using command line was getting less relevant and less utilised. Having said that, if you manage larger environments than automation is a must and executing scripts and various commands at scale becomes a necessary skill. In this blog post I decided to share a few interesting and useful commands that I've learnt over the years managing Windows environments. The Internet is full of "Top X cool commands every administrator should know" articles containing some fairly basic recommendations. There is no need to repeat this. I would like to share a few less trivial commands that might make it easier for you to perform certain tasks.

Display Wireless network password in clear text

netsh wlan show profile name=MyWiFiNetwork key=clear

The key=clear parameter gives us an ability to extract a WiFi password from any WiFi network (profile) stored on your computer.

Extract a list of Domain Admin users in the organisation

net group "Domain Admins" /Domain

By default the "Authenticated Users" group has Read access - any authenticated user in the organisation can execute this command to identify which users belong to which group. In the example about I used the Domains Admins group. This type of information is useful for the attackers - it gives them the "juicy targets" - which users to target (phishing, brute forcing etc) to get the domain admin privileges.

Get a list of all users in the domain

net user /Domain

Gives you a long list of all user accounts in the domains. Again, might be useful for the attackers - gives them another piece of a puzzle.

Get computer's IP address

ipconfig|find "IPv4"

This can be done in multiple different ways. Here I wanted to demonstrate the "piping" trick, where a vertical pipe character is used to combine 2 commands. And the trick is that the (standard) output of the first command is used ("piped into") by the second command. In our case the "ipconfig" command displays a lot of information but we use the "find" command to only display lines containing the "IPv4" - this gives us an IP v4 address of the computer.

In addition we can use another trick and push this information straight into the clipboard by piping the output of the "find" command into "clip"

ipconfig|find "IPv4"|clip

Display useful Wireless Network Connection information (WLAN)

netsh wlan show interfaces

netsh is a VERY powerful and useful command. Here we are using it to display information about all existing wireless network interfaces on our computer. This information is very handy when troubleshooting various network related issues.

We can also extract information about the wired interfaces - just replace "wlan" with "lan" in the command: netsh lan show interfaces

Display WiFi SSID

netsh wlan show interfaces|findstr "[^B]SSID"

It's great when commands like the one above dump a lot of useful information. But sometimes you just need this one piece - especially if you are running a batch file and want to identify a specific value. The previous example shows lots of different things including the SSID (wireless network name). If we just need to extract the SSID we can pipe the output into the "findstr" command. I decided to use "findstr" instead of a simpler "find" because it supports regular expressions. The first command displays both SSID and BSSID and I wanted to remove BSSID from the final result.

Get a MAC address

The netsh command that we used above to show interfaces' info can also be used to get the MAC addresses for each interface (disguised as a "Physical Address" in the output). But there is also a simpler command to do this:

getmac

It will display MAC addresses of all network interfaces that are present in the system.

Display system information

The "systeminfo" command contains tons of useful operating system configuration details. Run it without specifying any parameters first to see the variety of data it can provide you. Sometimes it might be beneficial to store all of that information in a file (e.g. to be imported into the centralised repository later on). For that purpose I would recommend changing the output to the CSV format. This will make import much easier:

systeminfo /FO CSV > c:\temp\sysinfo.csv

Using environment variables

Environment variables have been around since the MS DOS days. Just run the SET command to display them all in the console window. Each environment variable can be referenced by its name surrounded by the percent symbols.

See how each variable can be referenced in any other command:

echo %OS%
echo %PROCESSOR_ARCHITECTURE%

My only advice is try using environment variables everywhere you can instead of hard-coding certain values in your scripts.

Energy report (Officially: Power Efficiency Diagnostics Report)

powercfg energy -output c:\temp\energy-report.html

This is probably one of a less known commands. If you have never seen a report produced by this command - give it a go a see what kind of information it can give you. It is incredibly useful for troubleshooting any power, sleep, hibernation related issues.

On-Screen Keyboard

osk

As simple as that. It will bring a virtual keyboard on the screen - just in case you want to type with your mouse ;)

Bring up a User Accounts dialog

control userpasswords2

The new user accounts dialog window looks too fancy and less convenient to me (btw, you can access it via "control userpasswords"). But if you prefer the old style dialog then it's still there. You can bring it up by running "control userpasswords2" - even on Windows 10.

User, Group and Privileges Information

whoami /all

Without the "/all" switch whomai just returns the current logged in user name. With the addition of the "/all" switch you can see a lot more useful information including all groups this account is the member of (including UUIDs) and all privileges assigned to this account (things like SeIncreaseQuotaPrivilege, SeSystemtimePrivilege etc)

WMI

Now let's explore the power of WMI. WMI is an incredibly powerful way of interrogating various system parameters. I want to share a few useful examples with you just to demonstrate what's possible. We will use the wmic utility that comes standard on every version of Windows that was released after Windows XP.

Get motherboard manufacturer 

We will extract this information from the win32_baseboard WMI class. To make it more interesting I will add a few additional command line techniques that you might find useful:

for /f "tokens=9 delims= " %F in ('wmic baseboard^|more +1') do @echo %~F

Here we are extracting the 9th token (tokens in our case are space separated), which happens to be the motherboard manufacturer. Note: If a value contains spaces then they are treated as separate tokens by this method.

Using the FOR command to split a string into tokens is a generic way of handling strings from the command line.

I also wanted to demo the "more +n" trick. "more +1" means "skip the 1st line". The output consists of 2 rows - the table header and the row containing the actual values. We need this to skip the 1st (header) line in the output.

There is a more elegant way to extract values in wmic. And I will demonstrate it in the next example.

Get physical memory size

wmic computersystem get TotalPhysicalMemory | more +1

This gives us total physical memory installed in our system in bytes (we have 16GB in the example above).

We can also get max memory capacity (commit charge)

wmic memphysical get MaxCapacity | more +1

We see that we have roughly 32GB of RAM available - this includes the 16GB of physical RAM plus the size of the swap file.

Get a list of all applications that run automatically when a user logs into the system

wmic startup

Get version of the Adobe Acrobat Reader installed on your computer

wmic product get name,version | find "Adobe Acrobat Reader"

I hope you were able found a couple of useful commands. What are your favourite commands? Please share them in the comments section below.

Keywords: windows command line, command line tricks, useful commands, wmic, devops, sysadmin, systems engineering, microsoft windows

Tesla and the future of the autonomous cars

I have been following companies like Tesla and SpaceX for quite some time. Elon Musk has an amazing ability (or sense) to identify which established mature industries are ready for some shake up. It is fascinating to watch how companies like Tesla with no prior experience come and disrupt their corresponding industries. Being "out-innovated" should be one of the biggest fears and yet many large organisations (both in the car manufacturing and space technology industries) didn't get that sense of urgency. They were too slow. This could be due to various reasons - organisational culture that doesn't support innovation, the cozy feeling that you are safe because there are no new players to change the status quo or the sense that the entry barrier is too high. 

What makes Elon Musk's approach unique I think is partially due to his software industry background. The "release early, release often" mantra, that is so common in the modern software development world, allows his teams to iterate at a higher pace (compared to other players), receive valuable feedback and close the feedback loop by releasing newer versions faster than their competitors. It might be OK to release new products/models once a year in the classic auto manufacturing scenarios (with major overhauls every ~4 years) but in the software development world that would be a crime. And we can certainly see the software industry influence in Tesla's approach. The pace of innovation at Tesla is just crazy. They "will never stop innovating".

Earlier this month Elon Musk announced that the new revision for Autopilot HW2 will be rolled out to the first 1000 Tesla cars. All other Teslas that support this update were promised to also receive it but it would run in the shadow mode. This means that it won't be actively controlling the car but it will be collecting stats on the background (what it would have done if it were enabled).

New rev for Autopilot HW2 rolling out Mon to first 1000 & to rest of fleet in shadow mode. Also improves HW1 and enables Ludicrous+. — Elon Musk (@elonmusk) January 8, 2017 If all looks good, HW2 Autopilot functionality will switch from shadow to active mode by end of week for cars beyond initial 1000 — Elon Musk (@elonmusk) January 8, 2017

As you can see from the 2nd tweet, the plan was to enable this mode for all cars by the end of this week. With just a minor delay we received this update:

Autopilot for HW2 rolling out to all HW2 cars today. Please be cautious. Some cars will require adjustment of camera pitch angle by service. — Elon Musk (@elonmusk) January 21, 2017 @jakebathman Car won't complete camera calibration. Working on software solution to adjust image crop dynamically, so camera more robust to pitch angle. — Elon Musk (@elonmusk) January 21, 2017

So just after a couple of weeks of testing all Tesla cars with the HW2 package started receiving the update. By running the system in shadow mode on the first test group of cars, Tesla engineers certainly were able to collect valuable real life data that helped them to calibrate sensors. But as you can see from the last tweet, some cars won't be able to complete the camera calibration process and will have to visit a service station for the "adjustment of camera pitch angle". In parallel (according to Musk), engineers are working on a software solution to this issue. Preparing a software patch to mask/compensate for a hardware problem is a very common approach in the IT industry - this is another indicator of what is in Tesla's DNA.

And now this tweet:

@dnansink40 Autonomy capability should improve via OTA every 2 to 6 weeks

— Elon Musk (@elonmusk) January 22, 2017

As more data arrives, Tesla can keep tweaking and adjusting the capabilities of the new system. This is a spiral. Releasing updates in relatively short 2 to 6 weeks iterations is very similar to the agile approach, that has become a common practice in IT. It delivers increased value to the customers (end users) sooner.

Late last year Elon Musk has announced an ambitious goal for 2017 - a Tesla car (fully autonomously - no touch) should be able to drive from LA to New York, drop the driver (passenger? occupant?) off at Times Square and then automatically drive away to find a parking spot. We live in the future!

As a side note - sometimes it feels like Elon makes a public announcement first and then forces his employees to stick to these commitments. It's a nice way to maintain the high pace.

Another important news this week came from the National Highway Traffic Safety Administration (NHTSA). 

In May last year a 2015 Tesla Model S operated in the Autopilot mode collided with a tractor trailer in Florida. In June 2016 NHTSA opened an investigation PE 16-007 to "examine the design and performance of any automated driving systems in use at the time of the crash." They have finally released a report after completing the investigation of this crash.

 The result of the investigation?

NHTSA’s examination did not identify any defects in the design or performance of the AEB or Autopilot systems of the subject vehicles nor any incidents in which the systems did not perform as designed.

This is great news for Tesla. But, this is not all. This report also highlighted the safety benefits of Tesla’s Autosteer features. Automatic Emergency Braking (AEB) technologies include the following: Forward Collision Warning (FCW), Dynamic Brake Support (DBS), and Crash Imminent Braking (CIB). 

In 2016 20 car manufacturers (99% of the US new car market) made a voluntary commitment to make AEB "standard on virtually all light-duty cars and trucks with a gross vehicle weight of 8,500 lbs. or less no later than September 1, 2022"

IIHS research shows that AEB systems meeting the commitment would reduce rear-end crashes by 40 percent. IIHS estimates that by 2025 – the earliest NHTSA believes it could realistically implement a regulatory requirement for AEB – the commitment will prevent 28,000 crashes and 12,000 injuries.

12 thousand injuries (!!!) with some of them inevitably being fatal. Imagine how many people will make it safe back home to their loved ones - thanks to this amazing technology. A 40% reduction in rear-end collisions alone is a pretty big deal!

Human driver typical reaction time ranges from 0.7 sec to 3 sec with 1.5-2.3 being the average. 0.7 seconds is an eternity in the world of computers. Remember when automatic gearboxes were first introduced? They were slow and clunky. Purists were advocating for the manual gearboxes - better control of a car, faster launch times (quartermile) etc. Technology kept evolving and then suddenly one day we saw models equipped with the auto gearboxes showing faster times. We just have to accept the fact that computers are faster. The same is happening with the Autopilot technologies. 0.7 seconds is plenty of time for a computer system.

Image courtesy of https://www.technologyreview.com/s/534981/car-to-car-communication/

Now combine this with the car-to-car communications and capability gap becomes even wider. Cars will be able to update each other and provide situational awareness. A car driving 2 cars in front of us in the same lane sees an obstacle and initiates emergency braking. A human driver wouldn't be even aware of this emerging situation yet. Compare this with our autonomous car that immediately receives this information and responds by priming the brakes, reducing engine power and preparing to slow down and stop (actively measuring the distance to the car in front of us).

These recent successes and overall progress in the world of self driving cars got me pondering - how will these technologies change the world around us in the near future?

Faster reaction time means that autonomous cars can travel at faster speeds and potentially closer to each other (to increase the flow rates). This will most likely result in dedicated lanes for autonomous cars only (human drivers will not be allowed to drive there). These lanes might also be equipped with additional features to aid navigation and safety.

Since autonomous cars will be safer, the insurance premiums for the human drivers will go up. Do you want to enjoy driving? You will need to pay more for this "luxury". Imagine telling your grand kids stories how you were driving cars yourself - manually - and that those cars were burning toxic flammable liquids in their engines. 

Companies like Uber will introduce autonomous taxis. Unlike humans that need to rest (or work multiple shifts), new taxis will be able to work 24/7. Eliminating the need to pay human driver salary will drive the cost of this service down (compared to standard taxis).

The idea of car ownership will change too. On a typical business day I need a car 1 hour in the morning to get me to work and 1 hour in the evening to bring me back home. It might be tempting to become a passenger in the autonomous car and enjoy reading or browsing Internet while this car takes you to/from work. 

After dropping you off at work:

If it is a taxi it will drive to service the next customer. 

If it is your own car - it will either automatically find parking (to wait till you need it again in the evening) or it will join the fleet of taxis for a few hours while you work to earn some money for you.

Buying a new car will be fun! You will go to your favourite car sales web site, search for a model you like, complete the transaction.... and the newly purchased car will automatically arrive to your doorstep. "Beep, beep, I am here!"

Private car sales might change too. It might be possible to complete the transaction online (most likely via some sort of escrow service for added safety). But there will be no need to find time to meet face to face for inspection. The car will automatically drive itself to the mechanic of your choice. You will receive an inspection report online. After completing the transaction the car will drive to your home address by itself.

Parking will look different. It will most likely go underground to save space (no need to have huge surface parking lots anymore). It can become more dense too - there will be no need to open up doors and autonomous cars can be guided more precisely to park centimeters from each other (while eliminating chips and scratches)

The cars will automatically visit service stations for scheduled service or necessary repairs. They will  also be able to go to the car wash service and return back home. 

Crowd-sourced navigation services like Waze work well. But the true potential of this approach will be unlocked when connected cars begin talking to each other and to some soft of a central traffic planning and navigation centre. By knowing current locations, planned destinations, and current road and weather conditions it will be possible to select the best routes and optimise overall city traffic flows. 

Navigation planning and car-to-car communications will allow special services (police, ambulance, firefighters) to command all self-driving cars to slow down and move aside to free up a lane. It will also be possible to isolate a section of the road or an intersection for roadworks so that autonomous cars will find alternative routes.

We will see more and more electric cars on the roads. And electric cars are silent. Car enthusiasts (rev-heads) love the engine sounds (which might become extinct soon). That meaty, low pitch sound of a V8 engine... Sorry turbo fours and sixes - your sound just can't match it. Remember how popular were mobile phone ringtones? I predict that in the near future electric cars will come "equipped" with a few standard engine sounds (mainly for the enjoyment of the driver). And there will be an option to buy and download additional sound packs containing any imaginable engine sounds for a small fee.

As a security professional I can also see the new risks. For example, what if someone simulates an emergency breaking signal? It could just be a harmless prank - just to watch all autonomous cars coming to a screeching halt. Or it can have more nefarious reasons. The bad guys may trick a car stop or slow down in a given location to make it easier to attack it. There have been similar attacks demonstrated recently when a low tyre pressure signal was simulated/faked leading a driver to pull over and stop to check tyres.

Potentially someone could try to gain an unfair advantage by transmitting wrong data - e.g. to free up a lane or get the priority when crossing an intersection.

But all these issues aside, I am excited about the future. And thanks to the grand vision of people like Elon Musk this future is becoming a new reality.

I would like to hear your feedback. What are your thoughts? Do you have a self driving already or are you planning to buy one soon? How do you think the world will change? Please leave your answers below.

Top 10 recommended books for a DevOps manager

I have been browsing Google and Amazon sites looking for new books to read. For those of you who don't know me - due to the nature of my work for the last few months I've been focusing on security engineering but before that, for 6 years, I've been managing a DevOps and Security team. As a side note - combining DevOps and Security in one team is a very smart move. And we were doing it before the industry coined terms like SecDevOps or Rugged DevOps. But this is a topic for another day. What I realised though is that there were plenty of lists and blog posts providing recommendations for DevOps (in general) but nothing specifically targeting DevOps managers. Granted, there will be an overlap. E.g. how can you not mention The Phoenix Project, right? But at the same time the lists for DevOps engineers/practitioners and DevOps managers won't be identical.

In my previous company our CIO recommended (or I would even say - promoted - thank you Ajay!) several books to our IT leadership team. We've read them collectively and it was a very enjoyable experience to discuss chapters with my colleagues. While not necessarily technical books, I've learnt a lot from them as a manager - especially from the point of better understanding the business side.

Let's start:

	The Phoenix Project by Gene Kim, Kevin Behr, George Spafford This is one of my favourite books. I have it both in paper and electronic forms. I remember when I was reading it for the first time I was sharing entire paragraphs and even whole pages with my colleagues. This is how I excited I was and how well this book was resonating and matching my own professional experiences. I finished this book in just 4 nights. I have essentially made it compulsory for my team of DevOps engineers to read it. Gene Kim is a celebrity in the IT world and you just can't go wrong when you read his books or watch his talks. If you haven't read it yet - promise me that you will read it this year ;) This book describes the theory of constrains in a modern language applied to the IT world. It is a pleasure (and very enjoyable and light reading) to follow the journey of one company how they go from crisis after crisis to success of a well organised, high pace machine.
	Continuous Delivery: Reliable Software Releases through Build, Test, and Deployment Automation by Jez Humble, David Farley Jez Humble is another heavyweight of the DevOps world. This is a highly recommended book for anyone in software or application development. A large portion of DevOps activities revolves around automating the delivery pipeline. One of the mantras in our DevOps team was "we cannot be a bottleneck". We should be able to move with the pace of development. And when a developer checks new piece of code in - the expectation should be that in a few minutes a new build will be completed, tests will be executed and this code (automatically!) reach production.
	Delivering Happiness by Tony Hsieh This is not an IT book but something that any manager should read. Tony Hsieh (CEO of Zappos) can be controversial in his approach. As an example, he offers $2,000 to the newly hired employees to resign. Or how about removing all roles in the company operating in a completely flat organisational structure? This is very unorthodox and this makes this book very interesting to read. The book teaches us to focus on company culture and making customer service the responsibility of the entire organisation. I really liked the "ordering pizza" example. Please read the book to find out what I mean.
	Tribal Leadership by Dave Logan, John King, Halee Fischer-Wright Every organisation consists of relatively small groups of people ("tribes" in this book) and connections/interactions between those tribes. Each tribe has its own culture, which defines the behavior/attitude of the tribe and affects organisation's success as a whole.  The book teaches us how to diagnose and measure this culture, while defining 5 levels or stages. The most common are Stage 2 (passive, sarcastic, resistant to change culture) and Stage 3 (defined as "We are great, you are not").  I was really impressed by the way how tribe's thinking changes as it progresses up towards higher stages. At stage 5 a hospital has cancer as the enemy. They focus on bigger things. They don't think about competitors - they have a much larger goal in mind. You can also download a free audiobook from the official site
	Leaders Eat Last by Simon Sinek This book is full of inspiring stories. It is a must read if you value supportive culture in your team or the organisation as a whole. Supportive mentality leads to people willing to take more risks because they know their colleagues would do the same for them. This book is about inspiring trust and commitment.
	Site Reliability Engineering: How Google Runs Production Systems by Betsy Beyer, Chris Jones, Jennifer Petoff, Niall Richard Murphy In this book members of Google's SRE team cover the entire software lifecycle and share their experience of how Google builds, deploys, monitors, and maintains some of the largest software systems in the world. I would recommend this book to both DevOps and Security teams. Rugged DevOps in addition to fast pace of delivery also focuses on the reliability aspects. For larger IT teams it makes sense to have dedicated SRE teams focusing on resilience of the deployed applications. You will learn a lot about what it takes to run large online systems at scale and how to engineer these systems to maintain tight SLAs.
	Release It!: Design and Deploy Production-Ready Software (Pragmatic Programmers) by Michael T. Nygard This is a book about how to build software for the real world. Developers tend to focus on the positive results - that their code does what it's supposed to be doing.... under ideal conditions. Have you heard the "it works on my machine" argument? The real world is different. Instead of running on a single dev box your code will run in a farm. The server you are running on can be rebooted. A chaos monkey can pick your precious server as the next victim. The database that you rely on can be locked or your long running transaction might be killed. The WAN link you are crossing to reach a legacy corporate system may go down... You could run into so many potential (and sometimes unexpected) failures. If you want to build resilient systems, if you are the one receiving pager alerts at 3AM - this book is for you.
	The Innovator’s Dilemma: When New Technologies Cause Great Firms to Fail (Management of Innovation and Change) by Clayton M. Christensen My previous CEO once said that his biggest fear was being outinnovated. When you are #1 it is relatively easy to defend against the copycats. By definition they will be behind as long as you keep building new products. But there is a risk of a new player disrupting the market and changing the status quo. Worse, you can do everything right and yet still lose the market share. This book teaches how not to miss or ignore "the next great wave". It was one of the books that inspired Steve Jobs

So here it is - 8 books (a nice round number) that I would like to recommend.

In order to make it 10, I would like to add 2 "honorable mentions"

Good to Great: Why Some Companies Make the Leap and Others Don't by Jim Collins In this book the author makes an attempt to identify the factors that are responsible for the transition from being good to becoming truly great. They compare similar organisations (e.g. two financial institutions) and then show how one organisation suddenly finds something that propels them to the next level, while another organisation remains the same - good but not great. I have to admit - I have only completed about 50% of this book. I know for a fact that this is a very popular book, yet it was quite difficult for me to read. I had to set it aside for some time.

The Art of Computer Programming by Donald E. Knuth Some of you might be surprised by this recommendation. This is an old book. It was quite popular back in my uni days. This is a bible for software developers. It contains LOTS of algorithms for solving various computational tasks. The reason I decided to include it here - too many developers these days don't know the fundamentals. I saw that quite often developers just copy/paste code from MSDN or StackOverflow. By exploring sections of this book and gaining understanding how certain algorithms work, a developer will go a long way in achieving true greatness.

What do you think? What is sitting on your bookshelf? Which books have inspired you? Please leave your comments below and I promise that I will check these books.

Android vulnerabilities and market fragmentation

Earlier this week I came across this article and it brought back some of my concerns about the Android ecosystem. The key piece that caught my attention was essentially in the first two lines:

Attackers can pwn 60% of Android phones using critical flaw.
And don't expect a fix anytime soon.

I love (and respect) Android as a platform. I've been using Android phones for a number of years now. Google did an excellent job developing this platform. However, the way how software updates (including security fixes!) are handled by the ecosystem as a whole is just terrible.

A group of researchers measured a data sample of 500,000 Android phones to see if they were affected by the recently disclosed QSEE vulnerability. This vulnerability was published on the 6th of January 2016 and fixed by Google in the January 2016 monthly security update.

From that sample 80% of the Android phones were based on a Qualcomm chipset (the one affected by this vulnerability). And only 25% of these phones had a fix applied, leaving the remaining 60% of all Android phones vulnerable.

The problem with the Android ecosystem is that it is too fragmented. When Google releases a new version of Android (or a fix) it can push/apply it to their own phones but other vendors (Samsung, LG etc) take time to (thoroughly) test the latest code on their phone models to make sure everything works as expected. Many manufacturers/OEMs don't run "clean" Android, instead they (advantages of open source!) make modifications to adjust/tweak some aspects of the Android OS to their needs. The result is - it takes time (weeks, months) for the new version of Android (or a particular fix) to be made available by the OEM.

Then things get even worse - telcos/carriers/mobile network operators ALSO take time to test updates coming from the OEMs on their networks (no one wants to be in the situation when an update kills the ability to call 000 or introduces another serious bug).

As an example, Telstra does a good job updating their customers on the progress of when/how they are going to roll out the "new" versions of Android to various phones:

I have captured this screenshot in May. 8 months later the situation is getting better but I can see that mainly security fixes get prioritised for delivery. This is good! In fact, it is much better than what it used to be. But on the other hand, customer still have to wait for non-security updates, improved functionality etc, and it probably still contributes to market fragmentation (more Android variations to support).

I think most of the manufacturers and carriers are stuck with the mentality that people buy phones on a 2 year plan, use this model for 2 years and then upgrade to the next model. They are not software companies (i.e. they don't understand or don't have capacity to implement/follow the fast software release cycles). I guess it's OK to work on a new hardware model for a year. But it's a crime in a modern software agile world. And on top of that there is no incentive to update to the newer versions - OEMs have already received money for the phone (hardware) and the carriers are guaranteed to receive a certain amount every month for 2 years in most cases.

All of this is the main reason why I've been using Google Nexus phones for several years straight (from the 2011 Google Nexus model all the way to Nexus 6P). These are Google's flagship phones and I agree with the Amazon's 4.5 stars rating. These phones are produced by different manufacturers. As an example - Nexus 6P was made by Huawei, while the previous Nexus 6 version was manufactured by Motorola. But hardware design, specs, and software updates are all controlled by Google. Once a new version of Android is ready, unlocked (i.e. not sold by a particular carrier with a SIM card locked to that particular provider) Google phones receive them first. This is a guaranteed fastest way to receive the update - a matter of a few days maximum. For other phones it may take weeks or even months. Or they may never receive an update leaving these models permanently vulnerable. This is the reason for the 60% mentioned at the beginning.

I am sure Google engineers are aware of this challenge and doing their best to improve it. I can certainly see positive changes already taking place. From the late 2015 Google started publishing monthly security bulletins. These updates get pushed to the Nexus phones straight away. This is a massive improvement compared to the situation when we had to wait for months for these fixes to be incorporated into the next version of Android (leaving all phones vulnerable).

The newest Google phones - Pixel and Pixel XL - is the continuation of the Nexus theme but with even more (end to end) control from Google. This is a great way to reduce market fragmentation. I am surprised by the average ratings on Amazon. I loved every Nexus phone I had. And I am sure Pixel won't disappoint too. If you are thinking of getting a new phone and if you care about security - give it a go. You will get great hardware, modern mobile OS and the best security of the Android ecosystem.

If you are an Android user - which phones do you use and would also recommend to your friends? If you use an iPhone - would you consider Google Nexus or Pixel phones after reading this blog post?

Please leave your comments below and I promise I will answer all of your questions