Official BV Software Blog

PABP changes to PA-DSS

mmcconnell1618 — Sun, 04 May 2008 10:59:00 -0400

Even before the PCI security standard for applications (PABP) becomes mandatory the PCI organization has retired it. It has been replaced with a new PA-DSS standard. The PCI web site details the changes from PABP to PA-DSS.

One of the big changes is the PA-DSS is NOT required to process credit cards unless your credit card gateway/provider requires it. This should be a huge relief to many merchants as it will allow them to negotiate with their payment provider for a reasonable timeline to get certified.

BV Commerce wins aspNetPro Reader's Choice Award 2008

mmcconnell1618 — Thu, 24 Apr 2008 16:31:00 -0400

BV Commerce has once again won the AspNetPro Magazine Reader's Choice Award for Best eCommerce application. That makes 4 out of the last 5 years that it has captured the title. An incredible achievement given the pace of innovation in the industry.

DotNetBB our message forum software has also captured the runner-up position for best asp.net forum software.

Generate a Customer List for BV Commerce 5

mmcconnell1618 — Wed, 26 Mar 2008 15:50:00 -0400

If you've ever needed to get a quick export of everyone who has purchased from your store in the last year this SQL script can be used to generate a comma separated text file. Make sure you change the "> date" part to be the correct starting point for your export. You'll get customers' names, address, phone and email as long as they placed an order on your store.

SELECT 'LastName, FirstName, Line1, Line2, City, 

        RegionName, PostalCode, CountryName, 

        Phone, Email' AS Expr1, 0 AS [Order]

UNION

SELECT   CAST(CAST(AddressBook AS xml ).query(N'/AddressBook/Address[last()]/LastName/text()') AS nvarchar(1000)) 

+ ', ' + CAST(CAST(AddressBook AS xml ).query(N'/AddressBook/Address[last()]/FirstName/text()') AS nvarchar(1000)) 

+ ', ' + CAST(CAST(AddressBook AS xml ).query(N'/AddressBook/Address[last()]/Line1/text()') AS nvarchar(1000)) 

+ ', ' + CAST(CAST(AddressBook AS xml ).query(N'/AddressBook/Address[last()]/tLine2/text()') AS nvarchar(1000)) 

+ ', ' + CAST(CAST(AddressBook AS xml ).query(N'/AddressBook/Address[last()]/City/text()') AS nvarchar(1000)) 

+ ', ' + CAST(CAST(AddressBook AS xml ).query(N'/AddressBook/Address[last()]/RegionName/text()') AS nvarchar(1000)) 

+ ', ' + CAST(CAST(AddressBook AS xml ).query(N'/AddressBook/Address[last()]/PostalCode/text()') AS nvarchar(1000)) 

+ ', ' + CAST(CAST(AddressBook AS xml ).query(N'/AddressBook/Address[last()]/CountryName/text()') AS nvarchar(1000)) 

+ ', ' + CAST(CAST(AddressBook AS xml ).query(N'/AddressBook/Address[last()]/Phone/text()') AS nvarchar(1000)) 

+ ', ' + Email AS Expr1, 1 AS [Order]

FROM   bvc_User

WHERE  (bvin IN

          (SELECT DISTINCT UserId

           FROM          bvc_Order

           WHERE  (OrderNumber <> '') AND (TimeOfOrder > '01/01/2007')))

ORDER BY [Order]

Run this in SQL Management Studio and then copy and paste the results to a text file. You can open the text file in Excel as "comma separated" (CSV) to get sort the data or mail merge.

If you're late paying your cable TV bill your credit card payments can go up!

mmcconnell1618 — Tue, 25 Mar 2008 11:48:00 -0400

I've got a love/hate relationship with credit card companies. On one hand credit cards make it easy for BV to sell software over the internet. On the other hand chargebacks and fraud with credit cards is a royal pain with limited protection for merchants. I watched a great episode of Frontline on PBS about the Secret History of Credit Cards.

The most surprising revelation was that most credit card contracts include a clause called "Universal Default." Basically, if you make a late payment to any other lender or company the credit card issuer can automatically raise your interest rate. If you're on vacation and forget to pay Comcast on time your Visa interest rate can jump from 18% to 25% without warning.

Credit card companies are the only lenders that get to decide how risky you are when they issue you credit AND change their minds about how risky you are later too. My bank doesn't get to raise my mortgage payments because they think I'm riskier now than when I signed up for my mortgage so why should credit card companies get that ability? Sounds like a huge loophole that lets credit card companies jack up your rates almost at will.

Anyways, if you found this interesting you can watch the whole episode online.

JQuery 1.2.3 conflicts with Google Analytics

mmcconnell1618 — Wed, 19 Mar 2008 17:42:00 -0400

I was watching our Google Analytics traffic last week and noticed a sharp decline. My first thought was "My God, we've been blacklisted by Google or another search engine." I couldn't figure out why our traffic had dropped so dramatically. If it had dropped to zero I would have instantly thought the tracking script was at fault but instead it just dropped but kept counting with day to day variations.

I discovered that IE was reporting a script error and that was the clue to the mystery. We had added the JQuery library version 1.2.3 to our master page for some fancy image swapping. It turns out that this particular version of JQuery has an odd way of handling some click events and it conflicts with click handlers in Google Analytics. Apparently it doesn't happen all the time and it doesn't happen in all browsers so that's why we were still seeing some traffic records.

I pulled JQuery until it's patched and the stats popped back to normal the next day. Whew!

Silverlight, MVC, and more at Mix08 in Las Vegas

mmcconnell1618 — Tue, 11 Mar 2008 13:33:00 -0400

I just got back from the Mix08 conference in Vegas. It was fantastic! Scott Guthrie and Ray Ozzie showed off some new web tools during the opening keynote and it's clear that Microsoft is jumping into the web with both feet. Ray Ozzie pretty much said that Microsoft will be coming out with a new cloud based services model that will include most (if not all) Microsoft applications. Hosted data services are also coming and I'm interested to see how they differ from SQL relational databases. Ray didn't say anything about Microsoft hosting services but if I was in the hosting business I might be a little worried about what will happen down the road.

Silverlight, Silverlight, Silverlight was the battle cry from just about every Microsoftie I met. They are pushing this hard as THE platform for rich internet applications (RIA) in the coming years. NBC will be launching a silverlight based web site for Olympic coverage and if it does everything they showed in the demo the internet is going to grind to a halt with that much video running at once. Clearly, Microsoft wants Silverlight to take down Flash as the defactor way to add video and animation to web sites. Given Microsoft's ability to build great developer tools to support their platforms they just might do it.

Scott Hanselman gave a great presentation on ASP.NET MVC or Model View Controller. He started off by opening Notepad on a 40 foot projection screen and just typing random funny comments about the crowd. The room was silent in less than a minute and I thought it was a genious way to start things off rather than screaming for everyone to sit down.

MVC is an alternate way to build ASP.NET web pages instead of using WebForms. With WebForms you have a .aspx page and a code behind file. The code behind file pulls information from your business objects and binds it to controls on the .aspx part of the form. Everything is in one giant <form> tag and viewstate is used to emulate winforms-like interactions. With MVC you have views which are html pages or template language pages that accept some data and are responsible for rendering out angle brackets. A controller is a class that does not have a corresponding display page and is responsible for pulling data from business objects and packaging it into a bundle of data for a view to render. This is very similar to Ruby on Rails and will give ASP.NET programmers an alternative to WebForms. Scott was very clear to point out the MVC is not replacing WebForms and that the two can co-exist in the same web site if you want.

Wednesday night Microsoft sponsored a party at TAO, a night club in the Venetian where the conference was held. They brought in Steve Wiebe who attempted to regain his title as Donkey Kong champion of the world. Steve wasn't able to beat the high score but he did reach level 22, known as the kill screen, where Mario dies because the programmers were out of memory. The kill screen has only been reached 5 times during competition. If you're in Vegas you have to try the Kobe beef sliders at TAO which are incredible!

This was the first MIX conference that I've been to and it was different from other Microsoft events. There were so many opportunities to meet both Microsoft team members and other developers that I'd really recommend it to anyone building web applications on the Microsoft platform. Next year's Mix09 conference will be at the Ventian in Vegas March 18-20, 2009.

Meta Keyword Tag is Dead

mmcconnell1618 — Thu, 06 Mar 2008 10:44:00 -0400

I'm probably very late to this party but apparently the Meta Keyword tag is all but useless to modern search engines. I had a chance to meet Nathan Buggia from Microsoft's Search team yesterday and he was gracious enough to answer a lot of questions for me.

Nathan explained that all major search engines pretty much ignore the keywords tag and instead generate their own keywords directly from your page content. The meta keyword tag is a really great way to let your competitors know which words you think are important but aren't going to impact search rankings.

I also asked him some common questions that our customers ask us about. It's great to talk to the people that actually know the answers instead of guessing which SEO guru is right.

Does it matter that the extensions are ".aspx" instead of ".html"
The short answer is "no." The only expection is that Microsoft Search will actually read some .aspx pages more intelligently than non .aspx pages so there could be a slightly benefit to using ASP.NET in general.

Is it okay to use non-latin characters in domain names? I've heard they can flag your site as a phishing page.
Nathan says that it is 100% fine to use non-latin characters in URLs as long as your page content also contains non-latin characters. A 100% us page with all latin characters that uses non-latin characters in the URL could raise some alerts on filters.

Any other buring search engine questions? Email me and I'll try and get Nathan to answer them if I catch up with him again.

Technorati Profile link

mmcconnell1618 — Thu, 28 Feb 2008 21:49:00 -0400

Technorati Profile

Rock beats Scissors, Trashcan Beats Orb

mmcconnell1618 — Thu, 28 Feb 2008 21:14:00 -0400

I use both Windows and Mac OSX at BV Software. I really like somethings about each operating system and since we make web based apps we need to test them on both platforms. Tonight my 2 1/2 year old son showed me why a trashcan beats an orb.

I had my laptop booted into Vista and Gideon was "helping me" finish up some email messages. Click here, click there, window opens, etc. Not a peep out of him. When I was finished I rebooted into OSX because I remembered that he liked Photobooth and making silly pictures.

OSX was on screen and in less than 2 seconds Gideon promptly pointed out "Ooo, Trashcan, Oooo Book." That is great UI design. My 2 year old instantly recognized a trash can and that the Address Book program looked like a book. He can't read but he understood perfectly.

He never said one peep about the Windows "orb" that represent the Vista start menu.

How to create a Dynamic LINQ Query Programmatically

mmcconnell1618 — Wed, 27 Feb 2008 21:14:00 -0400

If you've been stuggling to create a dynamic LINQ query you're not alone. Thanks to some research, hard work and a smart co-worker I was able to implement some cool dynamic LINQ code in our help desk application.

In our helpdesk we have filter screens that look like this:

Creating a LINQ query in challenging because we don't know ahead of time which fields the user will complete. They are all optional and without anything selected we want to pull back all tickets. Normally, you'd write a query like this:

var ticket = (from t in db.cerberus_Tickets

                          where t.id == id

                          select t).Single();

In the example above we know that the t.id parameter will always be given. So how do you create a query in code when you don't know what fields to include in the WHERE clause ahead of time?

The first key is understanding the LINQ queries are not executed until they are used to enumerate through a collection. This part is key because it means we can create a query and change it in code as long as we don't try to look at the results first.

What we're going to do is create an IQueryable collection that contains all of our Ticket objects and we'll dynamically add our WHERE clause information. Then we'll create a normal LINQ query that selects all of the matches from our IQueryable collection and handles paging. Because we don't actually enumerate the IQueryable collection that contains all our tickets, it won't actually pull back all of the tickets (which would take forever!). Instead, it will be "merged" with our normally LINQ query at run time when we enumerate over it.

1) Create our LINQ to SQL context objects

 
 List<cerberus_Ticket> result = new List<cerberus_Ticket>();

 cerberusDataContext db = new cerberusDataContext(connectionString);

2) Create an empty IQueryable collection containing all tickets. Note that this query doesn't actually select everything from the database yet. If it did this would take forever and effectively be filtering the database table in memory. That would not be a good design!

 
 IQueryable<cerberus_Ticket> matches = db.cerberus_Tickets;

3) Add our WHERE clause information with custom logic to decide if the clauses should be added or not

        
 if (this.AgentIdField.Text.Trim().Length > 0)

 {

     matches = matches.Where(a => a.AgentId == criteria.AgentId);

 }

 if (this.TicketIdField.Text.Trim().Length > 0)

 {

     matches = matches.Where(a => a.TicketId.Contains(criteria.TicketId));

 }

4) Create a second LINQ query that selects from the first one to sort and page the results.

 
 // calculate start row based on page parameters passed in

 int startRow = (pageNumber - 1) * pageSize;

 var output = (from p in matches

               orderby p.DateCreated descending

               select p).Skip(startRow).Take(pageSize).ToList();

Again, I can't emphasize enough how cool it is that LINQ doesn't query the database until we call the ToList() at the end of the second statement. This delay in execution is the magic that lets us create dynamic queries on the fly.

Have any cool LINQ tips of your own to share?

Quick program to batch rename files to replace text

mmcconnell1618 — Sat, 23 Feb 2008 14:42:00 -0400

Today I had a huge directory of 300+ images that I batch converted in Photoshop from TIFF to PNG format. The problem was I must have missed something in Photoshop and all the files came out like this:

Image1.TIFF.PNG

I needed to remove the ".TIFF" part from the name so I wrote a quick c# command line program to look at a directory, find all files that contained text in their name and replace that with something else. It's a quick and dirty solution but I thought someone else might need it. The source directory, text to find and text to replace are just string in the source code. You may want to move them out to command line parameters if you need this kind of program often.

Here's the source code:

using System;

using System.Collections.Generic;

using System.Linq;

using System.Text;

using System.IO;

namespace FileNameChanger

{

    class Program

    {

        static void Main(string[] args)

        {

            /*

             * Change these three settings to tell the program

             * where to search, what to find and what to replace

             * it with

             */

            string sourceDir = @"C:\Users\mmcconnell\Desktop\CroppedTiff\PNG";

            string stringToFind = ".tiff.png";

            string stringToReplace = ".png";

            if (Directory.Exists(sourceDir))

            {

                string[] thefiles = Directory.GetFiles(sourceDir);

                if (thefiles != null)

                {

                    foreach (string f in thefiles)

                    {

                        string pathPart = Path.GetDirectoryName(f);

                        string filePart = Path.GetFileName(f);

                        filePart = filePart.Replace(stringToFind, stringToReplace);

                        File.Move(f, Path.Combine(pathPart, filePart));

                        Console.WriteLine("Moving to " + filePart);

                    }

                }

            }

        }

    }

}

Program.cs (1.26 kb)

How NOT to handle a long term consulting contract.

mmcconnell1618 — Fri, 22 Feb 2008 21:21:00 -0400

Last summer BV Software took on a large custom programming job for a social networking site targeting baby boomers. It was a great opportunity to expand our consulting services with a 6 month long project. Long term contracts are a great way to keep programmers busy and expand our team. The project didn't turn out as planned...

I've been in the software business long enough to know that you can promise hours or you can promise functionality when creating custom programs. If you promise functionality without limit on hours you have to be absolutely sure that you can deliver the project in less time than the cost of your resources will eat up. This turns out to be a difficult problem. Steve McConnell (no relation to me) has a great book on Software estimation and the challenges involved. Most clients are not willing to pay up front for the hours required to fully document and understand a problem before any coding begins. If you don't fully understand the problem you're trying to solve it is impossible to put a fixed cost number on it.

So that leaves contracts that sell hours of time. This particular long term contract promised 400 hours of time over a six month period. We estimated how long several tasks would take and gave the client an idea of what we thought those hours would cover.

This client was fairly high profile and we worked like dogs to help them meet their launch deadlines. However, like most projects, the requirements were constantly changing. We got request to change tax and shipping algorithms for or five times. We got requests to manually go into the database and change the pricing of one or two Harry Potter books! We were sent several conflicting designs and layouts that all had to be integrated "today or else!" There were last minute additions of flash product carousels and finally, the biggest change request of all: "Our site needs to be as fast as Amazon.com with all the same features and 5 million products. You have four weeks." The client expected to accomlish all of this for less than $50,000 working nights and weekends on an unrealistic deadline.

Needless to say we burned through the 400 hours pretty quickly. That's were the real problem began.

The client had known all along the hours were ticking away. We sent detailed status updates and let them know that we needed to extend the agreement or we had to stop working. We delivered the site, working as originally expected on time in the 400 hours budgeted. The client had paid their bills while we were working but as soon as the code was delivered all payments stopped.

I had made a huge mistake because I allowed our team to work through the 400 hours in about 2 months time. The client had paid for two months but still owed for the remaining 4. With the code in their hands and no more hours to use they simply felt entitled to stop paying us.

Fortunately, I was experienced enough to insist on a contract of hours over features. That means the client is in breach of contract no matter what was delivered if they don't pay. We'll see how everything turns out now that it's going to litigation. I fully expect to collect what's due including court costs and punitive damages but it's not a process I wanted to deal with.

Even with all the frustration there is something valuable to gain. It was a mistake to offer so much credit to a client. It was a mistake to work an unrealistic schedule just to please a client. It was a mistake to deliver source code with so much of a contract not paid off. I know that the knowledge from this experience will help with our future consulting jobs just like selling hours instead of features helped with this one.

6 Years since the release of BV Commerce 1.0

mmcconnell1618 — Wed, 20 Feb 2008 20:33:00 -0400

It's been almost exactly 6 years since the very first release of BV Commerce. It was the very first commercial ecommerce software for the .NET platform and we're still going strong. I started writing the first version back in September of 2001 and it was released in February as soon as the .Net Framework 1.0 was official released.

I'm often asked "What does 'BV' stand for?" The truth is it could stand for a lot of things but "Best Value" is the answer I usually give. I went through tons of names but it seems like every domain name in the world related to commerce was taken back in 2001. Would you believe that even "jerboa" was taken? So "BVSoftware.com" was available and "Best Value" sounded good enough. If I called it "comrc" or some other misspelling I'd probably have $5M in VC money right now :-)

The BV Software logo has changed a lot since the first days too:

The very first BV logo. I thought purple was a good choice!

The image of a methane molecule that served as a template for the next BV Logo

The very first "molecule" version of the BV logo.

The third BV logo with a 3D glossy molecule and more red!

A green version that never made it but did introduce the ITC Kabel font.

Current BV Software Logo

New design idea for dropping molecule symbol

I sold exactly 16 copies of BV Commerce 1.0. It didn't support choices or options and was all table based design. BV Commerce 2.0 followed less than 6 months later with a host of improvements and things have been growing non-stop since.

P.S. If you see Randy from GlobalWeb.net on the forums he was the very first BV Commerce customer and is still an active host/developer in our community!

BV Commerce and PCI Compliance / PABP Certification

mmcconnell1618 — Mon, 28 Jan 2008 20:34:00 -0400

The major credit card companies are giving merchants until 2010 to ensure that all applications are PABP certified or PCI compliant. PABP certified is used for packaged software (like BV Commerce 5) and PCI is used for hosted services and hosting companies.

There are 4 levels of merchants and the deadlines are different for each one.
Level 4 Merchants - Process 0 to 20,000 transactions per year
Level 3 Merchants - Process 20,000 to 1 Million transactions per year
Level 2 and Level 1 Merchants - Process over 1 Million transaction per year

Terms used
Known Vulnerable Applications - Software known to Visa to store unsafe data. (BV Commerce is NOT a known vulnerable appliction)
Certified Applictions - Software that has passed a certification test
New Accounts - New credit card processing accounts for merchants that do not currently process cards

Schedule of Requirements

Phase 1 - January 1, 2008
New Account must not be using Known Vulnerable Applications. A new merchant can use BV Commerce as it is NOT a known vulnerable application. No effect on existing merchants.

Phase 2 - July 1, 2008
Payment processing companies must only certify new software that is also a Certified Application. Current software and customers are not affected. Current merchants are able to use BV Commerce just as they do now.

Phase 3 - October 1, 2008
New Accounts are required to EITHER use a PCI compliant hosting company OR use a PABP certified application. Existing merchants are not affected and can continue to use BV Commerce as normal. New Accounts must use a PCI compliant hosting company if BV Commerce is not certified by this date. We fully expect that BV Commerce will be certified long before this time.

Phase 4 - October 1, 2009
Known Vulnerable applications will be de-certified for credit card processing. BV Commerce is not a Known Vulnerable application and will also be certified by this date. No impact to any BV Commerce merchant.

Phase 5 - July 1, 2010
All merchants will be required to use Certified Application. BV Commerce will have been certified long before this time and there will be no risk/impact to merchants.

Summary - Impact to BV Commerce merchants
BV Commerce 5 is currently 90% compliant and we are working hard to implement the last few remaining features. The major hold back at this point is the requirement that we allow merchants to change encryption keys on the fly on a running store. This will require a service pack to BV Commerce 5 and we will complete certification before the end of this year.

There will be no impact/risk at all to BV Commerce 5 merchants. Existing merchants will have until 2010 to move to a certified solution but BV Commerce 5 will have been certified long before that deadline.

BV Commerce 2004 merchants will need to upgrade to BV Commerce 5 (or a later version) before July 1, 2010 in order to process credit cards with a certified application.

BV Software to attend Mix 08 conference in Las Vegas

mmcconnell1618 — Fri, 11 Jan 2008 12:34:00 -0400

Marcus and Justin from BV Software will be at the Microsoft Mix 08 conference in Las Vegas March 5-7, 2008. The Mix conference is an opportunity for technical and creative web developers to preview the latest technology from Microsoft and to discuss future directions for the web. Keynote speakers include Steve Balmer, Scott Guthrie (ASP.NET team leader) and Guy Kawasaki.

www.VisitMix.com

If you're planning on attending drop us an email so we can meet up.