Darren Duke Blog Zone

Pop Quiz - who knows the encryption strength and alogrithm that Lotus Notes port encryption uses?

Darren Duke — Sun, 18 Jul 2010 12:20:36 -0400

Nathan got me thinking, and when I think I search the web. In an earlier post Nathan commented about Notes encryption. Now I swear that every 6 months or so I am asked by a customer about the strength and algorithm that Lotus Notes uses when connecting over an encrypted port. I also swear I search for this information every 6 months too and I always come up with 64 bit RC 2 as the "possible" answer in this ancient SearchDomino post ....

Well this time I searched I hit pay-dirt. Based on technote 1097816 we get the following:

S	Encryption Strength The first value is the key length The second value is the algorithm	Length 128 (new in Notes/Domino 6) 64 40 (only used for R3 Int'l or WW40 versions) Algorithm 22 = RC4 2F = RC2
A	Algorithm	4:1 = RC4 2:0 = RC2 (R3 Intl or WW40)

Now, this is not listed (as far as I can tell) anywhere in any help, be it admin or client. The technote also outlines how to test it and I did just that. As you can see below when I connected to my server I am connecting as 128 bit RC4.

So there you have it and why the hell is this not in the trace information or the help?

The most useful feature of Lotus Notes that most users can’t use - Full Text Indexing

Darren Duke — Sun, 18 Jul 2010 06:28:04 -0400

In a comment on Ed Brill's blog post about Google's dubious marketing I asked (comment 11) to allow full text indexes to be moved to different, non-Domino data storage. See, Google are saying you can't really search your mail file, or to quote Ed:

....they [Google] seem to have a total blind spot to the full-text search engine in Notes, asserting that sort by sender and browsing folders are the only ways to "search" in Notes

Anyone reading this blog will know that Google's assertion is as blatant a lie are there is. But, alas, most companies do not have full text indexing turned on for all, if any, of their mail users.

Why not? Is it IBM that have the blindspot here?

After all, full text indexing a Notes database application immeasurably increased the usability, value and experience of Lotus Notes so why not turn it on? Disk space is the why. Storage consistently rates as one of the major concerns for IT in any survey you can find, so why double the storage needed on my shiny new SAN just to enable searching? It is a good question and one that has never been addressed.

We can move attachments out to different storage.

We can move view rebuilds out to different storage.

Why can't we move full text indexes to different storage? Why do they have to reside in the same OS directory/folder as the mail file?

With Lotus Notes 8, IBM tackled head on the user interface issues with Lotus Notes. Now they need to tackle the usability of full text indexes and their location on the server. Yes you can use a local replica, indeed on this very blog I show you how to set that up, but IBM, you must tackle the issue at the lowest common denominator, the server-based mail file user. With the plethora of thin client technologies on the market (Citrix, Terminal Services and VMware View) more and more organizations have to use server based mail files due to "thin clients" having no storage. Add to that the brilliant experience that is iNotes, yet for most it is crippled beyond simple actions like sending and reading emails due to, you guessed it, being a server based mail file with no full text index.

Tripp Black elaborates my feelings on Ed's blog (comment 30):

The reason that Google can get away with the Full Text comment is, that as implemented, most companies cram as many users on a box until the experience is pretty dismal - No FT Indexes allowed. At a couple RTP companies (which one converted to MS live but still has $$$ going out to reinvent the apps), I told friends how to setup local replicas, turn on replication and then have FT Indexes. Suddenly, Notes was fast, you could find something and it didn't SUCK!. What a concept...... It took years of crippling Notes to get Notes to be evil to escape at any cost.

User satisfaction is king. And right now, due in some large part to this restriction, the majority of user are anything but satisfied when it comes to searching. And the shocker here is not that lack of functionality but being able to enable said functionality. IBM Lotus need to focus on the removal of every single roadblock that prevents full text indexing from being enabled.

As indicated above, there is already an IdeaJam for this, and it already has over 70 votes. 70 votes? That's a pretty unanimous cry for help. As Hynek Kobelka comments on the idea:

Very good idea ! And it should be so easy to accomplish :-)

To reduce storage on the server IBM Lotus gave us DAOS and I would have to say this has been a leading factor in the massive and fast adoption of Domino 8.5.x in the last 18 months. If IBM wants to see another fast uptake on a Notes/Domino release why not add this? It is a win-win. The user wins with increased functionality and IT wins by being able to use cheap storage for FTI's.

What am I missing here?

The 2006 version of Lotus Notes vs the 2006 version of GMail

Darren Duke — Fri, 16 Jul 2010 12:35:33 -0400

By now you have probably read Google's attempt to take a swipe at Notes that Ed Brill posted about. Most (if not all) of what Google claim is wrong or a lie. Apparently "Don't be evil" does not stretch to lies. Any way Chris Whisonant has done a very good response. So in an attempt at humor and righting some blatant wrongs, mis-truths and lies I decided to pit the 2006 version of Lotus Notes against the 2006 version of Gmail.

All facts about Lotus Notes and Gmail were gleaned from wikipedia. I will use the production code for each platform as of June 30th 2006. So for Lotus Notes we have 7.0 For Gmail we have nothing. It was in beta from 2004 through 2007. But that's OK because in the Google post they did not seem to care either, "Don't be evil".....erm.....OK....so on with the show.

In Lotus Notes in 2006 you....

Can access your email in an ajax based web experience (called DWA), a Notes client, a mobile device and any POP3 or IMAP mail client from anywhere in the world
View messages and their replies
Place a message in a folder
Sort by message sender and date
You could not auto-spell check (added in R8)
Delete messages to save disk space (and to avoid lawsuits, etc)
Archive to a desktop file (so you could read you email on a plane, even in 2006!)
Flag important messages
Receive notifications of new mail
Forward multiple messages

In Gmail in 2006 you...

Had to wait for an invite
Had to wait for an invite
Had to wait for an invite
Had to wait for an invite
Had to wait for an invite
Had to wait for an invite
Had to wait for an invite
Had to wait for an invite
Had to wait for an invite
Had to wait for an invite

See mine post is true too. Google, Google, Google, are you proud of your place beside Microsoft in the "we'll say anything" contest? Really I have thought more (not much though) highly of you.

An update on Anonymous access to Domino applications

Darren Duke — Fri, 16 Jul 2010 11:42:26 -0400

Yesterday I concluded an email conversation with Ed Brill to get some final clarification around the "anonymous access" questions surrounding Domino that were brought up on this blog and by Nathan Freeman over on Tim Tripcony's blog over that past free weeks.

Well the mystery is over. Express is, well, "limited" and as such has no anonymous access to Domino applications. You will need either a Domino Utility Server license or a Domino Enterprise Server license to allow this. Yes, that is right, Domino Enterprise Servers does allow anonymous access to applications. So at least some good news.

Thanks Ed for the follow up and clarification. Hopefully all confusion is now rectified......move along, nothing to see here.

OpenNTF IdeaJam is open until 7/16

Darren Duke — Thu, 15 Jul 2010 03:05:38 -0400

Over the last 12-18 months the OpenNTF web site and the number of projects (read free Lotus applications) has increased immeasurably. Help continue the trend by participating in the (the first annual?) OpenNTF IdeaJam that is open until 7/16/2010.

Got any things you'd like to see on the site? If not, go and peruse the ideas already contributed, there are some that will deserve your vote.

What are you waiting for, go to http://openntf.org/ideajam/IdeaJam.nsf/ProductByAreaMostRecent?openview&restricttocategory=July2010

The idea linked above is just a sample (although I think it is a great idea that we all start to promote OpenNTF on our blogs, etc).

It is hard to believe it’s 2 years for this blog - and international hug a blogger day

Darren Duke — Mon, 12 Jul 2010 06:23:03 -0400

Well that was a speedy 24 months. With a total of 294 post in that last two years I've averaged one post ever 2.48 days. That is far more than I ever thought I'd do ;)

With 527 comments (and not all of them are mine) then at least some find this useful.

Occasionally I get asked why I started this, and the honest truth is two fold:

The STS site requires editing and I'm crap at spelling ;)
To allow the STS sales and marketing folks to "prove" we know what we are doing

The latter has been a huge success and is sometimes the topic of a post requests from the team. Most of their requests get done, some get ignored ;)

During this period I've also been involved in other projects. I was worried that the blogging "frequency" and/or quality would lapse but I think I've avoided that potential pot fall, at least for the time being. Other stuff I'm involved in:

Tips In Two (admittedly, we need to add some more videos)
This Week In Lotus (with Stuart McIntyre)

I think one of the things that goes unsaid in any community, not just the Yellow Submarine, is how much time and dedication the bloggers put in. I wish to thank everyone I read for your time, effort and dedication to enhancing my knowledge.

In fact I recently estimated that the efforts I am involved with (including blogging. PoTs, LUG's, etc) is an investment equivalent of well over $40,000 per year. So, if you see a blogger, give them a hug.

BlackBerry Enterprise Server 5.0 SP2 released

Darren Duke — Sat, 10 Jul 2010 13:48:42 -0400

RIM have released SP2 for BES 5.0 for Domino.

See the release notes for further details.

some highlights:

BES now supports Brazilian Portuguese, English, French, German, Italian, Japanese and Spanish.
SQL 2008 R2 support added
More browsers can access BAS, although IE is still required for managing devices
Support for Windows Server 2008 R2
Tons of fixes

Get it from http://na.blackberry.com/eng/support/downloads/

Quickr Domino 8.2 FP 13 is available

Darren Duke — Sat, 10 Jul 2010 13:16:47 -0400

As per, get it from IBM Fix Central.

Fixes include:

06/23/2010	MPUL83KCKR	Cannot expand Domino Native Group in Room Security Add Member dialog.
06/23/2010	TJOR868PEP	Room contents not viewable when “Room Security” moved to the top of the room’s table of contents.
06/23/2010	PNOT86GG4Y	In FireFox, the start icon designating the current version is missing.
06/23/2010	MZHA86MA5J	Place non-member set to Author access cannot save a blog comment.
06/23/2010	ESEO85ZR4X	In Add Member dialog, duplicate search result entries are returned when multiple base DNs are specified in the qpconfig.
06/23/2010	JRIE84GGDL	“Upload to Library” drag and drop applet still visible and functional after disabling Java applets in the place.
06/23/2010	ASHH84WG46	In certain circumstances the h_Authors field is missing on a document during check out resulting in the user getting the error message “Sorry, you cannot edit this page right now because another author is currently editing it or has checked it out”.
06/23/2010	XZSU7K2853	When placing a Blog place in an IFrame, some fields are missing when creating a new blog entry.
06/14/2010	ESEO85TV5K	When notifying, unable to see users or groups whose name contains open or closed parenthesis.
06/14/2010	XZSU85R9CJ	In certain circumstances a user will get an error when cancelling a draft document.
06/14/2010	No SPR	When notifying, the option to include the first 30 words of the document you are sending is not available.
06/14/2010	RELS7FWPN3	The list of document versions does not appear when using the FireFox browser.
06/14/2010	SORA7LYHCJ RELS7C83C8	When editing the folder options for the Calendar, you lose the “New Event” button when viewing the Calendar.
06/08/2010	CLOH85TBPK	When creating a new Post, if your cursor is in the Post Topic and you select to insert a new image, that image appears at the top of the web page, not within the Rich Text Editor.
06/08/2010	DWON84PHV8	Within connectors, when dragging and dropping a folder from a Room to the Windows Explorer, that folder is put into a folder named libraryxxxxxxxxxxxxxxxx.nsf.
06/04/2010	CSTS84JNJF	The time is one hour behind on file's Modified Date using the Quickr ActiveX Control.
06/04/2010	MMOI84W2WB	URL Links sent to users via the SameTime chat integration do not open when clicked.
06/04/2010	HMON85MQAN	When using the QuickPlace Classic Theme, when you go to New or Customize, a smaller window opens in which you have to use the scroll bars to get to content.
06/04/2010	MPUL83NPPW	Add Member lookup for groups when using Domino Native as the directory does not show groups if the qpconfig.xml setting is enabled.
06/04/2010	CSTS85FJND	Cannot see places in My Places when using \, in Active Directory name.

Confused about Domino licensing? Attend my free webinar on July 15th

Darren Duke — Thu, 8 Jul 2010 08:14:00 -0400

With CPU changes, free entitlements "license simplification" and the incredibly complicated PVU tables licensing you should have some questions. Well good news, the kindly folks at STS (one of which is me) is here to help you out with a free webinar followed by a Q&A session.

The event will be on July 15th at 1pm EST.

What will be covered Darren? Well a plethora of items including:

Free entitlements with various licenses
PVU requirements for various CPU architectures
Virtualization impact of licensing
The different type of license

Hopefully this will whet your appetite some and you will join me for this free event. To register for the event simply submit the registration page on the STS site.

"I couldn’t find a Lotus BP in my area" - or support a "real" Lotus BP

Darren Duke — Wed, 7 Jul 2010 05:25:16 -0400

I hear the "I couldn't find a Lotus BP in my area" at least once a month and for the last few weeks I've been giving serious thought as to why. I actually think the answer is complex and I can't really do it justice in a single post, but hopefully this will provides food for thought.

Prologue
Over the last 5 years I been lucky enough to be part of a team that has built a reasonably successful Lotus-focused business. As with most Lotus BP's when we started out, we were not a dog turd on IBM's shoes until 4 years in. There is a reason for that, but that is not for a public post. After much work, 14 hour days and gnashing of teeth hoping we'd be able to pay the mortgage we've, at least in my mind, "arrived".

Prior to 2005 I worked for on the of the bigger Lotus consulting shops in the SE USA, the now defunct Eagle Technology Consultants. I started there in 1999 and there were literally a plethora of Lotus BP's in Atlanta. At least 6-9 I can think of even now. Now I can think of 3, two of which are multi-national conglomerates, and my company. So in the space of a decade the number of BP's in the Greater Atlanta area that I can rattle off has decreased by 50-75%. Why?

I also think this somehow plays into the "No Notes jobs" fever going around right now. Who do you think hires Lotus peeps? Lotus BP's and customers.

The Bigger Problem
There is no single reason for this rather sad state of affairs. There are many. And I'm pretty sure you'll add some more in the comments section.

1) The IBM web site
I remember when Lisa started at the company back in 2005. She was tasked with, and has done an incredible job of, building the IBM relationship. We sat down and went to the "Locate an IBM Business Partner" area on the IBM site and entered a search criteria of Atlanta, GA within 25 miles and selected Lotus as the technology. Of the top 10 (at the time) 6 of them had disconnected numbers. I can only imagine what it must be like being a customer trying to find an IBM sanctioned Lotus expert.

Even today, the same search brings back 34 results. 34? Hum.....OK, let test. The top one returned is a company called "PeopleTrain". I tried their phone number, disconnected. OK, next one, "Emtec". I went to their website and not a single Lotus related item out there. Nada. Dick! Then Softchoice, Ho-hum, only one of the largest re-sellers of Microsoft technologies in NA, and (thanks to LinkedIn) the place most people go to work for after Softchoice? MS . Now you know how that customer phone call will go, right? Rounding out the top 5 is an IBM hardware vendor with no Lotus skills. How many more calls is this customer (or potential customer) going to make?

Mr Customer, you are "shit out of luck" on finding an IBM sanctioned BP that will be able to answer any questions you should have. It is the equivalent of telling the customer not to bother. Call MS, call Booble. *shakes head*

IBM you need to clean up the partner page. You need to start making mock calls into your "Premier" BP's as potential customers and see where the conversation goes. Prepare to be surprised and angered. I would love to know how many migrations are kicked off by talking to the wrong BP.......I know of a few.

2) The Walmart effect - reverse it and support a "real" Lotus BP
If all you really care about is price, use SendMail. My value to a customer is provided at various levels:

I'll make sure you are licensed correctly either up or down (we saved one customer over $20,000 on stuff they didn't need)
I can get you what you actually need, as opposed to making some "sales quota"
I am you advocate with IBM
I can absolutely make your stuff work or work better. On any platform. Period.
You read this blog, download my presentations and white papers, listen to This Week In Lotus and watch Tips In Two

All of the above is a massive time and education investment. As a customer, I respect your decision to purchase from CDW, Softchoice, Agilysis or some other corporation (be aware a puppy dies each time you do), but don't be surprised that when you need expert help, it is not there. You are effectively voting with your money and that is why "You can't find a Lotus BP in my area (worth a crap)". If Mr Customer continues to purchase or re-new Lotus related products from the Walmart's in the software business then eventually, the skilled BP's will move elsewhere. I guess to make up for the loss of revenue I'll need to raise my services rates.

Mr Customer, support a real Lotus BP with your purchases and renewals.

3) The IBM renewals process
By far the most irritating part of being an IBM BP is that IBM insists on elbowing their way into the renewal. Get this, if you come to STS for, I dunno, let's say a new 500 seat Domino install, we'll we fulfill both the services (as we are experts) and licenses on the deal. In fact, most of the time it is STS that created this opportunity, directly from the ground up. You know what happens when the renewal is due on year 2? IBM send the "new" customer an invoice for the renewal a whole 30 days before we can even get a price. My customer is now being invoiced for stuff I sold directly from IBM. How f'd up is that? I guess to make up for the loss of revenue I'll need to raise my services rates.

That's right, a customer we developed, from the ground up, is promptly stolen by IBM. Symantec send us a nice little spreadsheet each quarter with our up and coming renewals. IBM just steals them. Trust me IBM, it is because of STS, and not because of IBM, that my customer is using your software.

IBM you need to stop stealing the renewals. Every piece of revenue you take from partners makes then look elsewhere.

Epilogue

When I started this post, there were 9 reasons. On reflection the final 6 were just re-iterations of 1-3. Basically IBM and Mr Customer are both, in part, responsible for the issue of "I couldn't find a Lotus BP in my area".

Until you both change, don't be surprised if you have even further deterioration in the next decade. Just saying.

Better late than never - my Jackson, MS LCTY presentation on Mobility

Darren Duke — Tue, 6 Jul 2010 14:38:21 -0400

Including things like Traveler, BES and Lotus Mobile Connect (LMC), see what Lotus Knows about mobility.

LCTY_Mobility.pdf

Hybrid drive and Lotus Notes start up times - "Test 2 - a 1 year old desktop"

Darren Duke — Sun, 27 Jun 2010 12:24:00 -0400

As I outlined in the original hybrid drive post earlier today, the performance of a laptop with the Seagate Momentus XT Hybrid Drive is nothing short of phenomenal. In this post we see if the same can be said for desktop computers using the XT drive.

The main physical difference between a laptop drive and a desktop drive is size. The former being a 2.5" drive, the latter a 3.5". Also the height on desktop drive is much, much larger (maybe 1" or so) while laptop drives a much thinner (maybe 3/8" or so). The XT is a SATA drive so the same SATA connectors were used on both the original 3.5" drive and the 2.5" XT drive.

Incidentally, laptop drives usually use less power than their desktop counterparts and the XT specs mention an average 1.1W operating power and 0.8W at idle.

As with the other test, I imaged the original drive (OS, applications, and all) using Acronis Wcho Workstation 9 and placed this identical image onto the XT drive. This was done to more correctly measure real-world computer performance and not some lab test.

The computer in this post is Lisa's main STS desktop machine and has Skype, Tweetdeck and other applications a "power" business user would have. So what's the verdict.........

Test 2 - Dell Optiplex 330 Desktop
Approx 12 months old and is Lisa's main office computer.

Specs:
Intel Core Duo 2 E7200 @ 2.53Ghz
2GB RAM
Windows XP Pro SP3
Notes 8.5.2 CD5

Original drive was a 160GB 7200 RPM 8MB hard drive with SATA 300. (ST3160815AS).

All times in seconds

	Old Drive	New Drive pass 1	New Drive pass 2	Difference old vs pass 2
From BIOS to Windows being loaded and drive activity ceasing	146	92	39	73% reduction in load time
Lotus Notes 8.5.2 CD5 loaded to home screen	34	27	8	76% reduction in load time

Again, so pretty impressive results. This goes to show that putting a 2.5" XT hybrid drive in a desktop can lead to some considerable improvements over classic, pure mechanical drives.

Now, for the sake of clarity, I bought my test drives in the retail channel (from TigerDirect), but as of today, in the US, you can order quantities of 25 or more from STS should you wish. Be mindful these things are selling like hotcakes so be patient if you are wanting some.

P.S. I don't think Lisa will let me get this drive back ;)

SSDs too expensive? See if a hybrid drive can improve Lotus Notes start up times - "Test 1 - a 4 year old laptop"

Darren Duke — Sun, 27 Jun 2010 06:23:00 -0400

As a teaser, how would you like Notes 8.5.1 FP3 Standard to start in 10 seconds? How about 10 seconds on 4 year old hardware? Read on.......

It is no secret that solid state drives give a phenomenal performance increase to OS and Lotus Notes start up times. Indeed I blogged about my experience back in December. SSDs offer performance, but at a high price. Another issue is the restricted storage capacity of these drive, ranging from 32GB to 128GB. Even a 128GB Torx drive (what I have and was the subject of the previous post) is currently $370 at Newegg and that ain't cheap. Anything higher than 128GB and you're in mega bucks area, north of $600 and higher.

So while the world waits for SSD prices to drop, Seagate have created the Momentus XT "hybrid" SSD hard drive. Basically is a "classic" 7200 RPM mechanical drive with 4GB of SSD bolted on as a really, really fast "read" cache.

The XT comes in 250, 320 and 500GB sizes. One big plus for the XT over "pure" SSDs. What about price? Well we just got two 500GB XTs and they cost $129 each from Tigerdirect. Another massive plus over pure SSDs.

So with almost 4 times more storage and one third of the cost over a pure SSD drive this approach looks like a winner on paper. Ah, but what about in the real world? Well good news. Using a computer with an XT inside of it really does feel like a SSD drive. I know, I use the Torx SSD everyday in my ThinkPad T500. But you don't just want my word, right? So....

Still one of the most popular posts on this blog is the 8.0.2 relative performance post, so I decided to get the stop watch out again and test the XT. But first things first, go read the AnandTech review of the drive to find out how it works.

OK, so you are back....basically a fast read cache right? And once the drive is used once "some" files are cached on the SSD portion. This allows for much, much faster read access for subsequent access to the files stored on the SSD portion of the drive.

So I did two tests, one was a 12 month old Dell desktop (to be posted after this), the other a 4 year old Dell laptop that was mine before we made the switch back to Lenovo 9 months ago. This was to get a feel for the performance across the board. As the drive needs to build the cache I booted to Windows, started Notes (aka pass 1) then rebooted and repeated (aka pass 2). Both set of times were recorded together with the original drive for the same task.

I recorded the time from BIOS to Windows desktop being loaded and timed until all hard drive activity ceased (this was to even out any timing issues with password entry at the Windows login). Then I recorded time for Notes so start with Shared Login enabled (so no password to enter).

Test 1 - Dell Inspiron E1405 Laptop
Approx 4 years old

Specs:
Intel Core Duo 2 T5500 @ 1.66Gbz
1GB RAM
Windows XP Pro SP3
Notes 8.5.1 FP3

Original drive was a 60GB 5400 RPM 8MB hard drive with SATA 150.

All times in seconds

	Old Drive	New Drive pass 1	New Drive pass 2	Difference old vs pass 2
From BIOS to Windows being loaded and drive activity ceasing	210	102	42	80% reduction
Lotus Notes 8.5.1 FP3 loaded to home screen	40	20	10	75% reduction

Admittedly, some of this increase is the jump from a 5400 drive to a 7200 drive. That's why I show pass 1 and pass 2. If you look at pass 1 vs pass 2 you'll see in this test the SSD cache basically doubles the drive performance. You could also read this as the performance increase over a standard 7200 RPM drive.

The XT makes this 4 year old laptop feel like a new one, and it feels like it has a SSD drive installed (after pass 2). All this and it only has 1GB RAM in it. Amazing stuff! In fact it is such a difference I wrote this entire post on the test laptop. It really does feel like a SSD. Have I said that before? ;)

While I have yet to see any laptops shipping with these "hybrid" drives it can only be a matter of time. Once they do start appearing as options, the laptop buying public (including corporations) would be insane not to add $30-50 to the price and get on of these puppies added to it. You can also add the XT to a desktop PC with the addition of a 2.5" caddy's, and that will be the subject of the next post.
At STS we'll be rolling these out now we know the benefit. Both laptops and desktops (old and new) will be getting new XT drives over the next few months! I'm sure the STS folks are looking forward to eventually rolling these out to their existing machines. Each time I log on to a "classic" hard drive machine, I lament (rather loudly) that it feels like they're using a floppy drive after being spoiled with my SSD.

From a computer point of view, just adding one of these, even to a 4-5 year old computer, will breath new life into your computer using experience. Oh, and Notes gets a pretty good boost too.

P.S. Don't all us SSD owners feel pretty stupid now. I do ;)

Update : Desktop performance is now available here.

The absolute joys of Domino licensing - not - An interesting conversation about anonymous access

Darren Duke — Mon, 21 Jun 2010 15:09:34 -0400

Over on Tim Tripcony's blog Nathan has a guest post on the recent furore surrounding Domino and application development. From comment 22 onwards there is an interesting "Domino licensing" conversation going on.

The item in question is around anonymous access to Domino servers and what is, and is not, allowed and if so, on Enterprise licensing and/or Express licensing.

You have read the Domino 8.5.1 license agreement right? Thought so....on with the show.

So first things first, what institutes an "authorized user". From the license :

Exhibit 1 (emphasis is mine)

An Authorized User is a unit of measure by which the Program can be licensed. An Authorized User is a unique individual inside or outside of Licensee's Enterprise with a specific identity that is validated when accessing a IBM Lotus Domino server. The Authorized User's unique identity could be defined by his or her Notes ID/password ("PW") combination, his or her IBM Lotus Domino HTTP Name/PW combination, or any other third party authentication source that defines the Authorized User's unique identity. The Program may be installed on any number of computers or servers, but Licensee must obtain PoE for every user authorized to access the Program. Licensee must have entitlements for each Authorized User accessing the Program in any manner directly or indirectly (for example: via a multiplexing program, device, or application server) through any means. Entitlements for Authorized Users may not be shared, nor may they be reassigned other than for the permanent transfer of the Authorized User entitlement to another individual.

So in reading the above, one could surmise that an authorized user is one who is somehow authenticated via an ID file, a web password or other 3rd party authentication source. The word here is validated. Right? So where is anonymous? Missing in action.

From the same license text we'll look at the "addendum" (my word not IBMs) for Lotus Domino Collaboration Express:

IBM Lotus Domino Collaboration Express

Where the Program is IBM Lotus Domino Collaboration Express, (i) the Program is licensed on a per user basis for use only by Licensee's employees and independent contractors, and those of a Related Company (collectively, "Licensee's company"); (ii) Licensee must acquire one PoE for Domino Collaboration Express for each Authorized User who accesses the Program; and (iii) the Program use is limited to companies of no more than one thousand (1,000) employees and/or independent contractors; therefore, Licensee's company may not acquire more than a total of one thousand (1,000) PoEs of Domino Collaboration Express or Domino Messaging Express combined.

Item (i) seems to indicate it is "for use only by Licensee's employees and independent contractors". Hummm....so anonymous is barred. OK....

Item (ii) seems to indicate "Licensee must acquire one PoE for Domino Collaboration Express for each Authorized User". Hummmm, but an authorized user seems to anything other then anonymous (from exhibit 1)....so maybe it is OK for anonymous access.

So which is correct? Is it (i) or (ii)? Clear as mud right?

So what is an Authorized User and does it include or disbar anonymous access? From Exhibit 1 one would have to say anonymous is allowed as there is no authentication for anonymous users and authentication is what dictates an authorized user (technically the term is validation, but surely they are synonymous) but item (i) seems to change that assumption. Well there is a Domino Licensing FAQ that one would hope would clear this up:

(Emphasis in the answer is mine)

Q. What are the differences between Lotus Domino Enterprise Server and Lotus Domino Collaboration Express?
A. Lotus Domino Enterprise Server is a single license for server software only. You acquire licenses for the number of processor value units associated with the hardware on which you deploy the software, and you acquire individual client licenses separately. Lotus Domino Enterprise Server is available to organizations of any size. Any user who has a client access license is allowed to access the server. In addition, anonymous access to non-mail applications (no sign-on or authentication involved) from a Web browser is allowed, even without a client access license.
Lotus Domino Collaboration Express software includes combined server and client licenses, priced on a per user basis. You may deploy the server software on as many machines as you would like, but access is limited to the users for whom you have paid the per user charge. If you do not have a Lotus Domino Collaboration Express per user license, you are not entitled to access the Lotus Domino server, even if the you have a separately acquired client access license or only want to use applications anonymously from a Web browser. The offering is available only for companies who have 1000 employees or fewer, and removes select capabilities of Lotus Domino Enterprise Server that are designed for larger enterprises. The license restrictions are:

No license to use Lotus Domino partitioning or clustering
No use on IBM System z platform (Linux or z/OS)
No license to use the following advanced administration functions: extended access control lists, cascading directories, directory catalogs, directory assistance, central directory (userless name and address book)

Look at the bold text above (ah, a negative sentence, just like a hide-when). The FAQ indicates that anonymous access is not allowed, at least with Express licensing. Ergo item (i) is correct and item (ii) is redundant.

I have never, ever accepted a "FAQ" when installing software, but I always accept a license agreement. What happens when the two seem to collide?

Some suggestions to IBM:
1. Where anonymous access is specifically denied, deliberately label it so
2. In the license text, please hyperlink the individual products to the name and program number at the top of the page
3. Change the license so that anonymous access is allowed. Are you really trying to make this as difficult as this?

8.5.1 FP3 IF1 is available - togther with the "fix list"

Darren Duke — Thu, 17 Jun 2010 08:02:24 -0400

Yesterday I tweeted about 8.5.1 FP3 IF1 being available but that the time there was no documentation as to what it fixed.

As outlined in Technote 1433721 there is a potential issue with Domino server performance with authentication when policies are bring downloaded to clients. Apparently this is can particularly affect Domino servers that are part of Directory Assistance.

As usual it is available on IBM Fix Central.

Are we all in the Yellow Vortex now? Spiraling to our own demise?

Darren Duke — Wed, 16 Jun 2010 04:07:00 -0400

This post is about application development on the Notes/Domino platform. Everything else Domino-wise is just hunky dory and I have the balance sheet to prove it!

Take a look at the image above and you will probably see a yellow line descending into the vortex of despair.....more on that at the end.

I really feel like I'm watching this sudden, albeit needed frenzy as an out of body experience. To a "T" all of the posts in the last 48 hours have indicated about the lack of employment opportunities in the Domino development world. I can't argue about that. It is true. I can't recall the last "net-new" customer Domino application I was involved in, either as a developer or architect. That may even pre-date the forming of STS back in 2005. Sure, there are lots of maintenance app dev jobs, but not anything new, at least in my sphere of influence. It is not due to lack of skill (our entire organization runs on custom Notes apps, and soon to be XPages apps) on my part. More likely it is lack of faith on my part. Maybe I'm secretly a "Notes App Addict", creating applications to run my business in secret, but hoping no one else realizes, afraid of the stigma that maybe attached to me.

As I mentioned on that last This Week In Lotus podcast I saw a stagnant, frozen platform that suffered from a lack of love and nourishment from it's parent (IBM) back in 2003-2004 time frame (or thereabouts). After the addition of LotusScript in R4.0 and "Domino" being added in 4.5 nary a useful feature was added to Domino Designer between then and the (re)birth of XPages in 8.5. There were a few, but that was a long 10-12 years. I think the most notable was Designer being separated with the advent of R5.

During this time, IBM started doing services in markets usually serviced by partners. IBM directly competing with the partners that had made the product such a success. Microsoft, ever mindful of smelling blood in the water lurked about, picking off customers, picking off partners (play Jaws theme here). We then had IBM executives stand on stage and declare Notes all but dead. The waters that Microsoft had been trolling suddenly bubbled up like a school of piranha feeding on a wildebeest. The partner eco-system all but evaporated, and with them the customer base. After all, a services organization will quite happily "migrate" you and get all new licenses to boot. I don't agree with that stance, but I understand it. Seeing this prompted me to basically pick up my toys (app dev skills) and expand my skill set to pretty much every product in the Lotus portfolio, yet still I exhibited the classic addict symptoms, secretly squirreling away, using Notes apps to build an empire of sorts.

Fast forward to this week (well, technically last week was Jake's first post on this and JonVon's was this week), and all hell breaks loose. I'm at a loss as to why it is a shock that Lotus Notes and/or Domino developers are having to re-evaluate their options, be it short term, long term or something in-between. I said to a Notes developer a few months back, you can probably go your entire career being a Lotus developer, I'd doubt you'd be able to go 5 years being a Notes developer. See, my complete lack of faith.

So, how can this aircraft carrier that is Domino development be turned around? I really don't have a single answer. I think XPages and DDE are a good start but there is so much catch up needed after a 10 year hiatus that this is just scratching the surface of the issue. And the "black smoke monster" has not been sat idle, waiting for IBM to catch up. They have been making things easier, simpler and lowering the barrier to entry. Slowly eroding the customer and partner base.

So what can or needs to be done to avoid the vortex image above? Thinking Designer being free is not the panacea that people hoped. It should have always remained free, but freeing it alone will not change a thing. Sorry. Do not pass go, do not collect 200,000 new client seats. I think the comments on both JonVon's blog and on Ed's response have a lot of good ideas....somewhat like an IdeaJam....When you look at the comments on all of the blogs, I think the commonality of the responses indicate a complete lack of relevance with Domino development inside of many organizations, analyst firms and hell, even me. How can we make it relevant? Here are my suggestions, that just for the record, may not be new, may not be mine, and have been voiced by me previously at various locations around the U.S. Here goes....

1) Renewal process needs to be changed. Reps need skin in the game here. (I have an entire post brewing on this one.....)

2) Domino Apps are horrendously expensive to run sans-Express. You really wonder why LAMP and RAILS took off? You have to be at least as good as, and magnitudes cheaper than the competition to pull back from this. Think Hyundai in USA. The Genesis was 2009 Car of the Year. What did Hyundai have in 1999?

3) IBM need to stop cannibalizing your own client base (as Lance said on Ed's blog) with license changes, or even worse, Lotus Live.

4) I really love the idea of an Adobe Air based email client.....really I do....drool. An excellent example of true 2.0 capabilities available in Domino (again, as Lance said).

5) XPages needs OTHER F***ING data sources. Without it is never, ever going to be considered "enterprise strength" by anyone except a Lotus Notes developer....and don't charge me $25,000 of the privilege. If you continue to ignore this (or make me use Java) then you will fail. Plain and simple.

6) For the love of god, revisit the niffty fifty. OpenNTF is NOT the forum for this. OK, so Sharepoint doesn't ship with these. Really, that is your reason for not doing this?...That is what we call a potential opportunity!!! Proactive, not reactive! No offence to OpenNTF and the great work out there, but most Domino customers have no earthly idea this even exists. And even if they did, creating a team room database is far simpler than installing an OpenNTF application.

7) Polish what is already there and continue to increase the use of standards based app dev....true HTTP, DDE fixes, etc

8) Flood, yes FLOOD the markets with sales reps.....1/2 to 1 Lotus rep per State ain't working. Half of Florida plus Georgia is the size of the U.K.. Mind share is king. Domino app dev has next to no mind share.

9) You insist on "Notes is more than just email", but email is where it is at right now, so at least make it a world class email application - fix the stupid crap, allow me to move full text indexes to a separate drive so I can actually turn it on and not run out of space! Indeed try to make a mail client out of XPages, that may provide a good lesson in futility.

10) Directory independence.....sadly it is an AD world. TDI is nice but "Integration" is not what customers want.

11) Rejuvenate the partner community, I'm no ISV and never intend to be, but a platform is only as vibrant as it's ISVs. Kudos to those here now. When I count ISV's I struggle to use all 10 fingers....not good. On a similar vein, don't let the ISV's drive the application development road-map, that is what Notes developers, working as FTE's in side organizations are for....see 5.

12) Bribe, educate or photoshop pictures of analysts and "IT Journalists" with various farm animals. Get them to see what Howard Stern sees. What David Allen sees. What we see. While you're at it, also do this to others in the IBM SWG. Then get them all to write about it.

So there you go, the Lotus Notes and Domino application development 12 step program. Like addicts around the world, we now have a blue print for recovery. Now revisit the image at the beginning of the post, hopefully you now can see the stair case of hope and recovery coming up from the vortex?

This Week in Lotus 003 posted - Duke vs Duke

Darren Duke — Mon, 14 Jun 2010 08:45:48 -0400

Another week, another This Week in Lotus podcast. For those that listen to the 1352 Report you'll notice I do TWiL without my Indian accent ;)

Running (or thinking of running) Domino on VMware - free Q&A webinar

Darren Duke — Mon, 14 Jun 2010 08:13:54 -0400

Yours truly will be hosting a free Q & A webinar on 6/15 (tomorrow) at 1:00 PM EST.

From the STS Events page::

"Best Practices for Domino on VMware" June 15 via webinar. Email info@simplified-tech.com to register.

This will be very interactive so bring your burning, and not-so-burning questions. You can also email along your questions when you register, just to give me a heads up ;)

This is a follow on to my LUG presentations and white paper on the same subject. Make sure to look over these too...

Secure, internet email - made easy - meet Lotus Protector for Mail Encryption

Darren Duke — Wed, 9 Jun 2010 07:48:00 -0400

We all know what a dangerous place the internet is. All kinds of wretched scum and villainy just waiting to steal your personal details, trade secrets and various high value pieces of data. Not to mention Country, State and local regulations like HIPPA, SOX, J-SOX, etc. You (and more importantly your users) need to be real careful when hitting send to an internet bound address. What you need is email encryption, right?

Darren, S-MIME sucks. Really you want me to install a certificate in my personal address book for every recipient I wish to send email to? You *think* the recipient even has a S-MIME certificate to send me?

All valid points. And here is where the email encryption woes set it. Using "classic" email encryption is hap-hazard at best. Yes, you can enable TLS for SMTP but you rely on both ends of the connection being set up right......but S-MIME, well, it is just plain difficult to use, manage and maintain.

So what other options are there? Well back in April IBM Lotus released Lotus Protector for Mail Encyption (or LPME from now on). Basically this software appliance takes the frustration, management and general PITA stuff out of the email encryption process.

How? Well any email requiring encryption and/or digitally signed is handled in a way transparent to the both end users that are involved in the transaction. Yes, I kid you not. It does this in one of two ways:

1. Ad-hoc encryption - the sender decides that this email needs to be encrypted and/or signed
2. Policy based encryption - the server administrator dictates via policies what, and how to encrypt and/or sign based on customizable rules

Ad-hoc uses a (separately available client) installed on a Lotus Notes workstation. This "client" allows the Notes user to simply use the "Sign" and "Encrypt" checkboxes inside the Lotus Notes email client:

Simply check either of these boxes and the internet bound message is magically secured and will eventually find it's way to the recipient in a secure fashion....more on that in a moment. This is exactly how Notes encryption works. So no training of your users. (Note, this feature is an extra license and is not included with the LPME authorized user license).

Policy based rules can force a message to be encrypted based on a wide variety of rules. From subjects, to text, to text patterns, to recipients, to domains. You name it, there is probably a configurable rule for it:

So how does this magic appliance work? Well, it is kind of genius. Basically LPME is an enhanced version of the a PGP Universal Email Gateway server. What this means is that IBM Lotus didn't have to create the infrastructure to allow for public key encryption. They simply bought (or OEM'd) the PGP infrastructure.

To put this into layman's terms, one of the issues with internet email encryption is the creation and distribution of public keys. With Domino, we are spoiled. NRPC does this all for us. Once you hit SMTP that is a whole different matter. In essence LPME will look up a recipients public key on the internet (using the nomenclature keys.recipient-domain-name) or a "store and forward" mechanism can be used, or the LPME server can create a key for the recipient or it can be sent as a encrypted PDF (wow, see, that's what they mean by LPME intelligent encryption ) . Thus circumventing the majority of issues surrounding email encryption when sending to internet addresses.

Another really impressive thing about LPME is the way it is licensed. Any internet recipient is license free. Gratis. So you only need to license your internal users. And it gets better. The recipient has the option of receiving secured email in the manner that bests fits them. The options include:

Store and forward (aka Web Messenger) - here the email is stored on the LPME server and a HTTPS link sent to the recipient. The recipient then logs into the LPME server to view the message. A bit like a bank would do.
As a secure PDF attachment, encrypted with the recipient pass phrase.
Via a PGP encrypted email that can be decrypted with any other PGP compatible server or the PGP Universal Satellite client (more on that in a moment).
Via S-MIME encrypted email.
Regular email - although certain messages could still be sent via any of the above if deemed necessary.

Here are the options from an actual LPME server:

OK, but what if I don't have a PGP compatible gateway to decrypt the message? Simple. The PGP Universal Satellite client is a small executable the recipient can download from the LPME server and install on their PC or Mac. This client integrates with the following common email clients:

Lotus Notes 6.5.6, 7.0.3, 8.02, 8.5
Microsoft Outlook 2007 SP1 (Outlook 12)
Microsoft Outlook 2003 SP3
Microsoft Outlook XP SP3
Microsoft Windows Mail 6.0.600.16386
Microsoft Outlook Express 6 SP1
Windows Live Mail version 2009
Mozilla Thunderbird 2.0
Novell GroupWise 6.5.1

And get this, this is free for the recipient to download. There is no license fee at all for external, internet based recipients. Once they, the recipient, download the PGP Satellite client the LPME server creates a PGP key for the user. Upon installation of the client on the recipient PC or Mac the private key is securely downloaded to the PC or Mac, thus providing seemless end to end encryption of internet based email. Additionally, when the recipient sends email back to you, the LPME policies dictate that the message be encrypted or otherwise......just like outbound. Read that last sentence again.....Satellite downloads the policies from the LPME server and will enforce encryption and/or signing of inbound email to your domain. How fricken cool is that! And that piece is free to you and free to them!

OK, so this is great what does it look like? Well when I send an outbound external recipient a secure email this is what they see if they were using the free PGP Satellite client (example is an Outlook Express user running against an internet IMAP or POP3 server, in this case a bluebottle.com account):

As you can see above, the message clearly signifies it was both signed and encrypted during transit therefore delivering the message body securely to the intended recipient.

Similarly a Lotus Notes user, sitting behind a LPME server or using the PGP Satellite client would see pretty much the same thing (here you can see the bottom blue section that was cut off in the OE screen shot as well):

Again, the message has been signed and encrypted and sent via the internet (via an IMAP server no less) and received and decrypted by the receiving LMPE server. Impressive stuff indeed.

Another notable feature of LPME (aside from making SMTP email encryption easy) is that it can be installed either as physical appliance running on Intel servers, or as a VMware ESX/ESXi installation.

Like the other member of the Lotus Protector family, Lotus Protector for Mail Security (LPMS), it is licensed per authorized user, so you are free to cluster as many LMPE (and LPMS) servers as you wish. You can have the same 100% up-time you have with Domino servers with your edge encryption servers and/or (when using LPMS) your edge spam and AV gateway.

Oh, and LMPE also has an archive feature where you can route copies of emails to an "archive" server based on policy rules. Encryption doesn't mean lack of compliance. You can spy audit emails just as effectively as if they were never encrypted.

Disclaimer - I am a design partner in the Lotus Protector products, so I like them. There's a reason I like them.....they're impressive.

Contact info@simplified-tech.com if you need further information, a demonstration or to purchase. What are you waiting for, this is the simplest way to secure your internet bound email and comply to regulations, both internal and/or external. Don't wait for that lawsuit.....

Symantec have released a 64 bit version of SMSDOM

Darren Duke — Tue, 8 Jun 2010 18:09:08 -0400

Back on March 31st Symantec quietly rolled out the much over due Symantec Mail Security for Domino 64 bit version. It is available on FileConnect.

If you've been waiting for SMSDOM to support native 64 bit, now is your chance. Oh and version 8.0.5.124 and higher officially support Domino 8.5.1.

For more details see this Symantec post.