Go Komura

Registered Information Security Specialist Exam, Spring 2024 (Reiwa 6) PM Q1 Commentary — JWT alg=none, API Authorization, and Interim WAF Mitigation (archived 2026-08-30)

Using the Registered Information Security Specialist Examination's Spring 2024 (Reiwa 6) PM Q1 as a case study, this article explains JWT's alg=none, API authorization, Mass Assignment, brute-forcing a four-digit authentication code, and interim mitigation with a WAF. Archived ve...

Practical Multithreading Best Practices: Java Edition — Conventions for the Virtual Thread Era (archived 2026-08-30)

In Java, the established practice for multithreading is never to create threads directly but to build on ExecutorService and virtual threads. This article sets out the practical principles: choosing between synchronized and ReentrantLock, cooperative stopping via interruption, at...

The Depths of Windows I/O (Part 2) — Synchronous and Asynchronous I/O: What OVERLAPPED Really Means (archived 2026-08-30)

Part 2 of a series explaining Windows synchronous and asynchronous I/O (overlapped I/O) with diagrams. It covers what FILE_FLAG_OVERLAPPED means, the four ways completion is reported, the conditions under which supposedly-asynchronous I/O completes synchronously, how to cancel pr...

How to Handle ActiveX / OCX Today - A Keep / Wrap / Replace Decision Table (archived 2026-08-30)

When you find ActiveX / OCX, how to choose between keeping, wrapping, and replacing it, covering 32-bit / 64-bit, registration, browser dependencies, and vendor support. Archived version of https://comcomponent.com/en/blog/2026/03/12/001-activex-ocx-keep-wrap-replace-decision-tab...

Calling COM and .NET from PowerShell — Widening What Your Scripts Can Reach (archived 2026-08-30)

A practical guide to calling .NET classes from PowerShell, embedding C# and Win32 APIs with Add-Type, driving COM, cleaning up leftover Excel processes, why unattended Office automation is unsupported, and the differences between 5.1 and 7. Archived version of https://comcomponen...

What Is the TPM in Windows? — An Illustrated Guide to the "Safe That Never Lets Keys Out" and Measured Boot (archived 2026-08-30)

An illustrated explanation of the TPM: how keys never leave the chip, PCRs and Measured Boot, how BitLocker and Windows Hello use it, the differences between dTPM, fTPM, and Pluton, how to check the state with Get-Tpm, and what to do when you are asked for a recovery key — all fr...

Automating Excel and CSV Work with PowerShell — Practical Recipes for Aggregation, Reconciliation, and Report Output (archived 2026-08-30)

Practical recipes for automating CSV aggregation, reconciliation, and Excel report output with PowerShell. Covers the default encodings of Import-Csv/Export-Csv (how 5.1 and 7 differ), aggregation with Group-Object, reconciliation with Compare-Object and hash tables, and the cave...

Practical Multithreading Best Practices: C Edition — Writing Safely the Win32 API Way (archived 2026-08-30)

The established approach to multithreading in C with Win32 is thread creation via _beginthreadex, SRW locks and condition variables, Interlocked functions, and a stop design built on a stop event plus WaitForMultipleObjects. This article also covers the dangers of TerminateThread...

The Windows Firewall and Business Applications — Register Inbound Rules From the Installer (archived 2026-08-30)

"It works on the dev machine but the client can't connect" almost always traces back to the Windows Firewall. This article covers the default-block-inbound behaviour and profiles, why you cannot leave production to the security warning dialog, and how to register inbound rules fr...

Automating Excel and CSV Work with PowerShell — Practical Recipes for Aggregation, Reconciliation, and Report Output (archived 2026-08-30)

Practical recipes for automating CSV aggregation, reconciliation, and Excel report output with PowerShell. Covers the default encodings of Import-Csv/Export-Csv (how 5.1 and 7 differ), aggregation with Group-Object, reconciliation with Compare-Object and hash tables, and the cave...

Decoding Windows Error Codes — The Three-Layer Structure of Win32 Errors, HRESULT, and NTSTATUS (archived 2026-08-30)

When 0x80004005 appears, decompose it before you search. This article covers the three-layer structure of Win32 errors, HRESULT, and NTSTATUS, the most important pattern that 0x8007xxxx is a wrapped Win32 error, and how to look codes up with err.exe and PowerShell. Archived versi...

The Depths of Windows I/O (Part 2) — Synchronous and Asynchronous I/O: What OVERLAPPED Really Means (archived 2026-08-30)

Part 2 of a series explaining Windows synchronous and asynchronous I/O (overlapped I/O) with diagrams. It covers what FILE_FLAG_OVERLAPPED means, the four ways completion is reported, the conditions under which supposedly-asynchronous I/O completes synchronously, how to cancel pr...

AppLocker, App Control for Business (WDAC), and Business App Distribution — Before "Application Control" Blocks You (archived 2026-08-30)

Explains the differences between AppLocker, App Control for Business (formerly WDAC), and Smart App Control, and sets out what developers and distributors can do so that in-house business apps are not blocked by application control in customer environments. Also covers how to rea...

The Differences Between Windows PowerShell 5.1 and PowerShell 7 — A Practical Guide to Migrating In-House Scripts (archived 2026-08-30)

The relationship between Windows PowerShell 5.1 and PowerShell 7 (side-by-side coexistence and pwsh.exe), Microsoft's official position that 5.1 gets no new features, garbled text caused by encoding differences, defending yourself with #Requires, and updating Task Scheduler — the...

Replacing an Excel Ledger with a SharePoint List — Sharing, History, and Flow Integration to Put an End to the Broken Ledger (archived 2026-08-30)

A practical guide to migrating an Excel ledger on a shared folder to a SharePoint list (Microsoft Lists). Covers solving concurrent editing, overwrites and row misalignment, the import procedure from Excel, column type design, a correct understanding of the 5,000 list view thresh...

The Depths of Windows Memory (Part 3) — Section Objects and Copy-on-Write: What DLLs and File Mappings Really Are (archived 2026-08-30)

This article connects section objects, image and data mappings, the shared cache, and copy-on-write to explain how DLLs and shared memory share physical pages. Archived version of https://comcomponent.com/en/blog/windows-memory-internals-section-copy-on-write/, as published on 20...

A Practical Guide to Group Policy (GPO) — How It Works, Confirming Application, and Choosing Between GPO and Intune (archived 2026-08-30)

Are you working in an AD environment without really knowing what "distributed via GPO" means? This article explains, from a practical standpoint, how Group Policy works and the LSDOU order of application, confirming that changes have taken effect with gpupdate and gpresult, choos...

What Happens When You Tap a My Number Health Insurance Card — Reading Online Eligibility Verification and Its Integration with the Medical Billing System from ORCA's Source Code (archived 2026-08-30)

From tapping a My Number health insurance card to insurance eligibility landing in the medical billing system, explained through the end-to-end flow of online eligibility verification and the published source of ORCA (Nichi-Rece). Includes the 20 eligibility-verification APIs, th...

The Windows Firewall and Business Applications — Register Inbound Rules From the Installer (archived 2026-08-30)

"It works on the dev machine but the client can't connect" almost always traces back to the Windows Firewall. This article covers the default-block-inbound behaviour and profiles, why you cannot leave production to the security warning dialog, and how to register inbound rules fr...

Preventing Key-Person Dependency in Power Automate — Keeping Flows Running After the Person Who Built Them Leaves (archived 2026-08-30)

An overview of how to counter the risk of Power Automate flows stopping when their creator resigns or transfers: what happens when the owner is deleted, setting co-owners, taking over orphaned flows, designing the execution account, and stocktaking with a flow register. Archived...