deepdark.net - James Green's Blog - Geeking Out!

Visual Studio 2008 Professional vs. Standard edition. Just what are the differences? Is it Features?

James Green — Tue, 20 May 2008 12:56:04 GMT

Today at REMiX '08 Sydney (Also see VisitMIX) along with a good show and a grand feed, attendees also got a copy of Expression Studio 2. After seeing it in action I'm quite looking forward to taking it around the block. I never quite got into [Macromedia|Adobe]Flash, and am quietly hoping Silverlight can find a spot next to it in the web ecosystem.

First thing I did when I got home was install Expression Studio, I got a little curious to find that there is a Visual Studio 2008 Standard disk in the box. It got me to wonder what really is the difference between VS Pro which I am using at the moment and VS Standard?

I can't remember the product comparison pages for any version of Visual Studio on MSDN ever being completely illuminating. The 2008 version is about as good as it gets it seems.

The one that I am most interested in somehow is down the end of the list: the inclusion of the Unit Testing features in VSPro 2008, when it was only included in Team System versions of VS 2005. Here is a slightly abridged summary of the other features included in VS Professional that you do not get in VS Standard:

Debugging Tools:

Attach to Remote Process
SQL-CLR Debugging
XSLT Debugger
T-SQL Debugging

Data Tools:

Database Projects
SQL Server Projects
Server Explorer

Reporting:

Crystal Reports Application & Crystal Reports for Visual Studio

Office development:

VSTO for Office 2003 and Office 2007
Sharepoint 2007 State Machine workflow template

Smart Device Development:

Device Emulator
Project Templates
Debugging Tools

...but surely this can't be it?

It's not. Well, this is the story if you are comparing VS Pro and VS Standard alone, but there is one other thing to consider:

In my timezone, the full boxed retail VS Standard is less than half the price of the equiv. VS Professional... but;
You can't get an MSDN Subscription including VS Standard. They are only available with Professional and above, and imho the licensing benefits of MSDN for developers is well worth the look.

So there you have it. If an MSDN Subscription is on your radar, enjoy using VS Pro. If it is not, and you can live without the above listed features, well maybe there is no need to spend more than you have to.

The var keyword (C# 3.0) - Nothing at all like VB6 Variant - It's not even a Type!

James Green — Tue, 01 Apr 2008 11:25:00 GMT

This is the first in what I hope will become a series on the new language features in C# 3.0 used in .NET 3.5 / Visual Studio 2008.

One thing I am not intending to cover is LINQ. Just because the blogosphere has been buzzing with LINQ articles since the early days of "Orcas". And with good reason I hasten to add!

Where I am starting is with the var keyword.

VB6 veterans will remember the Variant type. A Variant could contain anything, even Object. While this was sort of useful, my memory of it is as a synonym for: I can't be bothered, lets just stick it in a Variant and deal with it later.

There was also a performance impact of using the special Variant type, they were large in memory and have an overhead of extra runtime checking that added up; like when assigned inside a loop for example. They were also a special case in their un-assigned form, taking on the value Empty (test with IsEmpty()) vs Nothing (test with Is Nothing).

So when I saw var added to C# I raised my eyebrows in the way a Fed might, when the beagle sits quietly next to your suitcase at the airport.

Most of the time you see it in the samples, it is used when returning an Anonymous Type from a LINQ query. And this is the clue! var is not itself a type, but instead it is a signal to the compiler to infer the type of an operation, and substitute in the required type. It does not even have to be an Anonymous Type. Consider the following simple example:

var result = 10 / 2.0;
Console.WriteLine(result.ToString());

By the time this code is compiled, var is replaced with double. In fact, the Intellisense on result will be correct for it being a double.

To confirm this, looking at those lines of the assembly in Lutz Roder's Reflector show the following after disassembly:

double result = 5.0;
Console.WriteLine(result.ToString());

OK, so var can be used independant of Anonymous Types, but why would you want to be less explicit in typing your variables? Consider the following fictitious example:

DatabaseRequestService req = DatabaseRequestService.CreateFrom(value);

And compare it with the equivalent line using var:

var req = DatabaseRequestService.CreateFrom(value);

Here, var leads itself to much more readable syntax with the same typing, Intellisense, and everything else!

Listening To: Róisín Murphy

Bringing Grep back using PowerShell

James Green — Wed, 05 Mar 2008 12:25:19 GMT

One of the things I miss from my Unix/Linux days is Grep. Previously I have tried things like Cygwin, but was never quite satisfied. I am quite excited about PowerShell and am always trying to get more PS> in my life :-)

I'm using Powershell almost daily to replace Grep.

To start, this is all based on the Get-ChildItem cmdlet. The best way to think about Get-ChildItem is it does what the Dir command did in DOS. One important difference is it is not just for files, and can be used to return all items in a location - and it is up to each provider to decide what a location & item means to it!

For the PowerShell n00bie, you can just use cd around the filesystem and when you type dir, you are really running Get-ChildItem. In fact when you type cd you are really running Set-Location. For a full list of aliases for common commands, run Get-Alias.

To search in file names:

The following command searches for .aspx & .ascx files in the current directory that have the word "metro" in the filename.

PS > Get-ChildItem -Include *metro*.as?x

To search inside text files:

The following command searches inside .aspx & .ascx files in every subdirectory that have the word "metro" in the filename, and has the word "train" inside the file.

PS > Get-ChildItem -Recurse -Include *metro*.as?x | Select-String -Pattern train

You are also able to add the -CaseSensitive parameter to the end of the Select-String command, by default it will search case insensitive.

NB: I have used the full names of the parameters of the commands. This may look clunky, but:

I wanted the examples to be clear, because this is a blog :-)
The Tab-Completion feature works for parameter names so they are not hard to type
You can use the smallest number of letters that identify a parameter. For example, if a cmdlet accepts a -Recurse and a -Record param, you would only need to use -Recu and -Reco respectively.

Update: A lot of parameters accept an array as input. The syntax for listing these is as a comma seperated list.

An example where this applies to our example is searching through multiple file types, i.e. .aspx and .cs.

The following example searches both .aspx/.ascx files and .cs files with the word "metro" in the filename.

PS > Get-ChildItem -Recurse -Include *metro*.as?x,*metro*.cs

Listening To: Wicket Beat Sound System, Inner Styles

iTunes messages not getting any better despite constant updates!

James Green — Fri, 15 Feb 2008 02:57:52 GMT

Out of the blue I got this message from iTunes today:

iTunes has detected an iPod in recovery mode. You must restore this iPod before it can be used with iTunes.

Fair enough, foo happens, life goes on. Or so I thought. When you restore your iPod and reboot it, the same message comes back! Over and over.

The solution, it turns out according to the collective wisdom of the blogs, is to change the drive letter of your iPod in Computer Manager.

Mine had, for reasons not yet understood, changed from J: to H: - which was in use as a network-mapped home drive. This conflict was being reported in iTunes as an iPod in Recovery Mode.

It seems like all I do these days is download iTunes updates, and the messages are not getting any better when it goes belly-up.

Apple, this is turning into a one way relationship!

Listening To: Zephyr Timbre, Absrtakt Fusion

First DR scare at the new office

James Green — Thu, 07 Feb 2008 07:46:14 GMT

Sydney had some very heavy storms today, on the back of what is an unseasonal string of storms. The drains outside my new home office were at capacity for the first time and with the rain coming down…

It flooded

However by and large things went well. First thing was to cut mains power to the room as a puddle was forming under my rack. A laptop was on hand and the LAN infrastructure was on power protection, so all the machines that matter shut down cleanly.

What did I learn?

My SQL Server (Proliant ML530, 2x Xeons, 3Gb, Ultra3 RAID) takes the longest to shut down so should be shut down first. Tacitly I knew this, but didn’t connect the dots at the time (with the UPS ticking away)
Power packs, in fact mains power in general should be off the floor. I am gonna make a policy about this. Again it could have been a lot worse but it was a distraction with the clock ticking. Command hooks are cheap and I will be making some CapEx 3M’s way shortly.
The floor is a bad place to stack paperwork. Nothing important was lost but Rob and Coronel has a date with the hair dryer
One of my UPSes goes Red with plenty of juice to spare. Might need to do more testing.

Sign your way to better quality with a x509 Certificate

James Green — Wed, 23 Jan 2008 05:26:10 GMT

Lots of people are familiar with obtaining and installing SSL Certificates for hosting secure web sites, but the area of code signing seems less cohesive. I’ve compiled some notes I have on the process together in this blog post.

Yes, but who are you?

Reputable publishers of code signing certificates require some evidence that you are authorized with respect to the organization you wish to have named on your certificate. In my case, being able to produce the ASIC registration for my company was enough, YMMV.

This is subtle, but important.

My company rego papers are credentials a Root CA (e.g Comodo, Verisign, Thawte, USERTrust etc) uses to trusts me.
The user (implicitly) trust the Root CA by using an OS with their Certificate installed.
Ergo, the user (indirectly) trusts me.

Macro projects in Microsoft Excel/Word/Visio/Access/etc

Once you have obtained your certificate, you are able to sign Macro projects in Office document templates by choosing Tools -> Digital Signature.

Your newly purchased certificate will appear in the list and by saving the project your template is signed. The difference is now the user is asked to trust you (as verified by the CA) and your code, rather than being asked to enable all macros.

Software distributed MSI packages

Signing MSI packages and CAB files is more visible than ever before in Windows Vista. This I think is a good thing, however I do worry that because there are a lot of unsigned installers out there that users may get the message that it’s not that important.

Once you have got your certificate from a CA, the process couldn’t be easier. There are a couple of ways to get signtool.exe, I usually have the Windows SDK on my machines which ships with it. The command to sign ClassLibrary1.dll for example is: (assuming signing from a pfx, not the local cert store)

C:\Program Files\Microsoft SDKs\Windows\v6.0A\bin\signtool.exe sign /f My_Code_Signing_Cert.pfx /p L0ng5ecr3tp@ssw0rd /d name /du http://www.MyCompany.com /t http://timestamp.verisign.com/scripts/timestamp.dll ClassLibrary1.dll

The time stamping is important here, in that certificates expire. An external time stamp ensures that the assembly was signed while the certificate was valid.

.NET Assemblies

Technically, signing an assembly is not unlike signing an MSI. On one hand it is easier because you can do the signing from inside Visual Studio’s project properties

On the hand there is the concept of delay signing, where the actual private key is not available to the developer on a day-to-day basis. This added security adds a layer of complexity that is frankly beyond the scope of this post. I will come back and dedicate a whole post to it some time :-)

Windows Logo Certification / WinQual

This is the only case I can think of where the vendor of the certificate matters. A certificate from VeriSign is required to prove your identity in the WinQual program, which is required for a Windows Logo certification. VeriSign has special pricing is on offer for members of Windows Quality Online Services site. The $99 cert from VeriSign is required for WinQual membership, and is all you need if you already have a code signing certificate. The $399 cert is valid for both code signing and WinQual membership.

What's in my developer toolbox for 2008

James Green — Mon, 14 Jan 2008 12:45:38 GMT

So looking forward to another year in Visual Studio, and this year in Visual Studio 2008 no less!

I thought I'd open 2008's blog posts with a note about what is in my toolkit at the moment for developing in VS2008. So in no particular order...

What is in?

Visual Studio 2008. I played with it since Beta1, and blogged about it a bit too. Living in the RTM now and quite liking it.
Refactor! Pro and Coderush from Developer Express are still on my list. There is a new version (3.0.5 at time of writing) out that has some cool new improvements.
Aptana Studio. I heard about this Eclipse-based IDE on the Hanselminutes podcast and had to check it out. There are some good features in there for CSS and JS. Worth having around and they cram a lot of IDE into a tiny space!
The PowerShell Visual Studio Templates. Powershell is getting more and more use in my life, and I love the idea of rolling your own cmdlet (pronounced: "command-let") to manage your own apps. The page says they are for VS2005 but they are good for VS2008 as well.
NMock. I know there are plenty of mocking frameworks out there each with their own style. I just happen to like NMock.

What is out?

The notable exclusion from my 2008 dev environment is NUnit. I have been a fan and user of NUnit for some time, but am going with the MSTest-based unit testing framework that is built in to Visual Studio 2008.
NAnt is on thin ice in my environment too in favour of MSBuild. This is largely for pragmatic reasons, there is project information kept in both the VS Solution and in the NAnt file and my preference is to maintain it in one spot only.

And that's it! I like to keep it light. For Continuous Integration I am using CruseControl.NET.

I'm still searching for the perfect XPath/XSLT environment. Visual Studio is OK for the moment, but I have a feeling that the perfect tool may just be Eclipse based :)

The MOSS / WSS decision

Wed, 12 Dec 2007 06:03:40 GMT

One question I have strugled to answer clearly in past is What is the difference between Windows Sharepoint Services (WSS 3.0) and Microsoft Office Sharepoint Server?

The first difference is in the name, and is best highlighted in the words of Richard Campbel of DNR/Run-As fame: When it is a service it is free, when it is server you have to pay for it.

The following diagram shows how I keep them apart in my mind:

To explain a bit: this is not a complete list of features, and not the most important features, just my favs :-)

So if you have any features that you think are really important and didn't get a mention, leave me a comment!

Listening To: You're Living All Over Me, Dinosaur Jr.

Running multiple secure (SSL) sites with host headers and a wildcard SSL Certificate

Tue, 27 Nov 2007 08:32:41 GMT

The problem with IIS6 that I have been curious about but up until today never needed a solution for.

The problem I am talking about is that with the IIS 6.0 UI you cannot set a host header on a SSL port for a domain. You can live a long and happy life with a 1-cert-per-server config but with the case of a wildcard cert (one covering all subdomains of the domain it was purchased for) you really want to be able to take advantage of these extra subdomains.

Consider an example from a server below. The two sites that are highlighted belong to the same domain - Lets call the red one www.MySite.com and the blue one shop.MySite.com. There is a wildcard cert installed on the machine for *.MySite.com.

The first one is easy. Install the cert and assign it to the site.

Setting this on subsequent sites on the same box is where you get the problem. It can be done, and it isn't hard, you just have to know the trick!

The trick is the adsutil.vbs script that is included when you install IIS. The default path to find these scripts is: C:\Inetpub\AdminScripts.

The process for assigning a host header for SSL to all subsequent sitess is:

Don't assign a SSL port number to the second site. Leave it on port 80 for now
Open a command window and change to the path with adsutil.vbs.
Run the following command: cscript.exe adsutil.vbs set /w3svc/<site identifier>/SecureBindings ":443:<host header>" In our example above the <site identifier> is replaced with the Id of the blue site, 1023406912, and the <host header> is replaced with shop.MySite.com
adsutil will assign port 443 to the site, you do not need to reset IIS

TechNet has a rundown of all the things you can do with adsutil.vbs and IIS6, so check it out. But don't get too attached - the Metabase is not showing up for IIS 7!

Listening To: The Boatman's Call, Nick Cave and the Bad Seeds

Free Security Guidance Training for Developers

Tue, 20 Nov 2007 12:37:00 GMT

I just saw these and thought they were worthy of linkage

Clinic 2806: Microsoft® Security Guidance Training for Developers.

Clinic 2807: Microsoft® Security Guidance Training for Developers II.

There is a good breadth of topics covered, and the price is right :-)

Removing SQL Server Embedded Edition after Windows Sharepoint Services 3.0

Mon, 19 Nov 2007 10:13:12 GMT

OK I'm wheeling out the Sharepoint Annoyances category for one last random show - until next time (kinda like the Rolling Stones)

The problem comes when you remove WSS 3.0 from a box and the instance of Microsoft SQL Server 2005 Embedded Edition (SSEE) does not get removed.

This is by design, however if the reason you are removing WSS 3.0 is because of a problem with the SSEE database you have a problem.

It turns out it is easy to uninstall after all - I found the answer via Jérémie Clabaut's blog.

The good news is it is a one liner to call msiexec. Quoting Jérémie:

msiexec /x {CEB5780F-1A70-44A9-850F-DE6C4F6AA8FB} callerid=ocsetup.exe

As is documented elsewhere - don't forget to move away / delete any errant Mdf/Ldf files as they can interfere with the reinstall.

Thanks Jérémie!

Listening To: The Velvet Underground and Nico, The Velvet Underground

Bluetooth protocol - an architectural overview

Wed, 14 Nov 2007 00:12:24 GMT

So I recently got my first Bluetooth phone. The whole purpose of the phone was to keep my calendar on the road in sync with my shiny new notebook, and it worked out OK actually.

Being a nerd I was curious about the Bluetooth protocol and how it works, the following is an architectural overview of how the protocol is used to sync calendar and todo items:

Outlook: oh Hai, iz me
Phone: Hai
Outlook: haz new itemz?
Phone: ya
Outlook: o rly?
Phone: ya rly, Lulz
Outlook: Can has new itemz?
Phone: here iz itemz rite now, k
Outlook: I has new itemz2
Phone: Srsly?
Outlook: ya, here iz them
Phone: we kool? awsum. kthxbai

Password Strength, again!

Mon, 05 Nov 2007 23:37:32 GMT

I got this message again this morning and I am so sick of it!

Only 16 chars? O RLY? What if my dog's name is more than 16 chars long?

Further investigation of the JS source reveals that other error messages include:

Password can only contain letters and numbers

I am always talking to people about password policy and no wonder people are confused. So much good guidance out there is buried under so much rubbish.

Compare this to the other user experience that is becoming more common:

Much better! There was a time when it would be appropriate to explain why the second case is better... but in this day and age it should be obvious. It is all about coercing people to do good passwords until they are made obsolete in the future.

Since Version 1.0.60731.0 of the ASP.NET AJAX Control Toolkit there has been a quite good Password Strength control available to the ASP.NET platform. Everyone else (like my first, deliberately anonymous example) can just Google it! There are plenty of samples available.

One that I liked was at Gerd Riesselmann's blog, where he shares (GPL) a simple example suitable for learning how this is done.

What do you think? Is there any excuse for giving poor password guidance in 2007?

Why do programmers confuse Halloween & Christmas

Tue, 30 Oct 2007 10:05:29 GMT

(I know, every year! and you will see it next year too so long as I am able to type :) )

Because 31 oct == 25 dec

Listening to: You am I, Hourly Daily

Hardware review: Dell XPS M1330 as a developer machine

Wed, 24 Oct 2007 09:23:41 GMT

So today I took delivery of my shiny new XPS M1330, here is my thoughts so far [end of day 1]

Background:

For years (and years…) I have been using a Dell Inspiron 1100. I think of it as the little laptop that could. I had a P4 and 1Gb of RAM but it didn’t take much to bring it to a halt. It also generated enough heat that I had global warming protesters picketed outside for a month… I tried Vista on it and it had a WEI of 1, and to top it off I cannot live in 1024x768 for one more day!

So trying to run the latest hotness like Visual Studio 2008 and SQL Server 2008 betas was completely out of the question.

It would also blue screen switching between screen and VGA out. OK, enough space spent on the old, bring on the new!

The new hotness

So I bit the bullet and went in for a new laptop. After much research I chose the Dell XPS M1330. In red. Pillar box red. Sexy lingerie red. Very very red.

While the 64Gb Solid State hard drive would have been an awesome inclusion, for the extra $1000 I just couldn’t do it.

Out of Box experience.

It comes in an XPS sleeve that is actually pretty good quality, down to magnetic fasteners and neoprene sides.

Further investigation revealed a folder to keep the CDs and manuals. It looked something like an executive folder you might take to a meeting. A nice surprise in there was an XPS microfibre cloth.

The first thing I noticed was the weight. This is one very light machine. Thin, small and light.

Upon plugging it in, the screen struck me as being exactly what the doctor ordered for the 1024x768 blues. It is clear, bright and crisp. Also very thin!

Design, design, design

It’s the details.

If you search for pictures of the M1330 you will always come up with a side profile but the coolness of the hinge design for the lid didn’t dawn on me until I saw it – no, until I felt it.

At the top of the keyboard are a set of controls to eject the CD/DVD, control the audio & playback etc. These are not buttons per se, but little touch sensitive spots that glow when you touch them. Very cool.

The XPS M1330 comes with Creative EP-630 Noise Isolation earphones that compare quite favourably to my standard work wear – Philips SHP805. They have 3 sizes of rubber seal for your ear, dunno how they feel when used for extended periods yet. This was a nice surprise.

...and there are other little supprises all throughout this machine. Someone, somewhere put thought into the design of this machine and it shows.

Now, to uninstall the crapware…

Having had a bit to do with Dell over the years, first thing I always do is open Control Panel and uninstall the bloat. I was pleased to see so little preinstalled on my machine.

I removed:

Google Desktop
Google IE Toolbar
Microsoft Works (I have Office and didn’t want to pay for a redundant CAL, so Works is the only choice when ordering)

Things that may go if they show me the first sign of trouble, but can stay for now:

Dell Browser Address Error Redirection (whatever that is!)
Roxio Creator Home

So, what’s not to like:

There are a couple of minor things – so minor I only list them for completeness. None of these are an obstacle to being very happy with this machine:

When you eject a CD the sound is like strangling a pigeon. Don’t ask me how I know what that sounds like, it just does.
Chipset does not support Intel VT. I use Virtual PC a lot, but VMs run fine without it.
The system comes with a 10Gb recovery partition. This isn’t a worry to me with 250Gb but if I had gone for the 64Gb Solid State drive for the extra thou’ I would be nuking this straight away
The battery in the media remote is tricky to seat properly.

The Essential Stats:

Dell XPS M1330

CPU: Intel Core2 Duo @ T7500 2.2Ghz

OS: Windows Vista Business 32 Bit

RAM: 4Gb RAM installed – 3.5Gb Visible to 32bit OS

WEI: 4.0, broken down as follows

processor: 5.1
RAM: 4.8
Graphics: 4.0
Gaming Graphics: 4.5
Primary Hard Disk: 5.2

Video: NVidia 8400M GS w/ 128Mb RAM – 1280 x 800 x 32 on 13.3”

HDD: 250Gb WD SATA

Overall

Since it is only day 1 I can't be definitive, but this machine shows every sign of being a great developer PC. Recommended.

Trouble with the SQL Server 2008 CTP 4 VHD on MSDN

Sun, 21 Oct 2007 02:48:20 GMT

The SQL Server 2008 ("Katmai") CTP 4 VHD that was published to MSDN Subscriber Downloads last week is made available as a 4-part self-extracting RAR archive.

It can seem to have an issue in while self-extracting. As shown in the screen cap below is it looking for en_sql_server_2008_ctp_4_vhd_part_1_of_5_.rar:

This is obviously wrong because a) part 1 is not a rar - it is in the exe, and b) the download is in 4 parts not 5. So if you see this prompt, browse for en_sql_server_2008_ctp_4_vhd_part_2_of_4_.rar.

Likewise when asked for en_sql_server_2008_ctp_4_vhd_part_2_of_5_.rar browse for en_sql_server_2008_ctp_4_vhd_part_3_of_4_.rar.

Finally when prompted for en_sql_server_2008_ctp_4_vhd_part_3_of_5_.rar browse for en_sql_server_2008_ctp_4_vhd_part_4_of_4_.rar. You will not be prompted for a part 5.

Once you have done that, fire up VPC or Virtual Server 2005 and enjoy!

Also, don't forget: You can check out the LiveMeeting events on the new features in SQL Server 2008 available through the Connect site.

Listening to: Aphex Twin, Selected Ambient Works, Volume II

The uneasy case of Linchpin Labs and Vista x64 driver signing

Thu, 18 Oct 2007 12:09:42 GMT

I have a ColorPlus monitor profiling spyder by what was formally marketed as Pantone and is now Datacolor and I profile my monitors regularly.

Today was the first time I have tried to profile it since I built my new dev workstation. It turns out the (circa 2004) ColorPlus spider that has served me well so far is now in the legacy bin. While it works great on Vista x32 with the XP driver it has not had signed drivers released for Vista x64.

This lead me to look at what was the latest news for loading unsigned drivers into Vista x64, since I only need the thing to run for 5 minutes once every couple of months I was hoping to see that there would be some BCDEdit trickery that may let me reboot into a non-standard config, generate an ICC profile and then boot back into "real" Windows. Seems that option was supported on Vista RC2 and removed for the RTM.

What has this to do with Linchpin Labs?

Further investigation showed up the case of Linchpin Labs (who have a Willoughby NSW address, as well as Ottawa CA). Linchpin released a widget called Atsiv that was itself signed and would let you load unsigned drivers through it.

Things got interesting when Microsoft categorized Atsiv as malware.

The Microsoft position on this is detailed in the Windows Vista Security blog, and the equally detailed response by Linchpin Labs is detailed on their site. It's unfortunate that Linchpin do not have a blog because it would be interesting to contrast the comments on the MSDN blog to any they attract.

As for the comments it seems lots of folks think their obligation ends with complaining. It may be fun to type crap on a message board, but my respect is reserved for the folks who put time into finding the solutions.

But, what seems missing in the discussion to me is that (depending on how you count the numbers) between 40 and 60 million copies of Vista have been shipped in 19 languages to 70 countries. Only a slim slice of that huge number of users are the tech savvy / tech professional community who, generally speaking, keep technology and the internet working and profitable for the rest of the world. I think it is right that security decisions favor the great unwashed masses rather than the techno-elite, who should be able to look after themselves. A bit of perspective please people.

If you get to the bottom of the Linchpin Labs announcement you find the following:

Linchpin Labs would like to suggest that Microsoft spend less time using debatable policy as a security mechanism, and spend more time actually tightening its operating systems.

Wha?? Isn't that what this is all about? Driver Signing Policy is tightening the OS. Other examples of Vista security enhancements include:

Restricted Services (service hardening)
DEP and NX, including supporting hardware-based DEP
User Account Control (UAC)
Windows Defender / Windows Firewall / Windows Security Center (techies: think of the 98% of the world; they need hand holding, OK)
Network Access Protection (NAP)
Bitlocker and EFS
ActiveX Opt-In, support for EV Certs and anti-phishing filter support in IE7
...

...and probabbly others. Yeah I'd call this tightening the OS.

Back to my ColorPlus Spyder...

So, looking at my options:

Get a Mac. Oh yes would I love to get a Mac. hmmmm :) But, desk space, power and brain cycles are at a premium at the moment. Also being a entry-level product the ColorPlus is a Windows-only product so it would mean getting a new spider anyway.
Get a new Spider. These are costly devices and not really top of my spend list right now. Maybe one day.
Abandon the DRM-infested evil Microsoft empire, like some of the commenters (e.g. "Joe" et al) on the Vista Security Blog suggest. Just try and have a 16-bit/channel colour accurate workflow in Linux. I've been there (not recently, but as far as I can tell things haven't changed much) and it's not fun. Just go and spend some a couple of weeks setting it up and let me know how you get on. Send me a postcard. Really.

Now for some real options:

Email Datacolor and let them know that people are interested in Vista drivers. Done.
Install a copy of Vista x86, update to the latest vid drivers, calibrate the monitor, pinch the ICC profile, reboot into my "real" Vista x64. It'll take 1hr tops. I'll get to this on the weekend.

~~um, anyone want to but a second hand ColorPlus Spyder? One careful owner, still with original box...~~

Listening To: The Polyphonic Spree, The Fragile Army

Update: My ColorPlus is no longer for sale :-)

It turns out that in the ColorVision Knowledge Base (under Support Centre) there is an article that says:

ColorPlus users can download Spyder2express software from the colorvision website's support section, and run that software with a ColorPlus serial number and a ColorPlus Spyder. The latest versions of Spyder2express are compatable with Vista32 and Vista64.

I can confirm this works. Spyder2express is a 120Mb download which is hefty since I only want the driver :-/ The ColorPlus is detected as a Spyder2 after installation and works as advertised.

...and would you believe their is a Mac version of ColorPlus 1.1 in the Knowledge Base that is not listed in the Support downloads. I'm happy to be wrong anytime it works out for the best :)

Listening to: The Campfire Headphase, Boards of Canada

The Zen of T-SQL - My SQL Down Under Code Camp slides

Sun, 14 Oct 2007 12:25:08 GMT

It was great being able to have the opportunity to elucidate my thoughts on this matter formally at SQL Down Under Code Camp '07.

For completeness, here are my slides: The Zen of T-SQL SDU CC.ppt (128.5 KB)

I really enjoyed meeting so many nice and very clever folks. Thanks to Greg and all involved in putting on the Code Camp, what a really great event!

For the record, the image is of Kasprowicz catching Pietersen at NatWest Challenge Final, The Oval, 2005.

:-)

Blogging for fun and proffit update - interesting linkage

Wed, 03 Oct 2007 10:54:39 GMT

I'm just catching up on my feeds and saw Nick Hodge's post with his slides from the Australian Blogging Conference.

Without the benefit of the associated naration they are still worth a look on the topic of business blogging.

Blogging for fun and proffit - Good taste in company blogs

Tue, 02 Oct 2007 07:24:55 GMT

I have been looking at company blogs to satisfy a mixture of professional and after-5 curiosities. The example I keep coming back to is 37signals.

The reasons they top my list are:

They separate their affairs into a product blog and the SvN blog "company" blog.
They are current
They are well written (easy to read)
They are frank

The product blog is a great read for hearing how to get the most out of their products. In their own words, Signal vs. Noise, a weblog by 37signals about design, business, experience, simplicity, the web, culture, and more.

For a tech R&D shop, this is about as good as I have seen. I'd also welcome comments on other good examples that people like!

An honourable mention goes to Art. Levedev Studio’s Life and Incredible Adventures of Optimus Keyboard blog where you can keep up with the hardware development in what may turn out to be the last word in keyboards!

The Zen of T-SQL, an example

Fri, 21 Sep 2007 13:44:04 GMT

I came across the following example in Inside T-SQL Programming, which I am digesting at the moment. Actually it is credited to Steve Kass (technical editor):

SELECT OrderId, OrderDate
FROM dbo.Orders
WHERE DATEDIFF(day, '19000102', OrderDate) % 7 = 0

This query is to answer the question "Which orders were placed on a Tuesday?". The query isn't particularly magic, but the idea behind it is as close to the zen of T-SQL as I can remember seeing:

There are 7 days between any two Tuesdays. If we know one Tuesday (like the 2nd Jan 1900) we have all the Tuesdays since.

What a great mindset to take with querying.

Listening To: Places like this, Architecture In Helsinki

Who sucks at 64 bit, #1: Adobe CS2

Thu, 13 Sep 2007 13:44:33 GMT

Problem:

Sorry Adobe, parentheses are valid characters in a path.

Solution:

Luckily the work around is quite easy...

Check the 8.3 name of the x86 Program Files path in this listing:

c:\>dir /N /X
Volume in drive C has no label.
Volume Serial Number is BA64-04DE

Directory of c:\

28/08/2007 01:04 PM            30,469 DXCORE~1.LOG DxCoreInsaller.log
27/08/2007 07:24 PM    <DIR>                       inetpub
28/08/2007 01:26 PM    <DIR>                       NVIDIA
28/08/2007 01:44 PM    <DIR>          PROGRA~1     Program Files
28/08/2007 01:42 PM    <DIR>          PROGRA~2     Program Files (x86)
27/08/2007 09:41 PM    <DIR>                       Users
28/08/2007 01:45 PM    <DIR>                       Windows

Creative Suite 2 will install and work if you actually type in the 8.3 name for the x86 Program Files path, like:

C:\Progra~2\Adobe

I wonder who is next...

Listening to: Northern Substructures compilation

New dev workstation time!

Thu, 13 Sep 2007 13:33:49 GMT

First, some breif background: My motherboard went belly up, electronic burning smell and all. Power supply was suspect too.

So time to go shopping!

The new motherboard is the ASUS P5K Premium.

For the CPU I went with the Intel Core 2 Quad Q6600.

An important goal for me was this build was Virutal PC performance, and I am pleased to report it is doing just fine.

The WEI score is up to 5.3, broken down as follows:

Processor	Intel(R) Core(TM)2 Quad CPU @ 2.40GHz	5.9
Memory (RAM)	4.00 GB	5.5
Graphics	NVIDIA GeForce 6800 GS	5.9
Gaming	graphics 2303 MB Total available graphics memory	5.3
Primary hard disk	107GB Free (149GB Total)	5.6

The most important change for me was installing the 64 bit edition of Windows Vista Ultimate. So far I've not had any dramas with drivers and only the odd run-in with apps. For this I have started a new category on my blog: Who sucks at 64 bit.

It would be remis of me to not mention the great help that Kernel at KNK Professionals was. He went to great lengths to make sure I had the hardware that I needed. All while his wife was giving birth to their first baby! Highly recommended.

Free Technical Books! First in best dressed.

Tue, 28 Aug 2007 01:51:24 GMT

Why? They are taking up space and not the latest editions.

How? Just leave a comment on this blog post. Include your email address if I don't know you :-)

The books on offer are:

Microsoft
Professional SQL Server DTS, Chaffin, Knight & Robinson [link]
~~Introducing Microsoft.NET, by David Platt (famed author of Why Software Sucks)~~ [link] Taken!
~~Programming Microsoft SQL Server 2000 with XML~~ [link] Taken!
Microsoft SQL Server 7.0 Administrator's pocket consultant [link]
Microsft SQL Server 2000 Administration Readiness Review for MCSE Exam 70-228 [link]
Microsoft Visual Basic Design Patterns [link]
Java
Java Servlet Programming. Hunter, Crawford. [link]
XML, XSLT, Java, and JSP. A case study in developing a web application. [link]
Java Enterprise in a nutshell, a desktop quick reference [link]
Linux
Linux Routers, a primer for network administrators, Tony Mancill [link]

Caveats: Some of these are a bit marked on the cover from normal wear and tear. Original CDs are still in the book where applicable. Email me if postage is required.

Today's Lesson

Mon, 27 Aug 2007 06:56:39 GMT

Don’t underestimate the sly and insidious lengths Personal Firewall products in general, and Norton Internet Security 2007 in particular, will go to in fulfilling its goal of disrupting SQL Sever Management Studio.

That will be all.
:-)

Quickest way to free Silverlight training? InnerWorkings and CSharpZealot work together to make you cooler than your friends

Wed, 15 Aug 2007 08:01:21 GMT

For a limited time, members of CSharpZealot.com have access to some free Silverlight training content! Here's how:

You will need to grab the Silverlight 1.0 RC1 SDK
.NET Framework, v1.1 (required by the InnerWorkings bits, regardless of the training being in Visual Studio 2005)
Register at CSharpZealot.com if you have not already done so
Follow the link on Brian's blog to InnerWorkings special promotion for CSharpZealots

Easy!

Also, I'm impressed at how well the InnerWorkings bits integrate with Visual Studio during the training experience. You should really check it out.

Now please keep in mind that Web 2.0 (and it's previous incarnation, Web 0.9) supports bi-directional time travel.

Forward, at a pace of 1 second per second, same as daily life, really; and
Backwards at a rate of 20 yrs in, say, about 150 miliseconds.

That means that if you are reading this blog post some time in the future, this offer may be closed. It's only open for a limited time, so get to it! Don't be the last guy on the block to not know how to use the MediaElement and VideoBrush in Silverlight!

Mad props (that's what the kids say these days, don't ya know?) to Brian Madsen, btw, for keeping CSharpZealot the place to get your .NET love.

Learning to program, part 1 - What you can use

Tue, 14 Aug 2007 03:26:16 GMT

A friend of mine dropped me an email that asked the following:

So, I’ve been thinking more and more lately that I should make some better use of my spare brain cycles and train time by learning some coding. Do you have any recommendations for where a total coding newbie with no money and no copy of VS should start?

So I thought I would answer in a series of blog posts. This is part 1.

The first thing is no money does not mean that you can’t have a copy of Visual Studio

The first thing to do is grab a copy of Visual Studio Express Edition. These are supprisingly capable cut down versions of the real Visual Studio 2005.

Go for Visual Basic or C# - don’t think C++ or J# are particularly good places to start learning code. Either is fine. Really.

Also, Visual Studio 2008 Express Edition is available in Beta 2 at the time of writing. Visual Studio 2008 is awesome, but again not the best place to start imho.

Then grab Visual Web Developer Express and SQL Server Express

Also, if you think MCP Certification is on the cards, each MS Press training kit comes with a 90-day copy of Visual Studio Professional.

UPDATE: There are some additional downloads to consider:

Visual Studio 2005 Express Editions Service Pack 1
Visual Studio 2005 Update for Windows Vista
SQL Server Books Online Update (May 2007). NB: These are updated a couple of times a year.

The second thing is no Visual Studio does not mean no .NET programming

#develop, or SharpDevelop is a free, open source development tool for C#, VB.NET and Boo.

It has a couple of limitations, but can be had for a tiny 8.2Mb download and dosen't carry some of the weight of Visual Studio while still keeping some of the look and feel.

Still have some spare bandwidth?

Grab the Windows SDK. It's probabbly a bit above the beginner level but it represents an execllent reference to what is happening under the hood when you come to need to know.

Grab FxCop (NB: you may have grabbed this as part of the Windows SDK). FxCop is a tool that looks at your programs and compares them to a set of rules for programming on the .NET framework. This is a little bit of an advanced topic, but also is a really valuable learning tool for avoiding bad coding habits.

FxCop 101: The default is to check your code against all the rules. As a beginner you probabbly don't want this.

Source code control is an important practice. Even for a single guy on a train.

For source code control I would recommend going with SourceGear Vault which is free for a single named concurrent user. It's really easy to install and get going.

Unlike SourceSafe, Vault is backed with a SQL Server database for better performance and backup support, and also runs over SSL and can run over the internet. Additionally it supports an Edit-Merge-Commit usage pattern in addition to SourceSafe’s Checkout-Change-Commit usage pattern – but that is a bit of an advanced topic so don’t get too distracted. Just know that it’s there for later.

What Else? I'd love to hear from anyone via comments here on this topic. What other bits should people go and get for programming on day one.

Listening To: DAT318 Applied ADO.NET Entities from Tech.Ed '07.

Off to Tech.Ed!

Tue, 07 Aug 2007 02:34:22 GMT

If you are attending and wanna hang out, drop me a line via this blog.

Otherwise, see you next week* :)

* by which time I will be significantly smarter... ;-)

Update to: Everything you need to know to get started with System.AddIn

Tue, 31 Jul 2007 01:49:06 GMT

The CLR Add-In Team Blog has just posted a list of the 7 new features that they have included in Visual Studio ~~Orcas~~2008 Beta 2.

Group Policy for Web Developers, Part 3: IIS security accounts

Thu, 19 Jul 2007 06:39:09 GMT

This is the third of my posts about group policy for web developers [part 1] [part 2], and today's post is a from-the-trenches tail about how you can get 401.1 Access Denied as a result of applying group policy.

Mad props to Jimmie Russ and his post Access Denied 401.1 goes away temporarily after IISRESET, as it was his post that sorted my problem today.

As you will see in his post, it is possible to push out User Rights Assignment policies via a GPO that can define the following rights:

Log on as a service
Log on as a batch job
Allow log on locally
Access this computer from the network

The above list may not be complete, but it was these four that caused a problem in my IIS environment.

Two tell-tail signs that this is your problem:

If you run the always awesome AuthDiag utility and it reports that certain local accounts (like IUSR_*) have rights missing, specifically the ones listed above.
When you view the User Rights Assignment in Local Security Settings

The above four rights are locked (have a little lock icon instead of the "blue 1s and 0s icon") and are not able to be edited.
The above four rights are not granted to our local accounts (again IUSR_* et al)

Again, it may not always be exactly those four - what you are looking for are policies that will not allow your IIS accounts (as listed in the AuthDiag results) to log on.

If I had my time again, I would have cranked up the failed security events and listed them here, but my servers are working again and I like it that way so this can be left as an exercise to the reader :-)

As Jimmie said, the solution is to have these rights not pushed down to your web servers. This can be by not applying them in your Default Domain Policy, or by putting your web servers in a seperate OU blocking policy inheritance. If you're not sure, consult an expert.

Bad Day, one of my servers is on fire... :-(

Wed, 18 Jul 2007 07:08:36 GMT

Sorry to anyone who is waiting for an IM, email, phone call or anything from me... there is a burning smell coming out of a server :-(

If you need me, I'll be double-checking that I have valid backups...

Update: The acrid smell I mentioned above was in fact the smell of fresh just-out-of-warranty power supply. I even had to wash my hair to get the smell out. All is OK now. :-)

Everything you need to know to get started with System.AddIn (...Plus sample code!)

Thu, 12 Jul 2007 07:18:15 GMT

How to start?
You will need several assemblies. This is because to reach the level of decoupling that is desired, the pipeline has a certain pattern of dependencies between projects. I’m not sure if I am subconsciously not objecting to it or actually actively like this now, was not always the way.

A pipeline?
Yes, you need one.

What is a pipeline?
It’s a series of folders that live somewhere (does not have to be under your application's path) and each of the assemblies have their place in the structure. The folders will look like this:

It’s probably a good idea to build one now in your project tree and set the build output as you go.

There is a graphic explaining the pipeline on the CLR Add-In team blog (with nice colours), it is also in the Orcas MSDN under the title: "Pipeline Development Requirements". The MSDN one has the addition of lines to indicate the static dependancies.

I've chosen to show it differently in my graphics (don't say a word!) to indicate the order of it all coming together as well as the references. In the graphic the arrow lines illustrate the dependancies between the projects.

Also, I make reference to the sample code throughout this post. Download link is at the bottom.

Step 1: Define Contracts

The first step is to define the contracts in your contracts assembly and DTOs in your DTO’s assembly.

Your contract should be one interface per kind of add-in you will support. These interfaces need to inherit System.AddIn.Contract.IContract and be decorated with System.AddIn.Pipeline.AddInContractAttribute.

Types in the DTO that you wish to pass over the boundary will need to be serializable.

Jason He’s example of a Paint.NET Add-In (link below) takes a different path, by adding the extra types in the Add-In View, adding more wrappers. His approach may have advantages that I have not discovered yet, but it reminds me of some of the dancing you have to do when for example you have the same type in a Web Reference and a binary reference in the same project.

My preference is then to make a behavior-free separate assembly that anyone can take a dependency on safely. This is the reason for including a DTO project. I also like having the DTO types there to do as a [DataContract] does in WCF. This will allow the Add-In contract to remain static if the host side changes it’s implementations of the DTO equiv. types.

Change the project properties of the Contracts project to build to: ..\Pipeline\Contracts\

Also note, for types that take a dependency on the DTO project, set the Copy Local property of the reference to False. This is to keep the pipleline path clean. i.e. we don’t actually want a copy of the DTO assembly in the \pipeline\contracts\ path! This will slow our discovery and generate warnings as the Add-In infrastructure tries to examine it for contracts.

Step 2: Host View and Add-In View

Add two new assemblies: host view and add-in view
Each has a public abstract class that mirrors the contract interface but does not reference it.

Host view does not even need a reference to System.AddIn.

When building the Add-In View, be sure to:

Apply System.AddIn.Pipeline.AddInBaseAttribute
Set the project to build to ..\Pipeline\AddInViews\

Step 3: Host Adaptor and Add-In Adaptor

Add two more assemblies: host adaptor and add-in adaptor

Add-in adapter will have one AddinToContractAdapter class for each Add-In type and the Host adapter has one ContractToHostViewAdapter class for each Add-In type.

The AddinToContractAdapter descends from System.AddIn.ContractBase and implements the contract for the Add-In

The ContractToHostViewAdapter descends from the Abstract class in the Host View for the Add-In.

Set the build output path of the Host Side adapter to: ..\Pipeline\HostSideAdapters\
And set the build output path of the Add-In Side adapter to: ..\Pipeline\AddInSideAdapters\

The purpose of these adapters is too marshal calls between the instances of your IContract's and should just look like wrapper code.

Step 4: Build the Add-Ins

Every Add-In needs to take a dependency on the Add-In View project and the DTO project. Be sure to set their Copy Local = False in the reference properties.

Each Add-In also needs to descend from the abstract class in the Add-In View project, implement overrides, and to be decorated with System.AddIn.AddInAttribute.

The AddIn Attribute is the key to how the Add-In will be seen by the host so pay attention to the parameters on the constructor.

Set the build output path of each Add-In to: ..\Pipeline\AddIns\<addinName>\

I should mention that the Add-In's in the sample code below are just stubs to show the complete loop. The Book Library Add-In returns empty objects of the prescribed types, the other two throw an Exception. This is to show error handling.

Step 5: The Add-In Host

Take a reference to the Host View and Dto projects, this time it is OK to have the reference Copy Local.

In the attached example the Book Library add-in returns empty objects of the designed type, however the other two (DVD Library and CD Library) throw an Exception for each operation.

By the end of the process, the project will look like this:

Trouble shooting & Error Handling

Just skiming over this topic, but it is wise to wire up a handler to AppDomain.UnhandledException for the app domain that will run your Add-Ins, and Application.ThreadException (Windows Forms examples) as well as wrapping calls into the Add-In with a Try... Catch block.

If you are trying to work out why your AddIns are not being discovered, remember that:

AddInStore.Rebuild()
AddInStore.RebuildAddIns()
AddInStore.Update()
AddInStore.UpdateAddIns()

...all return an array of strings that can be examined to determine how the AddIn discovery went.

Source Code:

The source code for this example is available for download from the following link:

LibraryAddInDemoCode_deepdark.net.zip (152.81 KB)

It requires Visual Studio Codename Orcas Beta 1.

Summary:

There are a couple of steps to implementing the new System.Addin stuff, but none of it is hard!

...and considering that it replaces a lot of very untidy and error-prone Reflection code that we had to do in prior versions of the framework I think this is a great addition to the toolbox.

This post is not meant to be a hardcore reference, just the total of my experience with this technology to date. If you have any feedback please don't hesitate to contact me by email or leaving a comment on this post.

Sources:

CLR Add-In Team's blog
Jason He's CLR AddIn Model in Paint.Net series [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11]

Listening to: The Chillout Sessions 3

What is the Go-Live story with .NET 3.5?

Wed, 11 Jul 2007 04:34:36 GMT

I think this question is really suited to two kinds of people:

Criminally insane. Reckless to a point considered, well, imprudent. :-) You lick the top of 9V batteries; you chew on tin-foil. You cut your toe nails with a Leatherman. You bank the farm on a technology that is still moving because pain is your friend.
People who may ship a product before .NET 3.5 ships. .NET 3.5 has some new technologies that I am going to want to use. Three that are immediately relevant are: new Active Directory bits, System.AddIn, and the goldern haired child, Linq.

These are bits that (esp. Linq) I want to bake in. Right now I don’t want to code up bits that I know I am going to have to rip out soon in order to replace with the richer platform.

My ship dates are uncertain… if the product name is anything to go by Orcas is at least 6 mths away. The real question in this post is how to mitigate the risk of being ready to ship before the platform is, and what to keep an eye on.

Please feel free to leave a comment or email me if you have clues for the above question :-)

IIS 7 & Longhorn Beta 3 already has a Go Live license. I believe them when they say it is good quality, and I believe them when they say it may still change. Is a similar license something that we may see for .NET 3.5 as more betas or CTP’s become available?

Update: Feb 27 2008 is looking like the launch date for SQL Server 2008, Visual Studio 2008 & Windows 2008.

CodeRush Maintenance for Vista. Smart Cut / Intelligent Paste

Tue, 03 Jul 2007 04:21:07 GMT

I have been noticing that CodeRush / Refactor Pro! are playing up every so often my shiny (well, dusty) new Vista PC.

The symptoms are minor, but annoying when you have your fingers trained :-) Basically Smart Cut / Intelligent Paste stop working.

Turns out, the solution is on the Expert options: Startup \ Re-register CodeRush commands with Visual Studio on next startup. Easy!

...Then you can have all your pretty refactoring graphics back!

What is the .NET landscape to date and going into the next year - part 2: Framework Versions

Mon, 02 Jul 2007 23:11:18 GMT

It became clear to me during my last blog post on the .NET landscape that it was going to grow into more than one post.

Framework Versions

One fact that is important to note about the graphic in that post, and it was the catalyst for me making the drawing, is that the .NET 3.0 and .NET 3.5 frameworks do not supersede .NET 2.0 but augment it.

What I mean by this is if you were to look into your %WINDIR%\Microsoft.NET\Framework\v3.0 folder you do not get a new System.Data.Dll or System.Web.dll. Instead you see the folders for:

If you look in your %WINDIR%\Microsoft.NET\Framework\v3.5.xxx\ (still beta at time of writing) the main thing to note here is a new csc.exe and vbc.exe.

So what do you get with .NET 3.5 & Visual Studio 2008 (codename "Orcas")?

Managed AddIn Framework (System.AddIn & System.AddIn.Contract) ...also the CLR Add-In team blog.
An AD/ADAM wrapper (System.DirectoryServices.AccountManagement)
A WMI 2.0 Managed wrapper (System.Management.Instrumentation)
Peer-to-Peer API's (System.Net.PeerToPeer & System.Net.PeerToPeer.Collaboration)
In ASP.NET there is ASP.NET AJAX, asp:ListView, and the LinqDataSource. (System.Web.Extensions)
Improvements to WCF and WF (System.ServiceModel.Web & System.WorkflowServices)
ADO.NET Entity Framework (System.Data.Entity)
New Crypto algorithms and support for Vista's Next-Gen Crypto, which replaces CryptoAPI. (System.Security)

Update: Please also check out Daniel Moth's whole bunch Orcas posts, and his run-down of the new bits.

...and last but not least, the golden haired child, LINQ...

LINQ to Xml (System.Xml.Linq) and LINQ to SQL (System.Data.Linq) ...also ScottGu's posts here, here and here are some of the best you'll find)

...and for everything that I have missed, or is not in the beta bits yet, grab the Orcas overview whitepaper.

What is .NET 3.5 going to do to 3.0?

It seems it has to do with Green Bits and Red Bits (source: Daniel Moth). In other words, .NET 3.5 will also include SP1 for .NET 3.0 and SP1 for .NET 2.0.

What is the .NET landscape to date and going into the next year - part 1

Sun, 01 Jul 2007 13:51:05 GMT

When I started playing with LINQ, I needed to get some clarity ~~on this in my mind, so in the spirit of~~ ~~Linnaeus~~, ~~Mendeleev~~ ~~and~~ ~~Gell-Mann, I put together a graphic that showed the generations of the various bits, and after talking with friends thought it was worth sharing:~~

Update: Daniel Moth has a better graphic for the same data on his blog first. Shame, not an image map. :-)

Mohammad Adil Akif also has a version in his blog.

...This is the blog version - the original form was a Post-It note.
...And in the spirit of Web 0.9 (which came before Web 2.0 :-) the graphic is an image map :-)

I know there is much more coming, like the Dynamic Language Runtime, Domain-Specific Language tools, Silverlight, and so on. I've also chosen not to call out the versions of Team System, both in the interest of clarity.

Adding a pinch of spice to a search box with CSS

Wed, 27 Jun 2007 13:32:32 GMT

Today's post is about a nifty little trick that I have seen done with search text boxes on sites over the years and I decided that it had to be in my toolbox too.

What we are going for is a search box that looks like this when the page loads: >

...and looks like this when the user clicks into it:

This technique seems to mostly be applied to search boxes, and I can see the benefit in that.

The post that follows is the amalgum of many VS-A's

To get this done, it is a bit of CSS to style up the inactive and active state for the text box, and a tiny bit of Javascript to tie it together. I'm using the term active and inactive not in any technical sense, just to describe the two styles that are applied to our text box in response to the user activity.

(assuming the rest of the page is a drab #f0f0f0 in colour...) These are the two style rules that we are using in the images above:

.inactiveSearchBox
{
    background-color: #f0f0f0;
    border: solid 1px #ffffff;
}

.activeSearchBox
{
    border: groove 1px #d9d9d9;
    background-color: #ffffff;
}

The markup for the input box is then as follows:

< input type="text" class="inactiveSearchBox" id="SearchStrng"
   value=" Search Here"
   onFocus="this.className='activeSearchBox'; if(this.value==' Search Here')this.value='';"
   onBlur="if(this.value=='')this.value=' Search Here';this.className='inactiveSearchBox';" /> >

>As you can see it all happens in the onFocus and onBlur events of the textbox. When the text box gets the focus it sets the class to be our activeSearchBox style and clears our standard text. The onBlur event restores the default value if the user did not enter anything and sets our style back to the inactiveSearchBox style.

Glossary:

VS-A, n. View Source, followd by an "Ah!".
See also: VS-****.

Listening to: Former co-workers :-)

Supporting OpenSearch in your site, seriously... 10 minutes

Fri, 22 Jun 2007 07:11:55 GMT

You can do this today, like in 10 minutes...

OpenSearch is a format for describing how your site is searched, and optionally for adding Search elements to other formats like RSS.

Auto-discovery of OpenSearch description documents is done via a link in your HTML head like so:

The OpenSearch xml document is interpreted in the browser to add extra search providers in the integrated search function as so:

The contents of the file can be short or it can be long. A bare bones example may be as simple as this:

<?xml version=”1.0” encoding=”UTF-8”?>
<OpenSearchDescription>
   <ShortName>My Site</ShortName>
   <Description>Search My Site</Description>
   <Url type="text/html" template="http://www.mysite.com/search.aspx?terms={searchTerms}"/>
</OpenSearchDescription>

The spec gives another simple, and one much more detailed example document. The IE blog also goes into some detail... but in true internet fashion, View Source is the quickest path to an example :-)

Security?

The bad news is, as of current browsers at time of writing (IE 7.0.6000.16473, Firefox 2.0.0.4) it seems controls are quite lax around what search template you can include, I had no problems setting the URL in the search template as being a completely different site!

While it would be completely hilarious to posion someone's search bar as a prank with the following three facts...

IE stores the search settings here: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes
FireFox stores them in the filesystem: C:\Documents and Settings\<winprofile>\Application Data\Mozilla\Firefox\Profiles\<mozprofile>\searchplugins
(sounds like google, not work safe)

I would ultimately like some control here. I can't see anything in Group Policy for enforcing/allowing/denying new search providers. I'd like to add one to all PCs for my internal Sharepoint site for example.

DasBlog

Tangentally, If you are looking for the file to edit to add a new link url to a dasBlog site it is:

\dasblogce\themes\*\homeTemplate.blogtemplate

Listening To: Sonic Youth, Daydream Nation

If (Arrigo.Frank == Green.James) { // implementation omitted for clarity }

Fri, 22 Jun 2007 05:30:39 GMT

OK, let me lay it out for you a la the Lost secret clues...

Frank was interviewed on CSharpZealot.com. So was I.
Frank is going to Play! A Video Game Symphony tonight, as am I.

Thinkaboudit people, when have you seen us both in the same room?

The similaraties (*caugh* both of them) are really just too numerious to ignore!

Lolcats - You're killing my productivity

Wed, 13 Jun 2007 04:06:36 GMT

Yes I have better things to do but no I could not help making more LolCats - this time no Tech.Ed

Linkage: ICanHasCheezburger & Teh Cats

I am going to be talking the Lolcat speek for the rest of the day and that is final.

Group Policy for web developers, part 2

Wed, 13 Jun 2007 03:15:54 GMT

This is the second post on Group Policy for web developers. Part 1 was about managing the local Intranet Zone for your AD network. This post will be based on a similar scenario. Specifically, when issuing certificates from a local Certification Authority, like Microsoft Certificate Services that ships in Windows Server 2003.

Modern browsers give you a more pretty warning system than they did last year when you view a site that do not chain back to a Trusted Root CA. This is still an important warning and we don't want to condition people into just clicking yes every time they see it.

The first thing you will need to do (and like the last post, a certain degree of domain administrative Godness is required...) is get the CA's certificate from the CA. Using Microsoft Certificate Services, you want to choose the option highlighted below:

This will prompt you to save the certificate file. Do this, then delete it when you are done.

Next we need to install the certificate into our client machines. We will need a GPO. You may use the one from the previous example or make a new one. Again the place in your AD to create this will vary. For smaller sites adding at the the top level is fine, but hands off the default policy.

Navigate to Security Settings -> PK policies ->Trusted Root CA's as in the screen below:

Right-click on the Trusted Root CA's container and choose Import. Here, browse for the cert file saved in step one and you are done!

Finally, here is some linkage to much more detail about Certificates in AD.

Tech.Ed LOL Cats -

Wed, 13 Jun 2007 01:55:15 GMT

OK, not a big cats person, but the lolcats meme has made it to Tech.Ed.

Frank Arrigo's post seems to be the epicenter, Brian has had a go too, Plus more linkage here.

May I offer my contribution:

(And mad props to Frostdesign blog for the wholy unauthorized boosted image)

Group Policy for web developers, part 1

Fri, 08 Jun 2007 01:19:27 GMT

Some sites that you may have on your internal network, such as Virtual Server console, Sharepoint, ASP.NET sites of your own creation, and so on, can require your AD credentials to log you on. Typically the browser will prompt you for them unless you add the site to the Local Intranet zone.

This quickly becomes cumbersome as the number of users grows. Everyone will have to add the URL to their Local Intranet zone manually and that spells work.

Internet Explorer

All the IE Zones, including Local Intranet, can be administered by Group Policy. Where in your AD you create your GPO will depend on the scale of your operation, for smaller sites a GPO at the domain level is not a bad choice. I'd caution against editing your default domain policy, consider creating a new GPO just under it.

Edit the GPO and browse to the Site To Zone Assignment List, inside the Internet Control Panel \ Security Page settings:

The UI will let you add IP addresses, FQDN's or http/https addresses, and which zone they will belong to.

One nice side effect of this to watch for is the users can now not change their zones via the IE settings.

FireFox

For FireFox, you are going to have to create/maintain an all.js in the %installdir%\defaults\pref\ directory.

This is just a plain text file that can contain settings in the FireFox Javascript format. For Integrated Authentication you will need to add the following line:

pref("network.negotiate-auth.trusted-uris", "comma seperated site list");

Listening To: Kruder and Dorfmeister, the K&D Sessions, part 1

World Environment Day... for geeks

Wed, 06 Jun 2007 01:08:17 GMT

c'mon, it's still the 5th in someone's timezone ;)

With a tip of the hat to the fine people at Make, I present you with...

A solar powered Prius. Now that is environmental. White paper here. Shame it still looks like a Prius.

FxCop and the SuppressMessageAttribute class

Thu, 31 May 2007 08:04:38 GMT

There are not too many things I hate in the world. Popcorn is one (no joke) another is the feeling you get when you discover something cool in the .NET Framework or Visual Studio and think: Damn! Why didn't I find this sooner. I call it the Last one to the party Feeling.

Today, I'm talking about the SuppressMessageAttribute class (MSDN Link).

This attribute can decorate a class where you would like explicitly exclude a module matching a rule in FxCop due to a false positive. Really it is no different to excluding the message in the FxCop project, but I think this is better because of how visible it is.

When you exclude a message in the FxCop project it gets sucked into a black hole and you never see them again. What if they are just a short term exclusion, like the old fav Microsoft.Design.AvoidNamespacesWithFewTypes >- which may apply at the start of a project but not once it is off the ground. Who is going to go and un-Exclude it from the FxCop project?

Also, this attribute takes named parameters, like Justification. Again, FxCop lets you put a note in when excluding in the FxCop project but it gets lost to all but the most determined eyes. Having the reason for the exclusion right there in the code means it has a better chance of getting on-going attention as it may not always be as valid as it is today through circumstance or refactoring.

This attribute requires you to define a symbol - CODE_ANALYSIS. In NAnt you can add define = "CODE_ANALYSIS" on your CSC or VBC Task and/or define the symbol in your Project properties, depending on how you build:

Office Add-Ins - gotcha's from the field

Tue, 29 May 2007 02:53:56 GMT

I've just got a couple of lessons from the last week to share around developing Office 2003 (and specifically Visio 2003) Add-Ins

I'm also trying to saturate this post with links because I have come up with a good size folder in my bookmarks for what started out to be a simple task.

Grab the PIA's. Anyone who wants to run the Add-In will need them. Alternatively they can be installed from the Office Add/Remove/Repair under the guise of .NET Programmability Support, but in reality the user may not have the media or security access to do this. Do NOT however ship the PIA's in your bits. Ship the PIA's with your bits: This means 2x MSI's.
Using NAant to automate the build with csc.exe & vbc.exe is suboptimal. I'm keeping my project to one small assembly that depends on the PIAs, and also depends on another assembly that does the heavy lifting but has no ref to the PIA's.
Strong Name everything. Well, strong name everything anyway, but when trying to pass of managed code as COM it is essential.
You cannot load a .NET DLL, even one with the ComVisibleAttribute on the Assembly or Classes, via the Office UI. You just can't. KB316723 gives an explanation. This is because Office will try and register it the old regsvr32 way, which of course won't work. To get a .NET DLL into the Macros -> Add-Ins list, you must write the registry entry under: HKEY_CURRENT_USER\Software\Microsoft\<office program name>\Addins\
This brings me to my next point. KB316723 hints at it, but your setup must write a HKCU key not a HKLM key. The Shared Add-In Wizard in Studio is ambiguous when it shows you this choice:

I know this may be contentious, but consider using VB.NET over C#. This depends of course, but some parts of the Office object model make heavy use of Optional Parameters which C# does not support. It has been noted elsewhere what Type.Missing can do for readability. Having said that, it does vary greatly depending on where in the Office Object Model you are.
Spend some time with the Setup project that the Shared Add-In Wizard makes and test it. Once you like it, reverse engineer it to a WiX script and feed that to your automated build. For the record, you do that with:

Dark.exe –x path Debug/msi My.wxs
Candle My.wxs
Light My.Wixobj

To extra points when dealing with WiX-ified MSI's
1. It's useful to note that the extracted (-x) resources take many forms. DefBannerBitmap.ibd for example is just a bitmap. I think it is easier to rename it to .bmp & tweak it in Photoshop than to add a new banner in Visual Studio.
2. The Add-in reg setting mentioned in point #4 above references an assembly version. Visual Studio tweeks this for you but your WiX script will be frozen at the time your Dark.exe'd it. So don't auto-increment your assembly version numbers, or tweak you WiX script. The choice is yours but your MSI must write the version of the Add-In DLL to the target machine's registry.

Listening To: Leftfield, Leftism

CI: The Happy Meal and the Buffet

Mon, 21 May 2007 10:06:12 GMT

I think it is fair to say CruiseControl.NET has become synonymous with Continuous Integration in the .NET space. In the recent DNR on CI* with Eric Sink and Martin Woodward it was the defacto choice for the discussion and with good reason. CCNet is a great tool.

I just wanted to give a quick shout-out to Draco.NET which is also a CI server for .NET and while not having the broad featureset of CCNet I recommend it for smaller shops getting their first Continuous/Automated build together. My two reasons are:

Supports Visual Source Safe, which like it or not is the Gateway Drug for source code control. (To hear what I think of that go grab DNR #221 about 5min16sec in ;) It also supports PVCS, Subversion and Vault.
It is so much easier to configure. You have no options for reporting or postbuild steps, or overriding the build ID or RSS add-ons for. CCNetConfig is essential for configuring CruiseControl.NET. Draco.NET offers a pit of success for the folks new to CI.

The most compelling reason for CCNet over Draco.NET is Everyone else is using CCNet :-)

On the topic of DNR show #238 - Eric talks about Vault, but doesn't mention that you don't need to purchase a license when used for a single developer. It is licensed by named accounts, so go get it and give it a go all you VSS folks!

*the best bit of the show is 11min45sec in... ;-)

Listening To: Ani Difranco - Revelling and Reckoning

Build output as an ISO file

Tue, 08 May 2007 04:53:13 GMT

I was looking today at options for finishing a build with something other than an MSI or folder full of files: An ISO file.

I am a fan of DaemonTools and associated add-ons. Even if you're not planning to burn to disc, an ISO file can be a useful way of getting a bunch of files around the place.

First step was to grab a Windows binary of mkisofs from one of the various sources of cdrtools on the web. NB: It comes linked with Cygwin binaries.

This is a util that has its roots in the Linux/Unix world, so be prepared to scratch your head a bit if you are not familiar with the world of Linux/Unix command line tools. Also if you are, don't be fooled by mkisofs following the naming convention of the other mk*fs tools. It is really quite different.

In the *nix world, the online help is by the man ("manual") page system. Basically, at your prompt you type man mkisofs for help with mkisofs. This works in Google too! The man page will be a useful reference, as will the less informative usage info you can get from mkisofs.exe -help

Having said all that, the following options are a really good place to start:

*Option*	*Note*
-J	Enable Joilet (you want this)
-R	Enable Rock Ridge (you want this)
-V diskname	Set a volume label
-o filename.iso	Set the output ISO file name
-graft-points	allows "=" syntax in pathspec. More on this below...
-m "*.tmp"	Exclude files from the image by pattern

mkisofs takes paths to add to the ISO file as parameters, and by default all these are stacked under the root of the disk image. If this is not what you want then you should enable graft points. This option will allow you to make folders in your ISO image for each of the folders you are adding to the disk.

For example, the following pathspec will create two folders on the CD, one called Windows for the contents of the bin folder, and one called Documentation for the contents of the doco folder:

Windows=D:\build\windows\bin\ Documentation=D:\build\doco\

So the complete command line for mkisofs will be something like:

"C:\Program Files\cdrtools-latest\mkisofs.exe" -J -R -graft-points -quiet -o f:\backup.iso -V backup -m "*.tmp" Windows=D:\build\windows\bin\ Documentation=D:\build\doco\

For extra points, you can automatically burn the ISO to a disk using the cdburn / dvdburn tool that ships with the Windows Server 2003 Resource Kit Tools.

A couple of reasons I'll suggest using this over using cdrecord.exe that comes with the cdrtools package:

The cygwin-based tools don't work as well with later Win32 like Windows Server 2003, they seem to not deal with the tighter security well.
The syntax of cdburn/dvdburn is much much easier!

An example of the syntax to burn f:\backup.iso to the blank disc in the burner g:\ is:

C:\Program Files\Windows Resource Kits\Tools>cdburn.exe g: f:\backup.iso -speed max

Also note that the cdburn will eject the disk once it has been burnt! Keep that in mind if your CD drive is normally behind a door or cage or something!

UPDATE: This technique is also has some utility for backup-to-disk scenarios. For example a backup batch file that made an ISO then burnt it to disk.

Listening to: Bend to Squares by Death Cab for Cutie

Has this ever worked for you?

Fri, 20 Apr 2007 07:04:46 GMT

Every so often I check that web service, just to see what it comes back with.... nothing yet ;-)

Nice to see it is still in Vista, my little magic 8-ball dialogue!

I just wish I could control the default.

T-SQL: dmy, mdy, oh my! dateformat confusion

Thu, 12 Apr 2007 00:52:12 GMT

This script came out of a discussion here at the office around a product that isn't flexible or location aware in how it writes datetime values into the database.

This is also not paying attention to storing the date data in UTC or localtime or any of those concerns, just the semantics of storing whatever the date value happens to be.

What are your experiences with this? Comments as always most welcome :-)

Example script follows:

/*
    You can use the following proc at the start of your app to see
    what the current date format SQL Server is expecting from you
    based on the default language selection set on your login.

    Look at the dateformat field in the resultset of this proc.

    Use this if you want to honour the regional selection that has
    been setup on a per-user basis on the SQL Server
    (login properties of each user)
*/
exec sp_helplanguage @@language

/*
    Otherwise, you may also override the language settings if your
    application code can only format dates one way.

    This will avoid message 241 at runtime:
        "The conversion of a char data type to a datetime data type resulted in an out-of-range datetime value."

    The 15th of Feb is a good example because there is no 15th month:
*/

SET LANGUAGE us_english
go -- dateformat is now = mdy

select cast('2/15/2003' as datetime) as US_1
go
select cast('15/2/2003' as datetime) as US_2 --Expect Msg 242
go

SET LANGUAGE british
go -- dateformat is now = dmy

select cast('2/15/2003' as datetime) as British_1 --Expect Msg 242
go
select cast('15/2/2003' as datetime) as British_2
go

You can grab the script here: >20070412.deepdark.net_dmy_mdy.sql (1.14 KB)