How To Make Your First Windows Server VPS Secure In Just A Few Easy Steps

Today a friend (Amr Eldib) asked a question on Facebook that I think a few of you may have as well:


I’ve never setup a Virtual Private Server out in the open on the Internet, and I was wondering how safe it would be?

I prefer Windows, because it’s what I know.

It’s intended to run all kinds of applications, blog, CMS, Wiki, file sync, photo storage, etc.

From your experience, what safety/security steps I need to pay attention to?

Does the security of the server depend on the applications or the OS, or both?

I had a relatively short and simple answer to this question. I’m sharing it here with you pretty much as-is.

My Answer

If you are looking for affordable host, I’ve always recommended SoftSys Hosting.

For most hosts, the server is locked down by default. Any OS will be subject to vulnerabilities though, so, make sure you have latest Windows updates (it’s OK to have Windows 2008 R2 instead of 2012 R2, might be better actually due to less resources it uses, any OS that’s not out of support should be OK).

The most common attacks are usually random attacks, the attacks that go to random servers trying to open default port numbers, default usernames and weak passwords, and try to identify / guess what software is installed on the server, and use the known vulnerabilities that exist in that software, in the hope that you didn’t have these patched.

Things you can do are removing/disabling accounts with default names like Administrator, etc., changing default port numbers for things like SQL DBMS and FTP / SSH if you use any, making sure things like SQL DBMS do NOT allow remote connections in the first place.

Also the application can be a thread. For example, hMailServer uses OpenSSL, so you need the latest version to make sure you don’t have OpenSSL hole. WordPress now installs minor/security updates automatically but you always want to check, and maybe even be careful what plugins you use.

Apply same rule to similar software packages.

Using OneNote As Wiki Inside Readify

onenote In recent projects I have been on with Readify, I have seen the rise of using OneNote to share most of the artifacts related to project. We still had requirement documents and proposals and all, and also tracking systems for ongoing and future work (backlog), but we used OneNote to record all sorts of information you’d store in a Wiki and/or in email and floating documents everywhere like:

  • Induction information (why does the project exist? how to setup dev environment? etc.)
  • Demo notes (what items are ready to demo? what are the steps? which users/links are needed?)
  • Meeting notes (demo meetings, sprint retrospectives)
  • Essential communication (Copies of release notes after sending, special notes coming in email / chat)

The availability of OneNote pretty much everywhere (including mobile devices, and web, as it’s hosted in out Office 365) and automatic synchronization made it a perfect alternative to a wiki for internal communication.

And yes, although I haven’t noticed this earlier, but OneNote also keeps track of all revisions and modifications, just like a proper wiki does.

If you want to learn more about how this approach worked for us in Readify, Tatham Oddie, one of our Readify Principal Consultants had an extensive writing of this model and other related communication strategies that help us excel at Readify.


Of course this is more applicable in situations where we do have more control over the way of communication. Not all projects follow this yet, and many projects work according to the established ways of our clients as long as they get the job done.

Using Visual Studio Developer Command Prompt With PowerShell

Running Developer Command Prompt for Visual Studio

The Visual Studio developer command VsDevCmd.bat only works with the cmd.exe command line shell/processor, which is still the native command prompt in Windows. Try writing some command in Start->Run or Explorer’s address bar, and you’ll find that you need to use the cmd/batch command syntax (for example, using %SOME_NAME% syntax for variables).

What if you want to us VsDevCmd.bat? You want the stuff it adds temporarily to the PATH and all the other goodies it brings, but prefer to work in Powershell?

Using VsDevCmd With PowerShell

You can try to run VsDevCmd.bat from PowerShell, but this will execute another command prompt shell on top of it.

However, you can also easily do the opposite. Run the VsDevCmd.bat, and from the command prompt, just type PowerShell and press ENTER. The new Powershell session will inherit all the fluff that VsDevCmd.bat added to the command prompt session.

A Quick Shortcut

You can always have a simple shortcut to load VsDevCmd.bat with Powershell instead of writing everytime.

Simply create a new text file, and enter the following in it:

Save the file and change its extension to .bat. When you run it, it will run the command prompt and keep it open, run VsDevCmd.bat, and then powershell.

You can test it by running, ensuring the prompt shows the PS > prompt for PowerShell, then run msbuild to ensure it was added to the PATH by DevCmd.bat.

Using By Default, ConEmu

On my personal machine, I use ConEmu as my all-time console environment. If you don’t know about it, Scott Hanselman described it in depth.

Among many other things, ConEmu allows you to create tasks that can be executed by default when you open a new console tab. This allows you to have for example some preset (task) for sat Bash/cygwin, another for cmd.exe, another for PowerShell, etc. Maybe even another task that loads some extra variables or whatever that you don’t want always attached, but still want them handy when you use the console. It also allows you to optionally choose one task to be the default when you open ConEmu.

So, for me, the task I set to be the default in ConEmu is the following:

the first * > bits are ConEmu specific, telling it to run task as admin and make it active tab (if you can set multiple tabs in the same task). And the -new_console: switch allows passing other parameters to ConEmu when starting, like d:D:\_data, which sets the start-up directory to a prefered directory I have. The rest in the middle is the simple command which calls VsDevCmd.bat and then starts PowerShell.


My Answer To The Question: Is having an online reputation on sites such as Quora important for young people?

Social SitesToday I’ll be sharing with you another answer I’ve added to Quora. The question I answered was:

Is having an online reputation on sites such as Quora important for young people?

And here’s my answer:

In a direct way, only specialised sites count. For programmers for example, a high rank in StackOverflow might be valuable to some employers.

Apart from that, for a site like Quora or so, a high rank will possibly be just like contributing to charity or playing a team sport. A little nice thing for the HR person or cultural interview.

However, there’s more…

Answering questions will likely require you to research topics that you thought you know, when you start explaining them, you get the areas you miss and you figure them out to complete the answer. As the old saying goes, best way to really learn something is to teach it.

Even if a normal answer like this one I’m providing  Just writing your thoughts does help organize them, which is a very good both mental and writing exercise.

So, in short, it’s nice, very nice to have, although not necessarily that important.

Maintaining your personal brand online with @TathamOddie – New Video

My new video featuring @TathamOddie on maintaining your personal brand both online and offline is now up…

Tatham Oddie is a well known public figure in Microsoft world as he speaks in so many .NET conferences around the world and is an active contributor to several high profile open source projects like WebFormsMVP.

In this video Mohamed Meligy interviews Tatham on online personal branding and ow you can makes the best out of people you meet in social media and offline groups. Tatham shares his experience on how to make it easy for people to recognize you and communicate with you for both social and business benefits.

My 2nd On YouTube: Chrome Website App Shortcuts

The first video I published on YouTube (on Angular.JS directives and data-binding) seemed to be going very well. This made me easily fall into the issue I avoided before, which is worrying too much about what might follow. To get that worry off me, I chose a simple topic targeting different audience, recorded and edited it in one night, and just published.

The Video

This video targets Google Chrome user. It shows a productivity tip that I heavily rely on on my daily PC usage. I have many application-like websites pinned to my taskbar, ranging from TweetDeck to Outlook 365 Web Access. In this video, I simply show how to create these icons. the video is only about 5 minutes in length.

Load any website like an application using Google Chrome

Going Forwards: Suggestions Please!

There are several things I need to work on to make these experiments more useful (and fun) for everybody. Mainly I need to get used to talking to the mic so that I don’t get that dry throat that I don’t usually have even when facing many people in my offline live events, but also, I need to find topics that YOU guys and ladies are interested in. I’ll try to stick with short videos for now, but please, if you have any idea for the next video, just let me know, and I promise to consider it seriously.

Thank you very much.

Download Visual Studio Updates For Offline Installation

In case you don’t know already, Visual Studio 2012 Update 2 was released April 4th (Official AnnouncementDownload PageRelease Notes).

Like the previous Visual Studio update, you get a very small EXE file, which you run to download the update from the Internet, install it, and then delete it. This means that if you need to install the update on multiple machines, you may need to download it multiple times.

In this post, I’ll show you how to get the EXE to download the files to a known location so that you can use it on multiple machines, my sample update will be Visual Studio 2012 Update 2.

Offline Download Instructions

  1. Download the standard small EXE file, for VS 2012 Update 2, the filename is VS2012.2.exe
  2. Open a command window at the same folder you downloaded the EXE to

    One easy way to do it is open the folder with Windows Explorer, and write "powershell" (or "cmd" for standard command prompt – both without quotes) in address bar

  3. In command window, write

    Note the "/layout" flag, this tells the EXE you want to download the files and keep them, instead of install and delete them. Also note the file name may be different for different updates (or if you saved it with different name)

  4. When a wizard similar to installation shows, choose the download folder at the first step and press "DOWNLOAD".   

    download location

    I suggest that you create a new folder to store the files to, what you are downloading is an EXE with the same file name as what you downloaded, and a "Packages" folder containing all different bits of the update

  5. Wait as the download completes. This will take time, long time. That’s why we want to do it fewer times, right?


    Once finished, you can copy the downloaded folder to other machines, and use the EXE next to (NOT inside) the "Packages" sub-folder to install the update without requiring any extra downloads.

The instructions are also found at the end of the download page, but it seemed that not many people noticed it, which is why I wrote this post.

Gotchas & Going Forward…

Note that the download tool isn’t exactly like your preferred download manager. Don’t expect download speed optimizations or error-proof resume for network failures, etc..

There is a feature request for the Visual Studio to include the update in an ISO file that you can download use the best way you like instead. If you want to see this happening, please vote it up here:

Identify Your Weaknesses & Optimize For Them

It is very important to understand your weaknesses and optimise your methods for them.

For example, I have a very hesitant random memory. At any point in time, I’ll remember some things in deep details, remember only certain characteristics (important or otherwise) of certain other things, vaguely recognize the existence of other things, and completely forget about the rest.

Ensuring which memory has which degree of remembering doesn’t seem to have a direct relation to be related to the nature of things themselves (people faces/names, papers, told/witnesses situations, etc.), how important the things are or relevant to current time, or even how old the memory is.


That’s why, every time I have made a record about what I want my future me to remember, and made sure this record is searchable (physically or digitally) in a way that does NOT require remembering a certain hint (because I tried that, and I ‘sometimes’ forget hints), the future me gets happy, when I search things that sometimes I am not even sure they did exist.

Yes, I just had one of these moments :)


Of course, understanding and encountering for your weaknesses should not be a reason to stop trying to overcome them!

On Communicating Your Message More Than It’s On Telstra NextG


For so many years, the Australian mobile network provider Telstra had exclusive right to use the 3G network frequency 850 MHz. All other carriers were only allowed to use the 2100 MHz band (“Optus” had 900 MHz in rural areas, although didn’t have them in so many government-licensed towers).

The low frequency band has contributed a lot to Telstra’s mobile success. The 2G networks had used it for long making it easier to extend to support 3G and Telstra had already more towers, the low frequency also can cross walls easier, making it better for in-house coverage. It was definitely a killer.

The Challenge

How did Telstra advertise this band? Their target was conveying a message about a real feature that’s just awesome, sounds easy? Well, it included a few challenges:

– Not all people are “educated” or “smart enough” to be good at networking and stuff, or even numbers in general. It’s easy for users to see this whole 2100 vs 850 as a minor detail, or even think it’s equal to 900 and go to Optus.

– The advantage wasn’t exclusive forever, hopefully by the time it’s open to others there’ll be better options, at least Telstra will have more towers (in reality, when this happened, Telstra was already starting its 4G network), They don’t want other network to claim they’re equal.

– Involving the user in technical terms can have bad consequences. Only a few phones support 3G 850 MHz, but all phones support 2G 850 MHz, even worse, those are called CDMA for 3G (sometimes WCDMA or GPRS) and GSM (2G). The user can easily think that a phone that supports 850 MHz GSM is good for 3G 850 MHz. Users are “too dumb” to always remember the difference.

– It may be possible for Telstra to have agreements with smaller providers (It happened, with the “3” network, they also resell their “2G” network to smaller provier), and they didn’t want users to expect they can get the full experience by going to these other providers.

The End

imageWhat did Telstra do? The solution was very easy and we all know it. Telstra simply made up a name for their 3G 850 MHz. They called it the NextG network. It doesn’t really matter which name because it’s just a product name, but having invented the name it means it becomes their exclusive trademark, that’s even better! Now everybody knew they’d have to choose between different 3G providers, and Telstra’s own NextG.

The Takeaway

Users even would sometimes ask other providers when are you going to support NextG; and the best they could say is that they’ll have “equivalent” networks, like Optus “YesG” which sounded like just a try (the first name sounded genuine standard not company specific, while “Yes” used to be common part of Optus products, also recently “Vodafone” started supporting 3G 850 MHz, while still working on 4G). Neither of them could legally say “we support NextG”.

The story is very interesting, even when you have a great message, the trick is how to deliver it, and when it comes to communication and delivering your message, the most successful sales and marketing stories are true gold treasures of inspiration.

Final Note

For so long I believed that I have several non-technical topics to discuss on this blog that may be interesting to the sort of audience GuruStop.NET gets. And only in very rare situations I was able to post these thoughts. The inspiration for talking abut this story was originally a group conversation on Facebook, but it was inspirational enough for me to write my thoughts down, once they were written, there was no excuse not to share them with you.

I hope you like this sort of posts. At least they’re better than not blogging at all (well, again, I hope they are, let me know if you have different opinions).

P.S. I must also explain that I never worked for or with Telstra. This is my own interpretation of the story based on reading so many forum posts and blog posts when trying to choose a carrier and buy a phone when  I first arrived Australia in Q4 2010.

The Year O’clock! Goodbye 2011, New Year Resolutions for 2012

imageFor many years, people used to laugh at the World End 2012 prophecy. This year, people’s joke was that we’d be very lucky if we manage to get to the end of 2011 even!
Yeah, 2011 is such a bloody, surprising, rich, optimistic, pessimistic, and loaded year. So many events, so many famous deaths, so much fire, so much energy, and indeed, so much hope.

Seems we are lucky anyway. We’re only less than two weeks close get into 2012, Many have either started their holidays already, or just about to.
Unless you believe that year is the end of the world truly (no, not discussing it even!), that alone should make you optimistic :-)

The title “Year O’clock” is not mine, it’s my colleague, Steven Nagy. I may talk about the origin of the name later, for now, let’s say it’s a friendly internal new year’s resolutions cheer-up message.
Few days after I responded to it, I thought I’d share my response with you too, after removing some customer identifying parts and adding some context to a few parts of course.

The Year O’clock Email:

Just Three Questions

  1. Work related highlights for the year

    • Been across 4 different big clients in the same year. Really enjoyed them all
    • Speaking at Developers Developers Developers Sydney conference
    • Not feeling like “a new guy” any more (joined the company September 2010)
    • Learned a whole lot of stuff while doing work. This is great highlight although probably so common
  2. Non-work related highlights for the year

    • Moved from a furnished apartment to non-furnished (renting), same street. More stability FTW
    • My son, Adam (2 years), communicates better, learned numbers and English alphabets plus some words (mixed), developed his own, errr, decisions / opinions!
    • A lot of small improvements to my blog at the last few months. Happy about them
      Hey, that’s GuruStop ;-)
  3. New year resolutions

    • Need to build an idea of my own badly. I worked in 2 start-ups, and did freelance for friend entrepreneurs, it’s really time to own something other than my blog
    • More clients and exciting stuff at Readify is a must, should keep every year even better
    • Do more talks, think of some non-told-already topic for local user-groups in Sydney (open for suggestions)
    • More blogging
      Shout at me if there’s something specific you prefer to read here :-)
  4. How will you be spending your holidays?

    • Home
      (um. don’t count this one)

    How about you?

    Let’s keep this going. I shared my own stuff with you as I encourage you to do the same as well. Blog it, tell me about it. You know I care.
    Happy new year. Enjoy it Smile