Recent Updates Page 71

Yesterday was my last day at Dell, Inc.  I was with the company for 4 years and did my best to push Agile methods including Test-Driven Development in the CMM-crazy enterprise.  I’m now a Senior Software Engineer for Pluck.  Pluck is a company with several business lines around RSS and content aggregation.  There is a C++ team here, and a .Net team.  I’m obviously on the .Net team, and it’s an Agile shop whose practices are a mix of several Agile tracks.

Speaking of Agile, the AgileATX (ATX is for Austin, TX) group is meeting for lunch today at the Mongolian BBQ on N Lamar just south of Rundberg at 11:30AM.  If you are in the Austin area, check it out.  You can also subscribe to the AgileATX Yahoo! group.

Microsoft has a whole new reputation now that so many employees are blogging.  There is a new face to the company, and it’s a good one.  Information is flowing more freely, and I think the community is more comfortable with Microsoft now.  The environment at Dell isn’t like that.  For one, it’s mostly a manufacturing or assembling company that produces computers and accessories.  The IT department is only a few thousand people, and the minority are software developers.  Second, management isn’t comfortable being that open, so I wasn’t free to talk about what’s going on inside the company.

At Pluck, I hope to be very open.  We have several consumer products that I’ll be talking about.  Pluck is a software company, so I expect it to be very different.  The first thing I noticed was the free drinks.  For the last 4 years, I’ve had to get my Dr. Pepper from a vending machine!  🙂

Juval Lowy, on Friday, gave a talk about Being more productive with the .Net framework. The session was “simulcast” on the web. Juval contends that most books focus on the raw technology, and this talk is dedicated to things that can enhance productivity when programming with .Net.  Below are the tips and tricks that he explained in the talk.

WinCV – the utility shows header-life information. If you need to search for a type, you can search for it. You can load your projects in WinCV by modifying the config file. In VS2005, there is a mouse menu item “Go To Definition”. VS will open the class headers in the code window. Using the “Code Definition Window”, you can hover on any type, and VS will put the class headers in the docked window.

WinDiff – Get your VS 6.0 CDs, and copy WinDiff to your box for use in comparing code files. Better than the comparer in VSS.

Animation Speed – The default speeds are a little slow, so go to Tools, Options, and put animation speed all the way up.

Multiple Startup Projects – in solution properties, you can launch multiple startup projects and have the debugger attach to them all for simultaneous debugging.

Linked Files – Every project has its own AssemblyInfo.cs, and you’d like your version number to be the same. Create a SolutionInfo.cs file with all the shared attributes and link the SolutionInfo.cs file into the project, and it will get compiled with the project.

Solution Directory – when creating a new project, VS puts it in a directory with the project name. If you click the “more” button, you can select a solution name and check “Create directory for Solution”, and it will give a cleaner solution hierarchy.

External Tools Integration – Automate invoking of external tools. Go to tools -> external tools. Give the name of an EXE to be invoked. Don’t hard-code the name, but insert a macro to insert, for instance, the assembly name. Then, more options will appear on the Tools menu.

Treat warnings as errors – Make level 4 warning for building. This should be the default setting.

Derive classes from Component to enable drag and drop – Inherit from System.ComponentModel.Component. Then you can use .Net data access designers with that class. If you hold down the alt key, you can use rectangular selection of code.

Editing config files – When viewing an app.config file, use the Document Outline to show a stepped outline of your Xml file. You can use this for Html as well.

Search hidden text – When doing a find, select “Search hidden text”, and it will search inside closed regions of code.

Conditional Compilation – Exclude a method call from compilation. Use System.Diagnostics. Stay away from #ifdef. ConditionalAttribute is a method-level attribute that controls whether or not to compile the method. Lines that call the method also become conditional.

Event Accessors – Instead of raw event member, use add/remove accessors like properties. It promotes encapsulation and loose coupling. C# has this. VS will have this in 2005. Use property-like accessors for delegates. Don’t expose your member variables. You wouldn’t expose fields, so don’t expose fields that are a delegate either.

Windows Forms Opacity – Every visible control has an Opacity property. It can make the window translucent or completely transparent. One use if if when you close a form, you want to have the window fade away.

Name threads – naming threads can be very useful in debugging. If you have multi-threaded code, and you hit a breakpoint, you don’t know what thread you are on. Give it a name as well.

Thread name breakpoint – Go to breakpoint window and make a conditional breakpoint. Set the condition to “System.Threading.Thread.CurrentThread.Name == “MyThreadName” In 2005, breakpoints have a filter command where you can use ThreadName = “MyThread” There are certain tokens you can use. By default, this feature is disabled in 2005. Tools->Option->Debugging->Enable breakpoint filters.

Killing a thread – Do not call Abort(). Abort() does not allow graceful exit. Does not allow error handling. Abort() is not guaranteed to run. Make a custom Kill() method. Should set flag and wait for thread to terminate. Abort() has another flaw. The thread can do indefinite processing in catch{ }. Juval went through a custom class that he uses to abort the thread.

Have a coding standard – Naming conventions and style, coding practices, project settings and structure, framework-specific guidelines. The standard should be thin on Why, and rich in What. Minimize harm. You can use the Idesign coding standard at www.idesign.net.

Import/Export Settings in VS – Tools->Import and Export Settings. This will make it easier to have everyone on the team using the same IDE settings. VS has team settings file. You can automatically reapply if newer version is available.

Language Version – You can restrict the Visual C# version. The default in 2005 is C# 2.0. ISO-1 is C# 1.0 (VS 2002). If you have a VS 2003 application, you can use VS 2005 to maintain this application by going to the project settings->Build->Advanced->Language Version. Selecting ISO-1 is the C# 1.0 standard. You will use the older compiler and it will ensure you don’t use new language features. Good for maintaining an olde rapp.

Interfaces factoring and design – One big class is a bad design. A bunch of little things unrleated is a bad design too. When designing, you pay for the cost of building a unit, and you pay for integration. A large number of modules is a high cost to interface (effort). A low number of modules has a high cost/module for effort.. You need middle ground. If you graph the two lines, you have an area of minimum cost. You want to be there. The key is properly factoring the interfaces for the modules. When factoring, think in terms of reusable elements. Interface factoring results in interfaces with fewer members. Just one member is possible, but avoid it. Optimal number is 3 to 5 members. In the .Net framework, interfaces have more methods than properties. You need a ratio of at least 2:1. The exception is an interfaces with properties only – should have no methods). Avoid defining events. On average, .Net has 2.75 members per interface. The methods to properties is 3.5:1. Less thatn 3 percent of the members are events. On average, .Net framework interfaces are well-factored. Someone also did a survey on the JDK. On average, they have 4 members per interface.

Steve Riley and Jesper Johansson gave a cabana talk on security myths. It moved to a big room because you can’t fit 700 people in a cabana room. It evolved into a breakout session.

They defined a triangle between usable, secure, and cheap. You can’t have all three. You can pick 2. Usable and secure are opposites. If it is both, it’s prohibitively expensive.

Network security claims:  Our network/software/hardware is “secure”, “impenetrable”, “unbreakable”.

Newsflash: Security is Hard! There is no easy fix.

The security myths:

• Security guides make your system secure.




• Hiding: Security by obscurity is weak defense.


• Rename Administrator account


• Turn off SSID Broadcast


• Do not display last logged on user


• Change your web/ftp banner


• If we hide, the bad guys won’t find us.




• Hiding: Security by obscurity is weak defense.


• Rename Administrator account


• Turn off SSID Broadcast


• Do not display last logged on user


• Change your web/ftp banner


• The more tweaks the better.


• All environments should follow the advice of <insert guide here>.




• Turn on account lockout after 3 bad tries.
  Password reset calls cost $70/call.
  Hackers can use that it as denial of service.
  It covers up the real problem: weak passwords. Instead, use pass phrases.


• High security is an end goal for all environments.


• Security tweaks can fix physical security problems.


• The lemming security model – always follow the expert recommendations.


• We need to audit _everything_.


• Password cracking is our biggest problem.




• Passwords need to be uncrackable.
  If you can crack a password, you need access to the hashes. If that is the case, you have a bigger problem.
  If you have the hash, you can use a tool to calculate an authentication.
  Smart card readers help this, but biometrics don’t because if you use a fingerprint for authorization, and it gets
  ompromised, you can’t throw it away and get another one.
  If the bad guys have your password hash, you have already lost.


• Security tweaks will stop worms and viruses.


• Technology can fix user problems.


• Friends will always be by your side: what is the basis of your trust?


• Encrypted attack traffic is much better than plain text.

Protect your Windows Network by Steve Riley and Jesper Johansson.

On Thursday afternoon, Stefan Schackow gave a talk on ASP.NET and IIS: New Developments in Web Security with IIS 6.0 and ASP.NET. I decided to attend this talk not only because I’m interested in the subject matter, but also because I’m the technical editor for his new book, Professional ASP.NET 2.0 Security, Membership, and Role Management by Stefan Schackow

Some of the security features of IIS6 are very cool. There is an new feature called wildcard mapping that will let the ASPNET runtime process a request before and after another request (like asp or html).

It was a great presentation on web security.

[Picture no longer available]I had the recent opportunity to ride a Segway at the convention center.  I think I did pretty good for my first time.

This afternoon I had the privilege of speaking with Miguel Castro at the cabanas.  He has some great ideas about web controls, and I learned a lot from him.  He has some great control downloads at his website, http://www.dotnetdude.com

Scott Guthrie gave a session on ASP.NET 2.0. I asked a question about excluding files from a web project, and I got a partial answer. In Beta 2 with source control, the system wants to check in binaries. That is a bug, and he says it will be fixed.

He declared that for Beta 2, all the built-in controls were enhanced with better client-side support for alternate browsers. Whidbey doesn’t require Frontpage server extensions or IIS to function. It includes a built-in development server based on Cassini. When you create a website in VWD2005, it doesn’t auto-generate anything for you. You start out with a blank directory. No WebForm1.aspx.

By default, Whidbey will release with the DOCTYPE set to XHtml transitional. The code editor has intellisense everywhere including css style attributes. The editor will not reformat you code, so that’s a big improvement from v1. It will also preserve your cursor position when you switch between design and html view. Html tags are collapsable now, not just in the code file.

Currently in Beta 2, there is not support for excluding files from a web site. That feature will be added for RTM.

I was impressed with Scott’s demos because instead of doing all the drag and drop with datasets and no domain model, his demoes included a business logic layer, and he chose to ignore the SqlDataSource control in favor for the ObjectDataSource control which binds to his custom domain object. Many demos encourage the wrong way to design applications, but Scott’s didn’t. Bravo.

Toward the end of the first half, he had a VB page, and the VB compiler crashed the IDE. He tried it again. . . .same thing. He switched to a C# page, and he was able to continue. That’s very interesting. I’ll have to try to duplicate that bug. Adding an OutputCache directive to a VB page.

In the afternoon session, Scott covered master pages, navigation controls, themes, membership and roles, and web parts. Scott wrapped it up by going through a localization example. There is a built-in scraper that will find localizeable strings and create the default resource file for you. Then you can create translations, and it’s done. You don’t have to localize every control manually. A “meta” tag in the control controls localization.

All in all, I’m very impressed with the ASP.NET 2.0 feature-set.

Wednesday was a lunch session for a live showing of the .Net Rocks internet radio show.  Carl and Richard hosted some folks from the Teams System group.  There is a lot of interest here at Tech Ed about Team System.  Every session regarding it has been packed.

This talk went over the internals of ASP.NET 2.0. Other sessions went over the RAD (*shudders*) capabilities of v2, but this session drills down to the compilation models and other more internal aspects of the runtime. There are several compilation models. One could leave all files on disk and have them autocompiled on demand, or one could compile up front. For pre-compiling, there is the v1.1 option where everything but the markup files are compiled, and then there is full pre-compilation where even the .aspx files are compiled.

V2 also allows for custom build providers. Build providers recognize a particular file type. If you make a custom file extension, the system’s build provider won’t touch the file type it doesn’t know about, but you can specify a build provider that does know what to do with that file type. A build provider provides both design-time intellisense as well as the runtime compilation. The build provider actually uses the CodeDOM to generate a manged class. It also supports receiving a string containing some managed code, but in that case, your build provider would be limited to one syntax.

VirtualPathProvider: This is _huge_ for the URL rewriting crowd. ASP.NET v2 will have a subsystem that will allows virtual directories and pages to be processed more cleanly than with custom HttpModules or HttpHandlers. This is exciting for me because it will help me improve my CMS.

Next, the speaker went over the new parts in the page lifecycle. Here’s the rundown:

OnPreInit: dynamic MasterPageFile, theme
OnPreLoad, OnLoadComplete
InitializeCulture: dynamic culture/UICulture code-gen call when attributes defined.

ASP.NET 2.0 also supports cross-page posts and control post-backs which will only execute a portion of the page lifecycle. When a control does a partial post-back (AJAX-style), the page loads its state and then raises a RaiseCallbackEvent to handle the control functionality. There is also a new mechanism to allow a page to post back to another. The control causing the postback declares a “postbackurl” property that references another page. The page being posted to has to declare the previous page so that the second page can get back to the first one. The mechanics of it load the state of page A and then transfers to page B for the execution. This strikes me as an entry-level feature that ASP 3 developers will love, but having a large number of .aspx files complicates the site when a good amount of logic can be encapsulated in controls.

In ASP.NET 2, the runtime supports an asynchronous page model. This will allow built-in async calls to web services from a page. The page doesn’t block until OnPreRenderComplete. If there is a lot of logic on the page (or called by the page), this can be a good feature.

I had a normal lunch at noon, but then at 1PM, John Bristowe, Christoph Schittko, Don Smith, and Dom Demcsak were going to lunch, so I went for a second lunch.  We talked about some geek stuff, and I ate too much.  What times!!