Lost in .NET Code

Authorize.net lessons for etailers

noreply@blogger.com (James Knowles) — Fri, 03 Jul 2009 14:58:00 +0000

First things first I wish Authorize.net team the best of luck and speed in fixing there network.

Lessons for etailers though is to *if* possible build a second payment provider into the online checkout system. www.dabs.com are great example of site that has multiple paymet options at checkout. This not only gives consumers choice but also provides resilences into your online payment solution.

Is this not illegal?

noreply@blogger.com (James Knowles) — Thu, 12 Mar 2009 23:07:00 +0000

http://news.bbc.co.uk/1/hi/programmes/click_online/7932816.stm

Last time I looked it was illegal to do this type of thing either for profit or demonstration purpose.

"Almost 22,000 computers made up Click's network of hijacked machines, which has now been disabled."

"If this exercise had been done with criminal intent it would be breaking the law. "

What ? using other people machines to send traffic and there bandwidth is not already a misuses of there network ?? Does that not break the Computer Mis Use act ? What if some of those machines where on mobile networks where they were paying by the meg for there bandwidth ??

Moving a SUSDB Database on SBS 2003

noreply@blogger.com (James Knowles) — Wed, 07 Jan 2009 10:33:00 +0000

WSUS database by default tend to be on the C drive, which is all good until you start to run out of space.

The problem then comes in moving the database from C: to often your data drive in my example D:

The biggest problem people have in doing this is actually connecting to the database.

Most people like point and click tools like SQL Server Management Studio or Express edition
http://www.microsoft.com/downloads/details.aspx?FamilyId=C243A5AE-4BD1-4E3D-94B8-5A0F62BF7796&displaylang=en

MAKE SURE YOU HAVE A BACKUP BEFORE YOU START THIS.

To connect to the database you need to use the following address as the Server Name:

file://pipe/mssql$microsoft##ssee/sql/query

I connected through using this address as Administrator which seem to work ;-) Once you have a connection in the database.

The rest becomes alot simplier in terms of moving the SUSDB . Expand the database list and you should see SUSDB .

Before you do this though make a note of were the files are !! ldf and the mdf ;-)

Right click on the database

Task -> Detach

you will need to select the option "Drop Connections" otherwise it will normally fail to detach.

Once you have detached the database. *COPY* ldf and mdf file to your new location.

Once copied you simple need to Attach the database back in again. Right click on Database -> Attach

Locate the mdf file in the new location and attach the database back.
Once you are happy that database is re-attached correctly and you have checked the system is working, you can delete you old mdf and ldf file. Personally I just copied them off onto a USB drive just in case. You should then have some space back on your C drive.

[UPDATE]
Make sure you check the permissions on the database before you start this procedure just in case.

Happy New Year

noreply@blogger.com (James Knowles) — Thu, 01 Jan 2009 19:59:00 +0000

Happy new year to all.

Removing IE8 on Windows XP

noreply@blogger.com (James Knowles) — Mon, 22 Dec 2008 12:35:00 +0000

Had a few people run into IE8 beta lately by mistake. As most people look for Microsoft Internet Explorer in the add / remove programs, they get stuck. It is actually called "Windows Internet Explorer 8" why they cannot follow a naming standard they have setup I will never know...

Removing IE8 on Windows XP:
1. Click the Start Button and select Control Panel.
2. Select Add or Remove Programs.
3. Find and select Windows Internet Explorer 8 from the list of available applications.
4. Click the Remove button.
5. Restart your system.

Save As PDF in Office 2007

noreply@blogger.com (James Knowles) — Thu, 06 Nov 2008 10:29:00 +0000

http://www.microsoft.com/downloads/details.aspx?FamilyId=F1FC413C-6D89-4F15-991B-63B07BA5F2E5&displaylang=en

I just found this the other day and will save me purshasing a conversation tool for word to PDF.

Hope this helps someone else in the future, Not sure Adobe will love MS for this but it is great for consumers.

End of Windows 3.x

noreply@blogger.com (James Knowles) — Wed, 05 Nov 2008 17:32:00 +0000

http://news.bbc.co.uk/1/hi/technology/7707016.stm

The last time I saw 3.x was actually last month.. my dad still runs it for a flight sim!!

James

SQL Injections ASP

noreply@blogger.com (James Knowles) — Tue, 04 Nov 2008 22:51:00 +0000

http://blogs.technet.com/neilcar/archive/2008/10/31/sql-injection-hijinks.aspx

Neil Capenter shows another example of why ASP and using Black list is a really bad idea.

This is really interesting because it shows
"ASP drops a percent sign from the query string if it isn't followed by two valid hex characters(0-9, A-F) when it actually interprets it via Request.QueryString. "

Neil proves this in a test page it shows that the earlier attacks are again being updated to go past filters. If companies have patched a fix over this type of hole then they will be facing a more complete attack soon.

http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1697

The new version of URL scan specifically checks for this and is worth having in your toolkit.

Fircroft Trust are now blogging

noreply@blogger.com (James Knowles) — Tue, 04 Nov 2008 17:03:00 +0000

http://www.thefircrofttrust.org/blog/index.php
Well done Sam.

James

Long live Windows 7

noreply@blogger.com (James Knowles) — Tue, 28 Oct 2008 22:15:00 +0000

http://news.bbc.co.uk/2/hi/technology/7695933.stm

I think I am about to declare vista dead. Long live Windows 7.. Hopefully it will follow in the foot steps of Windows Server group because the server poducts seem to be getting better and better. As server/network admin though it means I am never going to be able to sell Vista at the business level, windows XP is going to rule until 7 has been released, this I have to say is a mistake on MS part if they are not seriously going to release 7 in the next 2 years, because peak shows like this just mean I have no chance of actually convincing someone in a business to spend money in a vista direction..Lets not even talk about the cloud...MS you really need to start delivering and show a real long term position rather than following the latest trend, your are effecting your long term partnership positions.

XP Antivirus 2008

noreply@blogger.com (James Knowles) — Wed, 27 Aug 2008 12:58:00 +0000

http://www.theregister.co.uk/2008/08/22/anatomy_of_a_hack/

Having spent a good couple of hours this week cleaning up XP Antivirus 2008 and one case having to do it twice..Sigh It is was very interesting to see this article. Everyone should read it, the quality of the attack that XP Antivirus 2008 uses is quite scary and will probably start to set a bench mark for coming attack. It will require a lot of education to protect user for this time of threat.

Cuil .. Maybe Not

noreply@blogger.com (James Knowles) — Thu, 31 Jul 2008 13:16:00 +0000

Just tried searching in Cuil for Unwind Software Ltd, not sure I like the image ideas they have, considering they seem to get it horribly wrong. Surely this is lawsuit waiting to happen, have no idea who FDM Software are but they seem to imply by the logo they are Unwind Software Ltd.

I assume I am not the only one, why though are they using images across domains, surely that is a reciepe for complete disaster.. Could you not posion high profile site images logo in Cuil with an image if you crafted a page that had the right keywords and the wrong images on it..

Sql Injection Prevention Articles

noreply@blogger.com (James Knowles) — Mon, 21 Jul 2008 21:39:00 +0000

SQL Injection prevention in ASP
http://msdn.microsoft.com/en-us/library/cc676512.aspx

SQL Injection prevention in ASP.Net
http://msdn.microsoft.com/en-us/library/ms998271.aspx

Both excellent articles on preventing SQL injection.

Scrawlr announcement - Microsoft / HP Collaborate on SQL Injection tool

noreply@blogger.com (James Knowles) — Wed, 25 Jun 2008 00:28:00 +0000

https://download.spidynamics.com/Products/scrawlr/

Well worth downloading and running it is free and certainly a great tool to start testing for SQL injections on a website.

Ado.Net Entity Framework Vote of no confidence ??

noreply@blogger.com (James Knowles) — Tue, 24 Jun 2008 21:38:00 +0000

**RANT**
http://efvote.wufoo.com/forms/ado-net-entity-framework-vote-of-no-confidence/

So I read Tim Mallalieu's blog he is on my RSS feed one of few select people I track and trace. (Tim if you read this I am not a stalker honest, I just think you post are cool and informative)

http://blogs.msdn.com/timmall/archive/2008/06/24/vote-of-no-confidence.aspx

So I read the following post, and fell off my chair, somebody has gone to the effort of actually putting togther a ADO.NET Entity Framework Vote of no confidence. Now forget the techie part lets just look a the practical, because obivously I am missing something. Surely and strike me down with a feather duster that if you don't like the Entity Framework ....You just don't use it ooooorrr, even better and maybe a more postive thing than moaning about a product write you own, develop an open source alternative, dare I say it... use something else.

It is really easy to sit on the side line and snip about a framework that does not fit your needs or you believe is wrong, but come on now give the guys and girls who have slaved over the Entity framework a break constructive critisim fine and in the post above they have made some (fair enough) but to finish it with please make a vote of no confidence is not exactly nice and in just is in my view rude. Yes I suppose you have got the attention of the team.. but surely there is a better way, how to motive a team to your ideas.

I personally don't use Entity Framework or Linq SQL (I have tried) but I am big fan of LLBGEN Pro, it works, it's solid and fits my clients and my needs. I made a choice, not bashed a team that was trying to build a very complex product. Have some respect please don't sign a petition just give sensible feedback through normal challenge.. or dare I say don't use it....
**END RANT**

Apologies for the Rant. Good luck to the Entity Framework team, please look at some of the criticims leveled it is correct, but I am sure you would review it just like Classic ASP is better than ASP.NET v1 and ASP.NET 2 is better than ASP.NET v1. It will be a process of learning, would love to see how many developers get frameworks out of the box correct. I will admit I don't always do, that is the part of being human, my first Sage Framework in C# sucked my revision at the moment does not..

I am missing something do we need vote of no confidence.. No, just MS to be listening which I hope they are, and for sensible suggestions in a reasonable manner.

Microsoft Anti Scripting Library + Base controls

noreply@blogger.com (James Knowles) — Wed, 18 Jun 2008 11:26:00 +0000

I have been experimenting with finding quick fixes on an existing site with Xss and using the browser file in ASP.NET to get a system wide Anti XSS implementation without have to go through each bit of code.

By no means is this a perfect solution you should go through all of the code that you are working on but sometimes you need to get up running defence.

Also this technique I am experimenting would be potentially useful for starting off with a new site with, a set of basic controls that have Microsoft Anti Scripting library by standard applied to.

Links to Microsoft Anti Scripting Library.

http://www.microsoft.com/downloads/details.aspx?familyid=EFB9C819-53FF-4F82-BFAF-E11625130C25&displaylang=en

Example:
http://msdn.microsoft.com/en-us/library/aa973813.aspx

This is the code I am tinkering with:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Web;
using Microsoft.Security.Application;
using System.Web.UI.WebControls;

namespace UnwindSoftwareLtd.Web.StandardAxss
{
public class LabelControl : System.Web.UI.WebControls.Adapters.WebControlAdapter
{

protected override void Render(System.Web.UI.HtmlTextWriter writer)
{
((Label)base.Control).Text = AntiXss.HtmlEncode(((Label)base.Control).Text);
base.Render(writer);
}
}
}

Ideally though I would like Anti Scripting Lib to be applied to all MS controls, it would be switched on by default. I accept though there applications that need to use for example Label control to output Java Script, but it would be great if you could use switch to say don't use the Anti Scripting library or I want to output Javascript format for that.

James

Classic ASP Functions for preventing SQL Injections

noreply@blogger.com (James Knowles) — Tue, 10 Jun 2008 13:45:00 +0000

The big rule of doing any CRUD data jobs in any ASP/ASP.NET app with SQL Server is that you MUST use parameterized queries.

http://msdn.microsoft.com/en-us/library/cc676512.aspx

The article above though also outlines using Regular expressions to protect your web app by validating data before passing it through.

Below are some example functions for testing for int and removing anything other than int information from a string. Both provide a first basic layer to stopping SQL injection attacks in classic ASP, as lot of web apps use int as a key field in a in a database, hence it gets passed through with a querystrings. Hopefully these will prove useful to someone else.

function IsInt(strOriginalString)
dim objRegExp : set objRegExp = new RegExp
with objRegExp
.Pattern = "^\d+$"
.IgnoreCase = True
.Global = True
end with

IsInt = objRegExp.test(strOriginalString)
set objRegExp = nothing
end Function

function OnlyInt(strOriginalString)
Dim regEx, Match, Matches,returnString ' Create variable.
Set regEx = New RegExp ' Create a regular expression.
regEx.Pattern = "\d+" ' Set pattern.
regEx.IgnoreCase = True ' Set case insensitivity.
regEx.Global = True ' Set global applicability.
Set Matches = regEx.Execute(strOriginalString) ' Execute search.
For Each Match in Matches ' Iterate Matches collection.
returnString = returnString & Match.Value
Next
OnlyInt = returnString
end Function

AVG 8 on SBS 2003 .. Maybe not.

noreply@blogger.com (James Knowles) — Mon, 09 Jun 2008 12:04:00 +0000

"Dear Sir/Madam,

Thank you for your email.

We are sorry to inform you that this issue was already reported by
other customer and we found that it is a bug in AVG. This problem is
fixed in our major program update which will be released at the end of
the second quarter of the year.

As soon as we release the update we will inform you.

Thank you for your understanding and cooperation. If you have any
further questions or issues feel free to contact us.

Answers to the most common questions can be found here as well:
http://www.avg.com/faq/"

Looks like my new shiny AVG 8 is not suitable for SBS Server 2003 .. Excellent.

Not sure why nobody thought to test it on this platform before release, can't imagine they have that many customers running SBS 2003 .... errr.

My advice is don't upgrade your AVG to 8 if you are running AVG 7.5. Stick or find a antivirus provider who actually support SBS 2003 which is exactly what I am going to actively have to do! AVG 7.5 seems to be still supported ..

Test for Int in a Web Application

noreply@blogger.com (James Knowles) — Thu, 05 Jun 2008 16:00:00 +0000

Useful function No 1

public static bool IsInt(string testStr)
{
string pattern = @"^\d+$";
if (testStr == null)
{
return false;
}
if (testStr.Length == 0)
{
return false;
}
Match matchResult = Regex.Match(testStr, pattern);
return matchResult.Success;
}

HostingUK dedicated box tips

noreply@blogger.com (James Knowles) — Fri, 30 May 2008 10:57:00 +0000

Been meaning to post this for a while.

When I pick up a HostingUK dedicated box. Some of the tips I give to customers when
they start with a dedicated box.

Disclaimer.

I am not a Windows expert by any means. PLEASE MAKE SURE YOU REVIEW
EVERYTHING.

Shut down All Services not needed

Unless you are using it shutdown all services.

These are the standard services that I shutdown on HostingUK box.

IIS :

Sharpoint Services

Report Server

Default Website

Administration Server (No Web Admin on)

Get a static IP Address to admin the box

Get a static ip address so that you can admin the box from only a selected set of addresses.

Confirm the Firewall rules to the ISP

Most you will need is normally:

WWW 80 / 443

FTP

HostingUK will have open a standard list.

Download and install Microsoft Baseline Security

http://www.microsoft.com/technet/security/tools/mbsahome.mspx

Run it and follow it.

Windows Update

Setup a Patch schedule and make sure you auto update regularly.

Uninstall un-needed software

If you don’t need it on the box delete it ASAP.

Change the Administrator Password

Change the administrator password. Make sure it is considerably strong
password.

Use http://www.pctools.com/guides/password/ and generator one with a reasonable length of maybe 12 chars.

Switch on Logging

Switching on logging for both SQL Server, Windows and give yourself full logging on IIS.

http://www.visualwin.com/Log-in/logging-failed-logins.html

Sql Server

Read The following:

http://download.microsoft.com/download/8/5/e/85eea4fa-b3bb-4426-97d0-7f7151b2011c/SQL2005SecBestPract.doc

Take offline used Websites

SQL Server 2005

Take Offline the following :

AdventureWorks
AdventureWorksDW
ReportServer
ReportServerTempDB

Rename your sa account on SQL Server and disable it.

The command used is:

ALTER LOGIN sa DISABLE;

ALTER LOGIN sa WITH NAME = [saNewAccountName];

Switch off TCP/IP access for SQL Server

SQL Server TCP/IP is at the moment for security reasons is switched off. No point having it on until we need it on. It is on shared memory.

Admin your SQL Server directly on the box

Means you don’t need to have a TCP/IP connection open.

These are just some general rules I follow when just starting with a box, hopefully it will be a good point for anyone taking over a dedicated box from HostingUK.

Word : Selection.Find.Execute

noreply@blogger.com (James Knowles) — Wed, 02 Apr 2008 11:19:00 +0000

Just because I have run into this one this week. Under no circumstance use

Selection.Find.Execute

in the word object model, it is horribly buggy. It may work on your development box and 80% of the boxes you deploy it on but for 20% of them it will fail on with a lovely com death.

You have to if you need to use the find / replace command in Word. Late bind to it, don't early bind under any circumstance.

object searchText = @"\<\<*_*\>\>";
object myFind = wd.Selection.Find;

object[] Parameters;
Parameters = new object[15];
Parameters[0] = searchText;
Parameters[1] = wdFalse;
Parameters[2] = wdFalse;
Parameters[3] = wdTrue;
Parameters[4] = wdFalse;
Parameters[5] = wdFalse;
Parameters[6] = wdFalse;
Parameters[7] = wdFalse;
Parameters[8] = n;
Parameters[9] = n;
Parameters[10] = wdFalse;
Parameters[11] = wdFalse;
Parameters[12] = wdFalse;
Parameters[13] = wdFalse;
Parameters[14] = wdFalse;

while ((bool)myFind.GetType().InvokeMember("Execute", BindingFlags.InvokeMethod, null, myFind, Parameters))
{

Microsoft have released a KB also. Which took me a while to find searching through google.

http://support.microsoft.com/kb/313104/en-us
http://support.microsoft.com/kb/292744/en-us

Hopefully this one stops someone else having the same nightmare.

WPF and Business line applications

noreply@blogger.com (James Knowles) — Wed, 27 Feb 2008 15:54:00 +0000

I am currently writing LOB in WPF.. Some background before I make my point.

http://blogs.msdn.com/jaimer/archive/2007/12/18/wpflob.aspx

http://www.itwriting.com/blog/?p=455

http://blogs.msdn.com/jaimer/pages/WPFLobWhy.aspx

http://www.danielmoth.com/Blog/2007/10/wpf-and-windows-forms-integration.html

My point.

"WPF LOB is really only going to take off when Microsoft invest heavily in bringing the same components that you find straight out of the box in Windows Forms."

Hold on: Have you not read Daniel Moths intergration bit. Yep. See link above. But it feels like a hack..Sorry it is not a typical hack but it feels like one. It feels like MS wanted to release this technology but have not finished all the components yet, lets put a hack in place so that nobody can complain about it. It makes me very nervous about using a bit technology that needs this type of component in it.. Sorry MS you could not win either way on this one "Dammed if you do dammed if you don't ."

Hold on: You can make amazing interfaces! Yes nobody can disagree with that one, but making basic interfaces takes a long time. Buttons for example require resizing frequently you end up putting them out of size frequently.. Yes I know you should use themes and styles. But your average developer wants straight out of the box a standard set. Standards are good, yes you can enforce them yourself it just take Time.. Time is money. It also slows down the development of building a mock up test application, to sell the idea at the start of project. I presently build them in Windows Forms, but to be honest that should be WPF.

WPF should be the future of ALL windows development it is a very sexy bit of technology but it requires probably a new version of VS to get it to the point where your average LOB developer is actually going to look to commit to it seriously. The time investment at the moment is huge, versus Win Forms development. Window Forms should really not have a place going forward, MS just need to smooth the bumps that are in the way and deliver a little more on standards and controls.

Anyway with the frustrating aside and my moan. I have decided to publish as much of my control kit as possible over the next couple of months. Hopefully that will help either developers close the time gap needed to get going. I will post more on this soon, and maybe even split it off in a dedicated site for the community.

Microsoft are going to improve setup and deployment.

noreply@blogger.com (James Knowles) — Wed, 20 Feb 2008 02:23:00 +0000

Just reading Scott Gu posting
http://weblogs.asp.net/scottgu/archive/2008/02/19/net-3-5-client-product-roadmap.aspx

It outlines some of the major improvements that they are trying to make.
This sentence is music to my ears..

"We’ll also be delivering improvements that enable a more integrated application install experience for both MSI and ClickOnce based solutions, and support a more consumer friendly user experience that is easy to build."

Were do I sign to get onboard on this one.. I have crossed my toes they don't drop this idea. It is essential to pushing WPF out and making Winform deployment smoother than it is at the moment . I deploy one application at the moment by ClickOnce and I can tell you it is seriously painful in places..

Looking forward though to the changes.

Visual Studio 2008 RTM Released, One Released .NET 3.5 Project and First impressions

noreply@blogger.com (James Knowles) — Tue, 20 Nov 2007 00:12:00 +0000

Horrah . Visual Studio 2008 and .NET 3.5 is released.

It took me 1 hour and half to download. (Very impressive MS)

1 hour to burn it to DVD..(Don't ask)

Roughly 1 hour and bit to get it all installed.

I can say I am truely impressed so far, I have managed to convert my beta 2 stuff very quickly.. Yeah sure there were some niggles but nothing like going from Beta 2 of Visual 2005 to RTM. So on that note I introduce the world to my first 3.5 NET Wesbite using DLinq as it background data layer.

www.railwayindex.com

It is just the start for me on getting a .com running and well... converting a few other projects on the way.. Exciting times.

Linq Changes from Beta 2 to RTM

noreply@blogger.com (James Knowles) — Thu, 18 Oct 2007 10:20:00 +0000

http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=2060651&SiteID=1

Some of the changes that are coming from Beta 2 to RTM have been published.

Some good news such as .

"Correct handling of database-generated GUID key values" Horray.

Some interesting news..

Previous Method
(Beta1 and Beta2)
Renamed Method
(VS 2008 RTM)

Add()
InsertOnSubmit()

AddAll()
InsertAllOnSubmit()

Remove()
DeleteOnSubmit()

RemoveAll()
DeleteAllOnSubmit()

I know exactly why they are changing this when you first start linq you believe that an Add() would actually add to the database in Linq SQL .. That in fact is not true till you actually submit a change. I.e

using (YYYDatabaseDataContext rdb = new YYYDatabaseDataContext())
{
RssFeed rssFeed = new RssFeed();

rssFeed.CopyRightNotice = "bbc.co.uk/news";
rssFeed.DateAdded = DateTime.Now;
rssFeed.RssUrl = urlFeed;
rssFeed.RssXML = xmlString;
rssFeed.Title = "BBC News";

rdb.RssFeeds.Add(rssFeed);
rdb.SubmitChanges();

}

When you don't add SubmitChanges() your code does not throw any exception or warning it just does not add/change anything to DB. Most devs when first starting with Linq will assume the rdb.RssFeeds.Add(rssFeed) would be good enough, because it is in everything else in .NET such as collections.

This cause serious dev risk in terms of code problems and it is something that I starting to think maybe worth writing a tool to look for this potential issue in large codes basis. I have already come across the issue myself, I have forgotten to add SubmitChanges(). You code looks fine but you seem to lose a record into table through your process.

Although in my heart I welcome the change because it will solve alot of the confusion it is going to be one of those changes that early adaptors will be very frustrated with.

Search and replace for Add is not actually that simple beacuse you use .Add in all sorts of contexts . I.e Generics Lists, collections. So it looks like one of my projects I will be adding a couple of days to project time to move from Beta 2 to RTM. Fair enough the risk of being in early, but it just important lesson to all Devs when building frameworks that naming things correctly from start, gives you alot less pain latter both in support of product but also in making a change late in the day if you have customers out in beta/alpha developing on the platform