Sha la la la la la la lala lala ti dah

Stop it.

Just received an email stating there's a new podiatry "pathway" or "service". Basically you can refer people to podiatry to "alternative providers" and the NHS will pick up the cost. "Awesome," I thought, until I saw the restrictions:

- can't refer anybody who just needs toenail cutting (bear in mind the majority we refer are unable to cut their own toenails).
- can't refer anybody who has diabetes/peripheral artery disease/musculoskeletal problems etc (yet these are the patients who are most likely to have foot related problems!)
- can't refer anybody with severe corns, calluses or fissures
- anyone who can't get out of their home.


Fudge me. We can't refer anybody who is unwell, and we can't refer anybody who is fit and healthy. Just who the fudge is the service for? This is the kind of crap the NHS shouldn't be wasting their money on.

Some might be a social services problem. Toenail cutting would be considered a personal care, and should be covered by social services rather than the NHS. Though social services do their utmost to get as many people as possible declared a mental case and then it becomes an NHS problem.

I'm testing a microsoft surface RT tablet.

To fully utilise it, I need to tie my account on the device to a microsoft account (what used to be microsoft passport). Once you have done this, you can't log into the device unless that account's password can be verified with microsoft.

Our wifi network uses a form of authentication which won't let you access the internet until the wifi connection has been validated with your LAN account password. The config for that is tied to the machine account on the surface tablet.

Can anyone see an issue that might arise out of these two requirements?

The problem is the number of limitations. I refer patients who:

- can't look after their own toenails
- have nail damage that means the nail needs to be removed
- have multiple problems including diabetes, arthritis etc and have problems with their nails.

The problem is that this is the "pick and choose" method that the private companies all want to do. They take the easy stuff and leave the more difficult stuff to the NHS. In the future, you won't be able to have anything done unless you're fit'n'well, after which you'll be deemed unfit and unwell because you had something done!

Cherry picking the patients is what the private sector has done for years. It still has not stopped them botching cases. It does need to stop though.

It is the same on Windows 8. The Windows account is still available for local network authentication. But RT.can't be joined to a domain anyway. How do you connect iPhones and iPads to the network?

They don't have any problems, since they're not multi-user devices, they don't have online user accounts that need to be logged into that the wifi credentials are stored against. . The problem with multi-user devices is if you're not careful you end up in a catch-22 - to connect to the network you need to log into the device and to log into the device you need to connect to the network. I did try the 'use the last local password that was successful' option but it didn't seem to work for me. Ended up having to factory reset the device. Obviously with would not be good in the user population. Even if the 'use last local password' did work, I suspect that won't be a solution as it means you won't be validated against a Microsoft account and therefore won't be able to access things like the app store even if you can log in to the device then auth to wifi.

It's a condundrum.

As it can't join the domain anyway, it won't be able to validate against a Microsoft server in any case.

Windows RT is designed to work like an iPad or Android tablet in this situation. It might allow multiple user accounts (Windows Workgroup for a home network), but it doesn't support logging onto the domain, policies, roaming profiles, accessing domain shares etc. AFAIK.

When it was released, Microsoft explicitly said that it would be managed using EAS (Exchange Active Sync) policies, not domain policies.

It's absolutely nothing to do with your local Active Directory or joining whatever domains you may have set up. Nothing at all. When the device first boots, you get a choice to either connect it to a Microsoft online (e.g. passport/hotmail) account, or create a local account. However as it turns out there are a load of things you can't do with a local account, including download apps from the app store, and it pretty much nags you to 'tie' your local account to an online account anyway. It turns out to be Hobson's choice.

So, once you set it up as an 'online' device or linked the accounts together, the online account then takes over login authentication. So you need a working wifi connection (or maybe a USB to ethernet adapter...) to log in to the device. Once you log in to the device using a given account, your personal settings are available to device. Unfortunately, one of those personal setting is the 802.1x authentication credentials. Which our wifi network uses to authenticate, before which it allows you access to a very restricted wifi zone which doesn't have access to the internet at large. This is not at all an uncommon setup. But it's pretty much catch-22 for the Surface RT.

When you boot up the device, it detects the wifi network is available and connects to it. Woohoo, you're on the internet! Except you're not, because you haven't authed to the wifi network yet. That's not problem, you can auth to the wifi network once you log in. Oh...

As you say, there is a mechanism where if the online auth fails in this way, you get to log in using the 'last used' local password. In reality, this is largely useless.

1) If you didn't set up a local account in the first place, you're buggered (and the default choice is to set up an online account).
2) If you don't remember the password on your local account because you've been using your online account, you're buggered.
3) Once you get in, you have no access to your cloud data or any of the apps you've bought and downloaded, because you haven't authed to windows online. It may be able to post-login auth to microsoft online, I unfortunately didn't get far enough to find out.

It's utterly stupid that this is a problem. All it requires is for the system to support 802.1x authentication before a local user account is authed. You could even make it 'one use', so any 802.1x credentials entered priot to account login aren't saved anywhere and the system re-auths with saved credentials once you're logged in. But apparently they've assumed everyone will have access to the internet all the time. Pretty strange assumption on a device they don't sell a 3G version of.

Their setup is fine for home use as domestic wifi kit doesn't tend to use 802.1x authentication, just standard WEP style schemes that it does appear to support authing to before account login. But for enterprise, this is going to be an issue. I'm going to try setting up a windows 8 desktop in a VM on my laptop tomorrow, see if it resolves this differently somehow. It comes down to one fact : having the only method to unlock a portable device require a working internet connection is dumb. Android managed to do multiple user accounts without this problem.

Ok, that makes more sense.

That said, after the inital sign-up, you can log onto a Microsoft account without it being connected. I took my Windows 8 laptop with me to Ireland for 3 days and used it all day long, without being anywhere near a network. It had cached the password, so I could log in with my account, but I couldn't log on with a new account. I can't understand why Microsoft would do it differently on RT, because, by design (i.e. no Ethernet and no 3G), it is often going to be away from a network when in use.

If it is in Airplane mode, how would you sign on?

Is this my fail or an Amazon fail?

Capitalisation in user names.

I've messed up twice now. Once on my PC a while back, and also on my Amazon account. Both times I ended up with 2 different accounts with the same login, except one had a capitalised first letter. Now I can understand it for a *nix login, but on a website login? Why would Amazon believe that Jason wasn't jason?

I found this out when I installed the Amazon App app on my new 'droid. When I signed in it came up in Japanese and none of my previous purchases were listed. The click to buy also wasn't working, even on the free app I wanted.

By comparing the settings (in Japanese which I can't read) to my old device (in English), I noticed my name (the only thing I could read!) was in a slightly different format. I've now logged into the store using jason and Jason and I do indeed have totally different content...

The double fail is that the JP free game of the day is a gorgeous old-style space invader game called Radiant HD, while the UK one is a boring calculator

I seem to recall reading piece in PC Pro about the stupidity of Amazons login system. I can't remember the exact details but the columnist was essentially in the same situation as you - 2 accounts with minor differences. Amazon, despite being provided with ample evidence that both accounts belonged to said columnist, couldn't (or wouldn't) merge them together. I have a sneaking suspicion he'd managed to get 2 accounts with the same name but different passwords and Amazon had let them be set up in the first place then couldn't resolve the problem.