Ruminations of J.net

Azure .NET Dojo PPT

jsawyer — Tue, 07 Jul 2009 15:39:14 -0500

OK … here it is. I know it took too long to get it up here, but better late than never.

The PPTX file is here and the labs and source for the (modified) personal web site starter kit are here. I will be doing a post about the (numerous) things that are wrong with that starter kit.

Final (?) Comments on Windows Server 2008 R2 as a desktop

jsawyer — Mon, 22 Jun 2009 16:35:41 -0500

I know … I keep bringing this up. It’s been a long road and there were still a couple of things that I found that I needed to really, truly, fully replace Vista/Windows 7 client with Windows Server 2008 R2 for my desktop OS … on both my traditional “desktop” machine and my laptop. I think, finally, I’ve got all of them worked out.

Power Management/Sleep/Hibernate Mode: I absolutely love sleep mode. I see no need to keep my machine running at 100% power all of the time. And I’m impatient so I don’t like to wait for a full reboot if I don’t have to. I don’t do hibernate too much but that’s also nice to have. As I’m sure you are aware, Windows Server has no problem with the whole power management stuff … until you enable the Hyper-V role (which is one of the biggest reasons that I want to run Server 2008). Once you enable Hyper-V, you lose all power management capabilities. In Windows Server 2008, there was nothing you could do about this. When folks raised this as an issue, Microsoft’s response was … tough. Hyper-V is supposed to be on a server and a server never sleeps. It doesn’t matter if you have VM’s running or not either. A lot of folks came up with workarounds/hacks that “enabled” this, with various degrees of success. Well, apparently there was enough of a hubbub for the Microsoft folks to do something about it. You’ll need to create a new boot entry with BCDEdit and set hypervisorlaunchtype to off. Full details and step-by-step instructions are on Virtual PC Guy’s WebLog. You will have to reboot to re-enable Hyper-V (and the hypervisor) but that’s OK for me … I don’t always run VM’s and I’ll accept the reboot for that. It’s not my ideal scenario, but it works.

Zune: This sucked. I couldn’t get the Zune software to install for anything. Improper version or some such nonsense. Which meant that I couldn’t access my Zune pass and couldn’t sync with my Zune unless I dual booted. Apparently, the Zune folks don’t think that Windows Server is an appropriate platform for Zune. Fortunately, I found a post on David Zazzo’s blog that takes you through doing this step-by-step. One note: I right-clicked on packages\Zune-x64.msi and clicked on “Troubleshoot Compatability” … which applied the settings “Skip Version Check”. Just running ZuneSetup.exe … even in compatibility mode … didn’t work.

.NET Dojo: Windows Azure

jsawyer — Mon, 08 Jun 2009 13:49:58 -0500

Here’s the info on the next .NET Dojo. Did you think it’d be gone? Well, I hope not and I’m working with Zain to transition the program over to him. That said, I will be doing my very first Dojo! The topic is Windows Azure (duh!) and it promises to be a good time for all.

Event Overview

Windows Azure is the cloud services operating system that serves as the development, service hosting, and service management environment for the Azure Services Platform. Windows Azure provides you on-demand compute & storage to host, scale, and manage Web applications and services on the Internet in Microsoft data centers.

In this Dojo, we'll dig into how to work with Windows Azure to build applications that run in the cloud ... using the skills you have and the tools that you are familiar with. We'll introduce the key concepts in lecture and then immediately apply those concepts in hands on labs. At the end of the Dojo, you'll be able to create applications to leverage this platform and its functionality, including tables, blobs, queues and, of course, web sites.

Attendees will be expected to bring their own laptops with the prerequisites (below) to participate in the hands-on labs.

Prerequisites:

· Windows Vista SP1 or Windows Server 2008 SP1

· IIS 7.0 (with ASP.NET, WCF HTTP Activation and optionally CGI)

· Visual Studio 2008 Professional (Trial OK)

· Visual Studio 2008 SP1

· Sql Server Express (2005 or 2008)

· Windows Azure Tools for Microsoft Visual Studio March 2009 CTP

· KB967631: Update for Visual Studio 2008 SP1 Debugger

Dates, Locations and Registration:

Houston: June 19, 2009 1PM-5PM @ the Houston Microsoft Office

Austin: June 26, 2009 1PM-5PM @ the Austin Microsoft Office

Hope to see you there!!

Life After Microsoft

jsawyer — Mon, 08 Jun 2009 13:40:20 -0500

Yes, there is “Life After Microsoft”. As I said, I’ve been taking something of a break but I’m getting back into the swing of things. Not that it was really much of a “vacation” … I just couldn’t stay off the computer or dev stuff, but it was light and nothing serious.

So what’s next? Well, after some discussion, I’ll be working with EPS Software on several different projects and initiatives. I’ll also be working with my old friend Dana on building out KinetikHosts and a startup web site that I won’t detail here. The biggest part, however, will be working with Markus and the EPS family and I’m very excited about that. I’ve known the folks there for quite some time and it’s a great environment – challenging, but relaxed and fun.

So … there you have it!

More on Windows Server 2008 R2 as a desktop

jsawyer — Mon, 11 May 2009 16:13:37 -0500

Since I did the last post on this, I’ve also (now) installed Server 2008 R2 on my personal desktop … as my laptop had to be turned in. In doing this and getting it set up to be a day-to-day desktop OS (as opposed to a demo machine OS), I ran across a couple of other things that I thought were worth noting.

IE ESC: That’s Enhanced Security Configuration … the ultra-secure-because-it’s-only-HTML mode of Internet Explorer that is enabled by default on Windows Server. Again, something that makes a TON of sense but it doesn’t work very well when you are using it as a desktop. I had thought (silly me) that it’d be easy … go into the Server Manager and turn it off. Well, there were complications. Here’s the deal: I run with a different account than the built-in Administrator account. It’s also the account that ties my machine to my Windows Home Server (which is way cool, btw). When I created the account, I did not initially add it to the Administrators group. So, when I turned IE ESC off for Admins, it didn’t turn off for that account … because it wasn’t an admin. Easy enough … I turned off IE ESC for all users. Nope. Didn’t work. Added my account to the Administrators group. And it still didn’t work … I was still running IE in the Enhanced Security mode. Even after rebooting. I went to “User Accounts” in Control Panel (it’s just like on the desktop version) and couldn’t add that account as an Administrator account there either. So … I wound up deleting the account and recreating the account using the "User Accounts” applet in Control Panel, creating it as an administrator account. Then it worked. Just fine. I don’t know why this happened. I cannot explain it at all. But there it is.

Windows 7 Themes: I did turn on the themes and eye candy as mentioned previously. But the Win7 themes aren’t included and I couldn’t find a way to install them. Easy enough … copy them from a Windows 7 installation. They will be under %WINDIR%\Resources\Themes. You’ll also want to copy the pictures (%WINDIR%\Web\Wallpaper) and the cursors (%WINDIR%\Cursors). They will then appear in your personalization window.

Windows Search: This one is important for finding stuff in Outlook and on your drives in a reasonable amount of time. It is not installed by default in Windows Server … and Outlook will tell you all about it and the necessity of installing it if you want to do any searching. You cannot find it in Features. There’s a download for Windows Search 4.0 for Vista … that doesn’t work either (refuses to install). Where is it? It is under Roles …File Services … Windows Search. Perfectly logical right?

So there it is. I’ll post any more tidbits as I happen across them. So far, though, all is well and happy.

Leaving Microsoft …

jsawyer — Wed, 06 May 2009 14:36:05 -0500

As I’m sure you know, Microsoft has been reorganizing, eliminating positions and reducing headcount … layoffs.

Well, after 9 years, I’m one of the folks hit by that.

I’m not going to sit here and tell you that’s it’s great, wonderful, etc. etc. It’s not. It’s hard and it sucks. But it could be a lot worse … Microsoft’s severance package is extremely generous and it will certainly give me the opportunity to take a little vacation time while I determine where I want to go from here. Beyond that, I will have assistance for outplacement as well. So, even in the leaving, I find myself lucky to work for a company as great as Microsoft. And, at the end of it all, I know that I will land on my feet and that the experiences that I’ve had at Microsoft will certainly be a part of that. I have had worse things happen to me … I have been through far worse things than this … and I have always come out better for it.

It has been a good 9 years. I’ve seen a lot of change at Microsoft and a lot of priorities realigned. I’ve seen the company grow in new directions and in new ways that none of us would have imagined in 2000. It’s always been interesting and challenging, to say the least. It’s been a fun ride and I don’t regret a moment of it. I, too, have grown a lot during this time.

Now … the question of tomorrow. I cannot tell you anything right now. What I can say is that I will be taking a week or two off (the longest *unplugged* vacation that I’ve had, I think, since high school) and figuring out where I want to go from here. But I can tell you this … I have been very involved in the community here in South Central, in Second Life, and in the open source world. That will not stop. I will continue to be active in those communities. It is something that I believe in.

But … for right now, for a time … I’m gonna take some time off. I’m gonna go hit my XBox and blow stuff up. Aliens and bad guys of all stripes … you have been warned.

Windows Server 2008 R2 as a Desktop OS

jsawyer — Mon, 04 May 2009 15:41:27 -0500

Before anyone gets started lecturing me that it’s a server OS and not meant to be used as a desktop, let me say this: Yes, I know. That’s nice. But I can use it as a desktop OS for work, demo, etc. etc. etc. So I’m doing it … partly because I can (the ultimate Geek reason) and, more importantly (or is this the excuse?) because it’s better for me to use it like that for my job. Now that I think of it, that second one is a wonderful “reason” to do all sorts of geeky things with my machines.

But … it’s required some amount of addition configuration to get Server 2008 R2 to look like the Windows 7 client UI … something that I’ve really, truly become totally addicted to. So I figured that I’d share all of that with y’all. Most of it is about the eye-candy but the Wireless LAN stuff was … well, let’s just say that it wasn’t optional.

Wireless LAN: This was the first one that I needed to add and it drove me nuts. It reminded me of the frustration that I experienced getting the sound working on Windows Server 2003 when I installed the RC (it was off by default). Put simply, wireless doesn’t work … at all .. unless this feature is added (look in Server Manager … Features). However, unlike the sound services in Windows Server 2003, it didn’t take me some 5 hours to figure this out. Once you do that, make sure that the service “WLAN AutoConfig” is set for automatic startup.

Sound: Since I mentioned this above, I wanted to note it separately. Sounds are completely disabled by default on Windows Server … all versions since Windows Server 2003. This makes complete and total sense … you won’t (typically) be playing music in Windows Media from you server box. Unless you are using it as your desktop OS. So go into “Services” and enable the “Windows Audio” service.

Eye Candy: A catch-all for all of the “pretty stuff” in Win7, including Aero Glass and the nifty window previews from the task bar. To get started in this, go back to Server Manager … Features and add “Desktop Experience”. If you have a TabletPC, you’ll also want to add the “Ink and Handwriting Services”. But you aren’t done yet … there are some services that, regardless of the features that you add, you need to enable or make sure are enabled. They are “Desktop Window Manager Session Manager”, “Tablet PC Input Service” (for Tablet users) and “Themes”. Without Themes, btw, you won’t get the option for Windows Aero, regardless of what you do. Even with that, you don’t get all of the themes that ship natively with Windows 7. I’m sure that you can put them on there if you want to, but that hasn’t been something that, honestly, I’ve bothered with looking up and/or figuring out.

Additional Settings: Once you have everything installed, there are some things that still don’t work. But they will. Again, the biggest thing that I was looking for was the thumbnail previews in the task bar. I have to be honest here … there is a lot of cool stuff in Windows 7. Some of it is just cool and some features really make my life easier. But the preview in the taskbar is the single biggest productivity feature feature for how I work. It’s common for me to have multiple windows for the same app open. It’s common for me to have zillions of open tabs in IE. It’s a normal course of day-to-day computing for me to be working on demos, etc. on my primary/personal desktop while having RDP sessions open to my work laptops. Preview enables me to more efficiently and easily move between all of the open windows and even just “check” to see what’s happening on an RDP session. It’s moving quickly from a “nice to have” to a “need to have”. But … even if you do all of the above, it is not enabled in WinSvr 2K8 R2. You need to go to My Computer … Right-click .. properties. Select the “Advanced” tab. Under “Performance”, select “Adjust for best appearance” and it’ll appear. While I’m sure that there is an individual settings that does it (perhaps “Enable Aero Peek” and “Enable desktop composition”), I went with the “nuclear option”.

There is one final thing that is not currently exactly how I want it … that’s the taskbar thumbnail previews over RDP. As I mentioned above, I typically work across three machines via RDP. I do have this enabled and working just fine on one laptop – after I went into the RDP settings and set the “Experience” setting to ”LAN” but that isn’t doing the trick on my server machine. I will be digging around to find it when I have time to do so but I’m also open to tips and/or suggestions from y’all. Assuming that I find the answer, I’ll post it here. If one of y’all provides me with the answer, I’ll certainly give due credit.

Bikers, Geeks and Community

jsawyer — Fri, 24 Apr 2009 17:06:08 -0500

When motorcyclists pass each other in opposite directions, they wave at each other. Watch them sometime; you’ll see this happen. A lot of non-motorcyclists (we call them “cagers”) don’t notice this until it’s pointed out but you’ll see it if you look for it. It doesn’t matter if you are riding a crotch rocket or a Harley, a Goldwing or a dual-sport, if you are suited up in all leather and a helmet or are riding with no gear at all, bikers will still wave. If a motorcyclist sees another biker stopped on the side of the road, they will usually stop to check and see if they are OK. That’s just how it is. When commuting, bikers will also sometimes join each other in traffic and ride together for a time as their commute allows. Again, you’ll see this. But I’d bet you never even considered that those two bikers didn’t know each other. There are also biker-specific forums – I’m on Two Wheeled Texans – that all kinds of bikers participate in. There are also group rides; random people hooking up just to ride together. Some are random groups from the boards, some more “organized”. For example, TWT has a monthly “Pie Run” to a small restaurant in a small town in Texas and there will be anywhere from 80 – 250 bikers show up, on ALL kinds of bikes from ALL over Texas. I even saw someone at one of the Pie Runs on a vintage 1943 Army issue Harley! Bikers will also get together for a “Bike Night”. As the name implies, it’s an evening for bikes and bikers to hang out together at a local restaurant/ice cream shop/parking lot/whatever. I can often be found at “Katy Bike Night” on Wednesdays, munching on empanadas with anywhere from 3 to 20 fellow TWT’ers.

There is a strong sense of community among motorcyclists that is built on a common, shared experience … namely riding a motorcycle. We share a love for riding, feeling the wind blowing over us. We also share common dangers and risks - for the most part, “cagers” are the greatest risk but that’s not the only one (think … weather … a 45 MPH crosswind is absolutely, positively NOT FUN). Sure, we have our differences – every group does - but the sense of community is stronger than that. Yes, there are some individual exceptions to this but, as a rule, that’s how it is. And those that get snobby about their “group” are considered rude at best. And I won’t even mention “squids”.

Why do I mention this? Well … it’s that community thing. I’ve been involved in the developer community for some six years now and the biker community for about 2 years. I can tell you, the biker community is much stronger and, even more importantly, much more inclusive. In the developer community, there is – and let’s be honest here – a huge wall separating technologists with different specializations. Java guys don’t talk to .NET folks and they don’t talk to PHP folks. Linux folks don’t talk to Microsoft folks. Sure, there are exceptions here and there but the rule is different; we don’t intermingle. Do you know of any boards online where you have PHP and .NET and Java folks all mixin’ it up together in harmony? I certainly don’t. Even boards that cater to all types of technologists will have different forums where techies of like technologies congregate, with very little interaction between the groups. We tend to get wrapped up in our own areas of technology and look at technologists in other areas with wariness at best. Certainly one difference is competition … if Java is chosen as a technology at a given company, the .NET folks will be looking for work. And, again, vice-versa. That’s not the case with motorcyclists – it has no impact on my life if a fellow biker buys a new Ninja or a new Goldwing … I can appreciate both and it has no bearing at all on my ability to provide for my family (even if you won’t get me caught dead on a Goldwing!).

But there’s something more than that – overall, there also seems to be little interaction between infrastructure/network folks and developer types even in the same technology area.

When you think about it, it’s actually quite silly. Yes, there is that competition but I can’t see why we can’t be more like the motorcyclist community … inclusive and sharing what we have in common (which is quite a bit) rather than focusing solely on our differences. All of us have a love for technology and we all have the same gripes and issues with end users, customers, managers and the like. Regardless of our technology, there is much that we can share and much that we can learn from each other. Even if that’s only an appreciation for other technologies.

I think it’ll be interesting to walk into a PHP user group. I’d bet that they are little different from the .NET user groups that I go to. I won’t say anything. Well, I’ll try not to say anything or too much at least. Not there to convert them, spy on them or any other such nonsense. Just getting a feel. Who knows … maybe I could persuade one or two to see what a .NET user group is like. And get them cross-pollinating with .NET folks going to PHP user groups. It won’t be the end of the world by any stretch of the imagination. But it certainly make the community much more interesting. And maybe … just maybe … we’ll take a step towards breaking down these silly walls that would divide us.

We’ll see …

Moving from dasBlog to BlogEngine.NET

jsawyer — Wed, 22 Apr 2009 09:54:36 -0500

As I mentioned previously, I’ve moved from dasBlog to BlogEngine.NET for this blog. This, of course, involved reformatting and redesigning the look and feel of the site; that’s nothing unique to the migration and I’m not going to go into that at all. What I will do, however, is discuss the process of moving existing content over from dasBlog to BlogEngine, something that isn’t really hard but does have a few gotchas.

Moving the Content

That’s the first thing that needs to be done. In fact, I did this before I even started formatting the new site – I wanted to be sure that the existing content rendered relatively well in the new design. It was not quite as simple as described on Merill’s blog. All of his steps are valid, but there is actually a couple of other things that need to be done. You will definitely want to use the dasBlog to BlogML Converter that Merill posted on MSDN Code Gallery – dasBlog doesn’t do BlogML and, while BlogEngine will import RSS, RSS usually will not get all of your content. BlogML works much better.

There were two things with moving the content … how big a deal those are depend on how picky you are about the move. I was. First, the timestamp on the entry. dasBlog uses UTC (GMT) to store the time and that’s how it is imported into BlogML. BlogEngine uses the server time. Both have an offset to convert the saved time into blog local time, but dasBlog’s offset is from UTC (using standard time zones) and BlogEngine uses an offset from the server time. My server is on US Eastern Time and my local blog time is US Central Time, which means that, on import, I had to convert the time to US Eastern and then set my offset in BlogEngine to –1 (US Central is 1 hour “behind” US Eastern). To do this, I had to modify the code that imported the blog entries, which can be found at BlogEngine.Web\api\BlogImporter.asmx. Since the incoming BlogML only had a post date, not a DateCreated and a DateModified (as BlogEngine does), I also set both the create date and the modify date to the same value. Here’s the code snippet from AddPost:

Post post = new Post();
post.Title = import.Title;
post.Author = import.Author;
post.DateCreated = import.PostDate.AddHours(-5);
post.DateModified = import.PostDate.AddHours(-5);
post.Content = import.Content;
post.Description = import.Description;
post.IsPublished = import.Publish;

Once I set BlogEngine’s server time offset (in the admin section under “Settings”), all of the times were now correctly displayed as US Central.

The second thing relates to the tags … BE uses tags (and categories) while dasBlog only uses categories. In dasBlog, the “tag cloud” is generated from the categories and BE generates this from the actual post tags. I can’t say which method I like better yet or if I prefer some mish-mash of the two (generate the cloud from tags and categories … that may be an idea) but I did know that I didn’t want to lose my tag cloud. So, on import, I added tags for each post category to the imported post. Again, simple and again, in AddPost:

if (import.Tags.Count == 0)
{
    post.Tags.AddRange(import.Categories);
}
else
{
    post.Tags.AddRange(import.Tags);
}

From a performance standpoint, I couldn’t tell you if AddRange is faster than looping block to add each value individually (and it really doesn’t matter here), but it is simpler, cleaner and much easier to read … so I tend to prefer AddRange().

With these two “issues” resolved – and they aren’t issues with BE, to be sure, just a difference between the two – I was ready to move on.

Preserving links

Some of my entries have a pretty good page rank on various search engines and there is a non-trivial amount of traffic that is generated from these search engines. While I can go in and change things like the RSS source for my feed from FeedBurner to make the move transparent, that doesn’t help with the search engines. Therefore, I needed a way to ensure that existing links would continue to work without returning 404’s. Yes, I moved the old domain over to the new domain and added it as a host header on the new site, but that does not help prevent link breakage and BE and dasBlog have different formats for their links. I also did not, at this point in time, want to force a redirect as soon as a new person hit my site from a search engine; it’s just rude (IMHO) and doesn’t create a great user experience. Sure, maybe it wouldn’t be a big deal, but I didn’t like it. And besides, it gave me an excuse to write code. :-)

To keep the links intact, I decided that I would leave BlogEngine’s UrlRewriting intact; I didn’t want to make too many changes to the base source code as it would make it harder for me to move between versions/revisions. Rather, I wanted to sit on top of it and make sure that the links worked. So I used ASP.NET Url Routing to intercept the requests and send them to the right place (post.aspx). Before I go into the code, let’s first examine the (default) url structures for individual posts. In dasBlog, the post link is in the format yyyy/mm/dd/{CompressedTitle}. In BlogEngine, this would be post/{CompressedTitle} –or- (the permalink format) post.aspx?id={PostGUID}. While BE can have the date as a part of the post link, it still wouldn’t work; they compress their titles differently and, as mentioned before, dasBlog uses UTC internally and it’s used in the link as well.

For the routing, I created the route using "{Y}/{M}/{D}/{Title}" as the route url. From there, I needed to implement GetHttpHandler to do the work. Initially, I did the matching to title using a Linq query and it worked just fine. The problem with this is that every title in the posts would need to be converted to the dasBlog format (I copied over the dasBlog CompressTitle method as dasBlogCompressTitle), a process that seemed far from ideal. Once I understood how the dates worked, I was able to do the primary matching on the date and then, if necessary, match the titles for posts on the same date, minimizing the string manipulation that was required. Once I determined what the matching post was, all I needed to do was append the query string “?id={postGuid}” to the URL and then pass back the HttpHandler from post.aspx for the actually processing. If there was no match, then there would be no query string appended and post.aspx would show a 404. The code for this is below:

public System.Web.IHttpHandler GetHttpHandler(RequestContext requestContext)
{
    //Get the date from the route. 
    string dateString = string.Format(@"{0}/{1}/{2}",
        requestContext.RouteData.Values["M"],
        requestContext.RouteData.Values["D"],
        requestContext.RouteData.Values["Y"]);
    string titleString = ((string)requestContext.RouteData.Values["Title"]).Replace(".aspx", ""); 


    DateTime postDate = DateTime.MaxValue;
    Post selectedPost = null; 
    if (DateTime.TryParse(dateString, out postDate))
    {
        //Date is valid at least. 
        //Find posts with the same date.
        //Date in URL is in UTC. 
        var postsForTitle =
            from p in Post.Posts
            where p.DateCreated.ToUniversalTime().Date == postDate
            select p;
        if (postsForTitle.Count() == 1)
        {
            //There is only one posts for the date, so this must be it. 
            selectedPost = postsForTitle.First(); 
            
        }
        else
        {
            //differentiate on title. 
            foreach (var p in postsForTitle)
            {
                if (dasBlogCompressTitle(p.Title).Equals(titleString, StringComparison.InvariantCultureIgnoreCase))
                {
                    selectedPost = p;
                    break; 
                }
            }
        }
        if (selectedPost != null)
        {
            //Use UrlRewriting to put the id of the post in the query string. 
            requestContext.HttpContext.RewritePath(requestContext.HttpContext.Request.Path + "?id=" + selectedPost.Id.ToString(), false);
        }
    }

    return BuildManager.CreateInstanceFromVirtualPath(
        "~/post.aspx", typeof(System.Web.UI.Page)) as System.Web.IHttpHandler; 

}

Once I set it up on the web.config file and added the routes to the RouteTable, all was good and it worked fine.

Preserving the RSS Feed Url

The final step - and the thing that occurred to me last – was to make sure that the RSS feed url continued to work. While FeedBurner had no problem with changes the RSS url for my blog, there was the possibility (however remote it may have seemed) that someone was using the dasBlog’s RSS feed rather than FeedBurner. I’m not sure how remote a possibility this is but I didn’t use FeedBurner in the early days of the blog, so I figured that it might be an issue. And I certainly wouldn’t want to alienate the longest-time subscribers to my feed. This was incredibly simple and didn’t require any code at all, just two lines line in the web.config file to have SyndicationService.asmx (dasBlog’s RSS feed) handled by BlogEngine’s RSS feed, which is implemented as an HttpHandler and, by default, at syndication.axd. The first line is for IIS 6.0/IIS 7.0 Classic mode and is under the httpHandlers node of system.web:

<add verb="*" path="SyndicationService.asmx" 
     type="BlogEngine.Core.Web.HttpHandlers.SyndicationHandler, BlogEngine.Core" 
     validate="false"/

The second goes in the corresponding location for IIS 7 Pipeline mode, in the handlers node of system.webServer:

<add name="dasBlogSyndication" verb="*" path="SyndicationService.asmx" 
     type="BlogEngine.Core.Web.HttpHandlers.SyndicationHandler, BlogEngine.Core" 
     resourceType="Unspecified" requireAccess="Script" preCondition="integratedMode"/>

These were copied from the default nodes used by BlogEngine for it’s syndication.axd and then the relevant attributes were changed. Simple enough.

Sql Injection #1 Hacker Technique

jsawyer — Tue, 21 Apr 2009 11:37:01 -0500

On April 15, Verizon Business Security Solutions released The 2009 Data Breach Investigations Report, a comprehensive analysis of the data breaches that they investigated throughout 2008. A total of 285 million records were compromised as a result of these breaches and 79% (approximately 214 million records) of the compromised records were compromised utilizing SQL injection based attacks, typically through custom-developed web applications. As attackers are targeting the financial industry (representing 93% of total records) and, in particular, PIN data together with their associated credit and debit accounts, for focused attention, these records represent a far greater risk to the compromised user’s financial data and funds than magnetic stripe records or simple credit card account numbers.

Do I have your attention yet? Are you thinking to yourself “Holy Cow!”? I know that I was when I first saw this … we’ve known about the potential exploits of Sql Injection for a long time now (almost 10 years) and it’s still the most successful method of choice for data breaches. And these aren’t easy or simple breaches … the breaches that are considered the most complex are responsible for 95% of the compromised records … some of these attacks were the result of months of research. Who, you may ask, would have the time, patience and resources to dedicate so much time to an attack? Of the external breaches where the IP was traced to a specific entity, 16 out of 25 were traced to known organized crime outfits We aren’t dealing with the zit-faced script kiddie here, munching pizza in the darkness of his parent’s basement. We’re talking about career criminals that will take advantage of this information. Conventional wisdom often points to insiders as the most dangerous breach, but this data does put give pause to that assumption. The largest and most damaging breaches were externally sourced, not internally. Still, one should not, and in looking at the data, cannot, dismiss the damage potential of internal breaches; while the largest individual breaches were external, the median number of records compromised from internal attacks was just over 2.5 times the number of records from external sources. As far as risk and damage potential, both sources are a high risk for compromise.

“Wow!” you say “I thought that Cross Site Scripting was OWASP’s #1 threat!” Well, injection attacks are #2 and I’d bet it was a close race. That said, it’s not so simple. Cross Site Scripting (XSS) and Cross Site Request Forgery (CSRF) have been used to spread JavaScript-based worms that then use Sql Injection for an attack. Attacks vectors, it seems, don’t like to be alone and prefer to travel with their buddies.

We’ve known about Sql Injection and its potential for damage for a long time now. We’ve known that this type of attack is technology and database agnostic. Yet it is still a major issue. And it’s difficult to get developers to actually listen to security talks … there is still the attitude, it seems, that security is an infrastructure problem – but it clearly is not.

Are you one of the ones that care deeply about security? Or do you want to prove my previous statement wrong (I’d love to be proven wrong on that)? Why don’t you show up at the Houston OWASP group or your local OWASP group?