Geekswithblogs.net

Why I Chose WordPress Over Geeks With Blogs, And Moving From WordPress.com To A GoDaddy Hosted Solution

deadlydog — Fri, 17 May 2013 17:57:31 GMT

Originally posted on: http://geekswithblogs.net/deadlydog/archive/2013/05/17/why-i-chose-wordpress-over-geeks-with-blogs-and-moving.aspx

A while back I wrote about some reasons why I didn’t like GWB (Geeks With Blogs) and was attracted to WordPress. 6 months later and I am confident that I made the right decision. GWB was good to me, but…

Exploiting the Non-Uniqueness of Guids

Chris Gardner — Fri, 17 May 2013 08:48:42 GMT

Originally posted on: http://geekswithblogs.net/freestylecoding/archive/2013/05/17/exploiting-the-non-uniqueness-of-guids.aspx

You know those seemingly random Guids? Guess what? They're not random.

I'll give your head a moment to recover from that bombshell.

Ok, back with me? Good.

I was digging DEEP in some hardcore specs when I stumbled upon this. I had a situation where I have a Guid as a unique identifier. This identifier had some subsequent child data that needed to refer to the global object but required different handling. Yes, I'm being slightly vague. I do have to respect company proprietary data.

Due to this dilemma, I had a really weird "hash table" to quickly find the identifier from the child object. While this solution worked, and was REALLY fast, it was very messy and complex. I decided I needed to hack something to reduce this complexity.

I know. I just said I wanted to reduce complexity, and that my solution was to hack Guids. The sick humor of this is not wasted on me. You knew what you're getting into when you read my blog.

Turns out, there is a status field in the Guid. I was scouring the Wikipedia article on Guids when I read the Binary Encoding section. Turns out 3 of the bits have a special meaning. More specifically, if you were dealing with the Guid 00000000-0000-0000-x000-000000000000, part of the hex value of x means something. Guids in .NET, generated by the System.Guid structure, are all "standard" Guids. As such, they will always have the bit mask of 00000000-0000-0000-8000-000000000000.

If you don't believe me, go do a select on your largest database column. That hex value will always be either 8, 9, A or B.

If we exploit this, we now have 2 bits in our 128 bit number which we can control. We know those 2 bits being 10 will refer to our master identifier. However, since they are fixed, we can use 00, 01 and 11 as attached, but still unique, child Guids. This child Guids will always point back to the parent Guid by restoring those 2 bits to 10.

Happy Friday, people.

APress Deal of the Day 17/May/2013 - Pro HTML5 with Visual Studio 2012

TATWORTH — Fri, 17 May 2013 01:40:33 GMT

Originally posted on: http://geekswithblogs.net/TATWORTH/archive/2013/05/17/apress-deal-of-the-day-17may2013---pro-html5-with.aspx

Today's $10 deal of the day from APress at http://www.apress.com/9781430246381 is Pro HTML5 with Visual Studio 2012

"Pro HTML5 with Visual Studio 2012 is written to help ASP.NET developers make the leap to the inevitable and exciting world of HTML5. "

Extending Team Explorer 2012 – Associating Recent Work Items

Jakob Ehn — Thu, 16 May 2013 11:29:44 GMT

Originally posted on: http://geekswithblogs.net/jakob/archive/2013/05/16/extending-team-explorer-2012-ndash-associating-recent-work-items.aspx

Extension available at: http://visualstudiogallery.msdn.microsoft.com/9ed2d30c-a692-42b0-a21d-cdc8d2bf322c

I have been playing around a bit lately with extending Team Explorer 2012, mostly because it is fun but also to fix a little nagging feature that should have been there from the beginning. Often I (and a lot of other people) find myself wanting to associate several consecutive changesets to the same work item. The problem is that Team Explorer does not remember this, instead I have to either remember the ID or use a query that hopefully will match the work item.

Where is the work item that I just associated with?

True, when using the My Work page and the teams and sprint backlogs are correctly setup, you can find “your” work items there, but every so often this is not the case, and off I go to locate that work item again.

So this seemed to be a good feature to implement and at the same time learn a little about how to extend Team Explorer in Visual Studio 2012.

There is a great sample posted by Microsoft over at MSDN, it also talks about the main extension points and classes/interfaces that you need to know about. You can find it here: http://code.msdn.microsoft.com/windowsdesktop/Extending-Explorer-in-9dccd594. If you have developed extensions to Visual Studio before, you will be relieved to know that this new extension model for Team Explorer is purely based on standard .NET/WPF and MEF, no weird COM interfaces.

You can add new pages to Team Explorer, you can add new sections to existing pages and you can add navigation links to the Home screen. All these extensions are discovered by Team Explorer using the Managed Extensibility Framework (MEF). You just need to attribute your classes with the correct attribute and it will be found by Team Explorer. The attributes also control where your extension will appear. This extension is a Section that should appear inside the Pending Changes page:

Example of attributing a Team Explorer extension

The last property (35) is a priority number that controls when the extension is created and also where it will placed relative to the other sections. The existing Related Work Items section has priority 30, so 35 will place our extension right below it.

We also need to implement the ITeamExplorerSection interface, that contains properties and methods that needs to be implemented for anything to show up.

ITeamExplorerSection interface

The most interesting property here is the SectionContent property which is where you return the content of your extensions. This is typically a WPF user control in which you can add any controls you like.

This is how the extension appear inside the Pending Changes page. It will analyze your recent changesets in the current team project and extract the last 5 associated work items and show them in a list.
From the list you can then easily add a work item to the current pending changes by right-clicking on it and select Add. You’ll note that the work item will then disappear from the list, since you are not likely interested in adding it again.

Recently Associated Work Item section

I encourage you to read the MSDN article for more information about the possibilities to extend Team Explorer 2012. Also, try out the extension and let me know it you find it useful!

I was surfing io13 and found this interesting article from google

foxjazz — Fri, 17 May 2013 00:08:42 GMT

Originally posted on: http://geekswithblogs.net/foxjazz/archive/2013/05/16/i-was-surfing-io13-and-found-this-interesting-article-from.aspx

http://readwrite.com/2013/05/01/10-technology-skills-no-longer-in-demand

copied here just in case the link breaks.

10. Something That Seems Secure Today

The TIOBE Programming Community Index lists C, Java, C++ and Objective-C as the programming skills most in demand right now. But here's the thing. In 2009, Objective-C was barely in use. The rapid success of the iPhone and iPad vaulted the language's popularity. Now, however, just over three years later, its popularity is already stabilizing.

In today's superheated technology environment, even the most popular, most secure seeming technology skills can suddenly become obsolete. That's just the way it is. No matter how in-demand your current skill set, you can never rest on your resume.

Learning Is The Key

Will highlighting the wrong skill set to a recruiter brand you as out of touch - or too expensive to hire? Perhaps. But don't expect anyone to tell you that's what going on. More likely, they may just won't return your call, or let your resume vanish into the ether. (There will probably always be a few legacy jobs in all these areas, but that's about it.)

The only solution is to keep learning - and keep showing that youcan learn. While the pace of skills disruption may well be increasing, learning new skills has never been easier. That includes formal schooling as well as free and low-cost resources like Khan Academy and CodeAcademy, for example.

Here's the bottom line: Since so much technology is fairly new to everyone, why should a company invest in experienced candidates - rather than someone just starting out? Writing forThe Wall Street Journal, business professor and entrepreneur Vivek Wadhwa, was brutally direct:

It may be wrong, but look at this from the point of view of the employer. Why would any company pay a computer programmer with out-of-date skills a salary of say $150,000, when it can hire a fresh graduate — who has no skills — for around $60,000? Even if it spends a month training the younger worker, the company is still far ahead.

It's not just about the money, of course. To justify any salary, it's not only about what you know - now - but what you can learngoing forward. The key to a long career in Silicon Valley, or anywhere in the tech world, is showing that you can learn and adapt - and master - constant change.

Good luck!

.NET Security Part 3

simonc — Thu, 16 May 2013 10:52:00 GMT

Originally posted on: http://geekswithblogs.net/simonc/archive/2013/05/16/.net-security-part-3.aspx

You write a security-related application that allows addins to be used. These addins (as dlls) can be downloaded from anywhere, and, if allowed to run full-trust, could open a security hole in your application. So you want to restrict what the addin dlls can do, using a sandboxed appdomain, as explained in my previous posts.

But there needs to be an interaction between the code running in the sandbox and the code that created the sandbox, so the sandboxed code can control or react to things that happen in the controlling application. Sandboxed code needs to be able to call code outside the sandbox.

Now, there are various methods of allowing cross-appdomain calls, the two main ones being .NET Remoting with MarshalByRefObject, and WCF named pipes. I'm not going to cover the details of setting up such mechanisms here, or which you should choose for your specific situation; there are plenty of blogs and tutorials covering such issues elsewhere. What I'm going to concentrate on here is the more general problem of running fully-trusted code within a sandbox, which is required in most methods of app-domain communication and control.

Defining assemblies as fully-trusted

In my last post, I mentioned that when you create a sandboxed appdomain, you can pass in a list of assembly strongnames that run as full-trust within the appdomain:

// get the Assembly object for the assembly
Assembly assemblyWithApi = ...    

// get the StrongName from the assembly's collection of evidence
StrongName apiStrongName = assemblyWithApi.Evidence.GetHostEvidence<StrongName>();

// create the sandbox
AppDomain sandbox = AppDomain.CreateDomain(
    "Sandbox", null, appDomainSetup, restrictedPerms, apiStrongName);

Any assembly that is loaded into the sandbox with a strong name the same as one in the list of full-trust strong names is unconditionally given full-trust permissions within the sandbox, irregardless of permissions and sandbox setup. This is very powerful! You should only use this for assemblies that you trust as much as the code creating the sandbox.

So now you have a class that you want the sandboxed code to call:

// within assemblyWithApi
public class MyApi
{
    public static void MethodToDoThings() { ... }
}

// within the sandboxed dll
public class UntrustedSandboxedClass
{
    public void DodgyMethod()
    {        
        ...
        MyApi.MethodToDoThings();
        ...
    }
}

However, if you try to do this, you get quite an ugly exception:

MethodAccessException: Attempt by security transparent method 'UntrustedSandboxedClass.DodgyMethod()' to access security critical method 'MyApi.MethodToDoThings()' failed.

Security transparency, which I covered in my first post in the series, has entered the picture. Partially-trusted code runs at the Transparent security level, fully-trusted code runs at the Critical security level, and Transparent code cannot under any circumstances call Critical code.

Security transparency and AllowPartiallyTrustedCallersAttribute

So the solution is easy, right? Make MethodToDoThings SafeCritical, then the transparent code running in the sandbox can call the api:

[SecuritySafeCritical]
public static void MethodToDoThings() { ... }

However, this doesn't solve the problem. When you try again, exactly the same exception is thrown; MethodToDoThings is still running as Critical code. What's going on?

By default, a fully-trusted assembly always runs Critical code, irregardless of any security attributes on its types and methods. This is because it may not have been designed in a secure way when called from transparent code - as we'll see in the next post, it is easy to open a security hole despite all the security protections .NET 4 offers. When exposing an assembly to be called from partially-trusted code, the entire assembly needs a security audit to decide what should be transparent, safe critical, or critical, and close any potential security holes.

This is where AllowPartiallyTrustedCallersAttribute (APTCA) comes in. Without this attribute, fully-trusted assemblies run Critical code, and partially-trusted assemblies run Transparent code. When this attribute is applied to an assembly, it confirms that the assembly has had a full security audit, and it is safe to be called from untrusted code. All code in that assembly runs as Transparent, but SecurityCriticalAttribute and SecuritySafeCriticalAttribute can be applied to individual types and methods to make those run at the Critical or SafeCritical levels, with all the restrictions that entails.

So, to allow the sandboxed assembly to call the full-trust API assembly, simply add APCTA to the API assembly:

[assembly: AllowPartiallyTrustedCallers]

and everything works as you expect. The sandboxed dll can call your API dll, and from there communicate with the rest of the application.

Conclusion

That's the basics of running a full-trust assembly in a sandboxed appdomain, and allowing a sandboxed assembly to access it. The key is AllowPartiallyTrustedCallersAttribute, which is what lets partially-trusted code call a fully-trusted assembly. However, an assembly with APTCA applied to it means that you have run a full security audit of every type and member in the assembly. If you don't, then you could inadvertently open a security hole. I'll be looking at ways this can happen in my next post.

Powershell functions to get an xml node, and get and set an xml element’s value, even when the element does not already exist

deadlydog — Thu, 16 May 2013 17:18:18 GMT

Originally posted on: http://geekswithblogs.net/deadlydog/archive/2013/05/16/powershell-functions-to-get-an-xml-node-and-get-and.aspx

I’m new to working with Xml through PowerShell and was so impressed when I discovered how easy it was to read an xml element’s value. I’m working with reading/writing .nuspec files for working with NuGet. Here’s a sample xml of a .nuspec xml file:

Live Coding During Presentations–Good or Bad?

D'Arcy Lussier — Wed, 15 May 2013 13:37:25 GMT

Originally posted on: http://geekswithblogs.net/dlussier/archive/2013/05/15/152933.aspx

This is a response/continuation of the discussion that Chad McCallum started over on his blog. He wondered what people’s view was on doing live coding within a presentation – for or against.

Where. To. Begin.

There is no right answer to the question. As developers, we like to look at things almost from a bit perspective – 0 or 1, yes or no, true or false. But humans aren’t computers and so to say that yes you should or no you shouldn’t use live coding demos isn’t a worthwhile argument because you’ll never get consensus from the most important group of people for a presenter – your audience.

Consider these two comments:

“I attended this session based on my experience from his other session. Great demos!”

and

“Number of presenters clearly didn't have any developer content prepared and re-used decks of the web and didn't get into any programming. [Speaker]’s was particularly bad.”

Note the last part of the second comment, about a certain speaker’s sessions being bad because they clearly didn’t have any developer content prepared? Well the first comment is about that speaker’s second session. I was in that session and yes, he showed code but didn’t write any. Huh. Two people, same session, different…expectations?

It’s Always About Expectations

I have learned this through much trial and tribulation – the sure way to ensure success in life is to set clear expectations as early as possible. Doing live code? Showing slides of code? Using copy/paste or snippets? Not having any code whatsoever at all? There is no discussion about whether one of these styles is better than the other. I’ve seen all these styles work and work well (I’ve also seen them all bomb just as well also, but I’ll get to that in a second).

So what we’re really talking about is audience expectations.

A few years ago some friends and I went out for Chinese food. One of our friends decided to buy a lobster for the table. He was invited into the kitchen to see it prepared. He came out pale and a little shocked. Why? Well, he was going to see a lobster get cooked – y’know, dropped in boiling water. Isn’t that how you cook a lobster? Not in this restaurant. In this place, you chop it with a huge knife while its still alive and then throw its pieces into a pan and stir fry it. Now had the cook set the expectation that he’d be seeing something else, he may not have gone into the kitchen.

The same thing happens with presentations. Why do people not like a presentation? Sometimes its because it was just a bad presentation. But most of the time, its because expectations weren’t set up front. If you don’t set expectations up front, you let the audience’s expectations become the baseline and you as a presenter have no ability to meet a room full of different expectations. If you set the expectations of what will be seen and the style, then the audience has two options: accept it (stay) or reject it (leave). Either way, you are in control.

So It Doesn’t Matter What Style I use (Live Coding/Snippits/Slides Of Code)?

Like any presentation, you need to use the best medium for communicating your message and address the risks associated.

Want to do live coding? Great! Make sure you set your font and IDE colour scheme, ensure that it’ll work and compile in its finished state (use the Julia Childe method*), test out the available wi-fi to ensure its reliable if your presentation requires it, ensure all updates and required components are installed to your machine/VM ahead of time, ensure all background running processes (virus scanner, auto updates, etc.) are turned off ahead of time, etc. etc.

Want to do slides of codes? Fantastic! Make sure you’re ready to answer questions about how to do things differently/more advanced than what’s on your slides. Make sure you check that your code is readable on your slides, the background/style doesn’t clash, and remember that if you’re using image snapshots of code that you can’t change the font on it so it better be big enough for the guy in the back row to read. Oh, and make sure that your version of PowerPoint or whatever tool you created your presentation with is usable with the version on the presentation computer (if its different than your own).

Presentations are Tools to Communicate Your Idea

I do a talk on how to give technical presentations as well as a presentation workshop, and the one thing I stress is that your PowerPoint, your code, your demos, your whatever isn’t as important as you. You and your knowledge is the reason people are coming to a presentation. You need to pick the tools and techniques that will ensure that you will communicate your message to the audience.

You won’t every please everyone that comes to your presentations. But if you set expectations and give thought to the tools/techniques you’ll employ, you can limit the negative comments and ensure more people leave understanding what you were trying to get across.

Use the NotMapped Attribute with Entity Framework in Partial Classes

Aligned — Wed, 15 May 2013 09:32:32 GMT

Originally posted on: http://geekswithblogs.net/Aligned/archive/2013/05/15/use-the-notmapped-attribute-with-entity-framework-in-partial-classes.aspx

I wanted to add a property to send to my JavaScript class through WebApi, but didn’t want it in the database. I was getting an error telling me I had an invalid name on the EF 5 selection from the database. Adding the NotMapped attribute to the property did the trick. I get it on the JavaScript side as well. I found the answer (again) on StackOverflow.

Example:

public partial class ComponentAttribute
{
    [NotMapped]
    public bool IsModified { get; set; }
}

Tech Learning–Always Start with Hello World

D'Arcy Lussier — Wed, 15 May 2013 07:20:01 GMT

Originally posted on: http://geekswithblogs.net/dlussier/archive/2013/05/15/152931.aspx

Remember Hello World? It was the program that we all started out with at some point. We did something that would make Hello World display somehow. But as we got older and more into our careers as developers, we’ve forgotten Hello World. Instead, we’ve replaced it with Contoso or Pet Store or whatever large, heavy, complex domain we decided would be a much better sandbox to frame learning a new technology with.

I was talking with an attendee at Prairie Dev Con about this last week, and how we can easily get caught up in fulfilling the domain rather than understanding the underlying tech.

Consider these two scenarios, both related to learning ASP.NET MVC with EF code first.

A doctor’s office wants a web site to schedule patient visits. This site will use forms authentication and will leverage MVC and Entity Framework Code First. We’ll use jQuery on the front end for the UI and SQL Server in the back for storing the data. The datamodel looks like this…<insert data model here> and the class diagram looks like this <insert class diagram here>.

Create a single view in an MVC project that uses EF to retrieve a simple value of “Hello World” from a database table and display it on the screen.

Now, if we were to do both of these we’d come to the same result of understanding EF and MVC, but with one difference – the example on the left comes with a huge and heavy domain that we’ve added in for no other reason than to feel like we’re building something of value. But here’s the thing – we’re not. When we’re learning a technology, its about the technology. The details of a pretend scenario do nothing but get in the way of the actual learning.

The value is in us understanding how the technology works so we can apply it to domain contexts later. Would we expect an apprentice carpenter who’s just learning to build a house as their first project to teach them framing? Of course not. So why do we expect it from ourselves as developers?

Unburden yourself from complex domain contexts when you’re starting out with something new. Start with Hello World and take it from there.

Special Tampa WPUG meeting - How I became a Millionaire writing apps!

Nikita Polyakov — Wed, 15 May 2013 04:48:44 GMT

Originally posted on: http://geekswithblogs.net/campuskoder/archive/2013/05/15/152930.aspx

DO NOT MISS THIS 5/21 6PM : Special Tampa WPUG meeting - How I became a Millionaire writing apps!

If you are in Tampa the night of 5/21 you should not have any excuses not to show up to this event. There should not even be any giveaways (especially this awesome) because I am sure this will be a sold out event. Be there (early) or be square.

http://tampawpugmay21.eventbrite.com/

Tampa Windows Phone User Group
Tuesday, May 21, 2013 from 6:00 PM to 8:00 PM (EDT)

Nokia: Your vision is clouded

rodelljr — Tue, 14 May 2013 22:26:24 GMT

Originally posted on: http://geekswithblogs.net/rodelljr/archive/2013/05/15/nokia-your-vision-is-clouded.aspx

In the last week or so we have seen two new phones announced by Nokia: the Lumia 928 and 925. The 925 version looks to be the next evolution in Nokia’s lineup of Lumia devices while the 928 at a glance looks like a variation of the original 920, with maybe some parts of the 925 mixed in. You of course get a great camera experience with the low light PurView system.

While you can view the 925 specs here, I will note that unlike previous Lumia’s (including the 928), the 925 only has 16 GB of storage instead of 32 GB. This wouldn’t be a problem if it had expandable memory, but it doesn’t. That’s right, if you play games that take a lot of storage, or like to save music playlists on your device, this could be an issue. Most likely it won’t for the average user. That is really the only flaw I can see in the hardware itself. It looks stunning and if by some miracle I can get a unit to review, I will defiantly enjoy playing with it. I haven’t really done any phone reviews, but would love the opportunity to begin doing just that. As a developer, its nice to have that ability to play with new hardware and try testing your apps on it.

Now I mentioned flaw in hardware, but this article is more about Nokia itself. While I love their products; (I own a Lumia 800), I completely disagree with their distribution model. While they seem to be trying to be like Samsung and flood the market with handsets, they are doing it as if they are Apple. Please stop. If you really want to compete with Samsung, follow their model that they had done with their Galaxy S3 and S4 and build it for all the carriers. Stop doing this limited distribution. Releasing the 925 to only T-Mobile in the US is a mistake. Its bad enough that the 920 was restricted to AT&T, but to follow that same model again a year later is wasteful. Now before I get any comments, this also applies to Canada and other countries who are only getting partial carrier coverage

That whole exclusive type distribution model has only really worked once, and that was by Apple. Even HTC has learned their lesson somewhat with the HTC One, but that is a whole other argument. The Lumia line is basically THE best that Windows Phone has to offer, and as long as your vision is clouded, it may prove to be the end of Windows Phone. We can’t expect Windows Phone to get any market share increases with this limited distribution model.

This also doesn’t just apply to the 925, but should apply for a few of their other models. The midrange phones like the 820 would defiantly benefit from being on multiple carriers in the US and abroad. You could probably include the lower end tier and include the 620 or 521 in that list. Basically think of it as a small, medium and large model where you have three phones for all carriers. I also wouldn’t stop their. I would include the smaller market carriers like Cricket. Taking this approach will go along way.

With all this said and done, will I buy a 925 or 928? Unfortunately no. I carry a Galaxy S3 as my carrier doesn’t carry Windows Phone yet. And before any one asks, I can’t switch carriers for another year, and few months. I switched from AT&T for reasons I won’t explain here. Other than my minor rants, I really love the Nokia handsets and can’t wait to either review or use their developer borrow program to test my Windows Phone apps.

Using Windows Azure Mobile services to develop Android Applications–Nigeria DevCamp

Malisa L. Ncube — Tue, 14 May 2013 16:25:51 GMT

Originally posted on: http://geekswithblogs.net/malisancube/archive/2013/05/14/using-windows-azure-mobile-services-to-develop-android-applicationsndashnigeria-devcamp.aspx

I have blogged about the Dev camp event we had in Nigeria, where I did a session on using Windows Azure Mobile Services on Android Applications. I run through a recipe, in which I created a shopping list application which was shared between Windows 8, Windows Phone 8 and Android. My task was that of developing an Android application from scratch which would make use of some of the coolest features in WAMS. i.e. Facebook authentication and storage.

The result is a cross platform solution which takes advantage of the unified authentication features of WAMS and share the same data.

Check it out here http://blogs.msdn.com/b/africaapps/archive/2013/05/14/using-windows-azure-mobile-services-to-develop-android-applications-nigeria-devcamp.aspx

Technorati Tags: Windows Azure Mobile Services,Android,Nigeria DevCamp

Which kind of API service provider are you?

Michael Stephenson — Sun, 12 May 2013 14:50:13 GMT

Originally posted on: http://geekswithblogs.net/michaelstephenson/archive/2013/05/12/152924.aspx

Ive been pondering this one for a while and been meaning to put something out there about it.

During some of the architecture discussions I've had with colleagues some of the examples that are often put out there in terms of a public API are google and twitter. They are often described as things like "internet scale", "open standards based", "easy to use" and a whole bunch of other good things.

One of the things which I always feel that is a little bit ignored is that these companies are very different in terms of their market forces to some of the companies I have worked with in the past. If you are twitter for example its very easy to say this is my API and you will consume it using my rules. If twitter want to change their API or retire an older version of it then the client either upgrades or stops working.

If you are a service provider like one of these guys then you have all of the power and its really easy to produce an API and make everyone do it the way that suits you. I would describe this as a "provider driven API".

A lot of the companies I have worked with are different. They work with partners and customers who have a lot of power and the balance of power in their interactions and relationship is either finely balanced or in favour of the service consumer. In these cases we often end up with different scenarios where you may have an API, but you also end up having to build adapters or gateways to your API so that different consumers can work with it. To give an example of this we planned to produced an API but we found that one of our biggest consumers would account for 70% of its usage and they could only support a SOAP web service API with basic security where as another consumer of it would be REST based. In this scenario you may produce your "preferred API" and then produce adapters to convert different consumers to this API. The power balance means that you cant necessarily influence the consumer to change the way they would talk to your API because they would use a competitor who would make it easy and cheaper for them. Thats just the nature of business. In these cases I find that its important to try to use good integration practices and to keep the adapters as simple as possible and to reuse the core services in your preferred API. This will keep your total cost of ownership lower. I also often suggest to the business that they look for ways to incentivise partners to use our preferred API as this brings our costs down so we should look to share that saving for the longer term benefits it would bring. We know this isnt always possible though. In this case I would describe your API strategy as being a "consumer driven API".

I think its important to recognise that there are differences between these approaches, and that while google, facebook, twitter or Windows Azures's API might be excellent and very easy to use, they may be in a different business paradigm to your company and while there are definitely good techniques and practices to aim for they may not be the best comparison to your own situation.

This subject is not something I have really researched too much online to see if there is much in the way of discussion on this subject but im bored sitting waiting for a flight in miami airport and thought id get this one off my chest!

Id love to hear what other people think, is this a valid problem space that lots of us face, and what kind of challenges do you have in your domain. Also do you think the terms "Consumer driven API" and "Provider driven API" are right. Ive come across the "Client driven contracts" pattern but I feel that this is only part of the challenge.

From my own experiences the one good practice I would recommend in the "consumer driven API" space is that you should try to avoid developing whole new API's for all of the different consumers. Create your main API and then develop gateways to it. The gateways should be as simple as possible and do little more than mapping and composing the data from the main API into these newer formats and dealing with the differences in things like security. Dont go replicating all of the logic if possible.

Integration between Resource and Message Based Architectures

Michael Stephenson — Sat, 11 May 2013 22:36:52 GMT

Originally posted on: http://geekswithblogs.net/michaelstephenson/archive/2013/05/11/152923.aspx

I've been thinking for a while about the way in which resource based architectures and messaging based architectures interact with each other. Resource based architectures have increased in popularity a lot over recent years and I have read a number of articles in the community but I've always felt there was a gap and lack of discussion and guidance over the integration between resource based architectures and message based architectures. I have had a couple of chats with colleagues who's opinion I value very highly and they felt the same about this subject as I do so I thought I'd write this article and see where we end up at the end of my brain bump on this subject and hopefully prompt some discussion on this subject.

So let's start with the typical example of a RESTful service. In most of the examples you see in articles we have an application that contains some resources and then a REST API is developed to provide access to these resources using all of the common techniques used when putting together a REST API. At this point I am completely happy. REST is a great way to provide an API for your applications resources. "REST is good for producing an interoperable API".

If you're developing applications in a client/server style architecture where you may have a website which calls this REST API then you probably never need to worry anymore about this problem, however where I start to struggle with things is in the real world of integration. When we start to develop real solutions which are more than just a website calling my API and we have things like aggregated services or complex business processes or the many other integration scenarios to think about. Let's take the example of a service which wants to aggregate two or more services together in a publish/subscribe style pattern. In the below diagram I've shown how you have two backend services exposing REST API's and a client who wants to make a call with a RESTful GET.

There are a few conceptual challenges here, firstly when you are talking about resources, the resource that the customer is thinking about isn't necessarily the same as the resources that each partner is thinking about. The message broker could be aggregating the two partners resources and producing some new kind of resource. Other challenges may include the addressability of the resource. Would the address send by the client make sense when it was sent to the partners. Probably not!

In the above example it could be possible to write custom code to deliver this aggregator service but what about a more complex problem? Take the diagram below.

In this example we have a more complex example where there are multiple customers and more partners. Now like in most real world scenarios you have more than one protocol going on. Now you're moving away from custom code, it would be a good to consider some of the common messaging solutions such as BizTalk, NServiceBus, RabbitMQ, or the many other vendors who are available.

The key thing when you start working with an integration broker is that they work based on a message based architecture and a key underlying principle of that is a message which is self-describing. A message based architecture has the benefit that because everything is contained within the message it should be possible to route then transform the message and send it over any protocol. Hopefully this begins to show how important the translation from a REST à Messaging and Messaging à REST can be.

In the new version of BizTalk 2013 they have introduced a new REST adapter and the BizTalk product team have attempted to address this challenge about how to convert things like a URI with the GET verb to a message which can then be self-describing and used in a messaging system. The REST adapters then let you connect applications to your integration broker and provide whatever mapping and routing your scenario may need.

In summary I think I'm saying the following:

REST is an easy to use and interoperable way to develop application interfaces
There is a difference between an application interface and Enterprise Application Integration
Messaging systems use messaging architectures and are used to develop real world EAI and ESB solutions
BizTalk has some cool new REST adapters which let you convert between these architecture styles
We should be able to build even more powerful integration solutions than we have in previous versions

As I mentioned at the start of the article, I haven't seen much discussion in the community about this translation from Resource-based to Message-based approaches. If you know of any good articles or have any opinions around good practices or techniques in this area I'd be very interested to read them.

As a side note if anyone is interested in practical examples of using the BizTalk REST adapter check the below articles from fellow Integration MVP's Richard Seroter and Steef-Jan Wiggers:

I Finished My First 5k Run

Brian T. Jackett — Sat, 11 May 2013 04:00:57 GMT

Originally posted on: http://geekswithblogs.net/bjackett/archive/2013/05/11/i-finished-my-first-5k-run.aspx

This post is a bit more personal than most. Two weekends ago my fiancé and I (along with two friends) completed our first 5k run. To many people this may not sound like a big deal, but to me it was a very significant event. Below is the story why.

History

When I was a junior in high school I started to have pain in my right hip when I ran or was on my feet for extended periods of time. At the time I was in track doing shot put and discus which are very demanding on your leg joints and muscles. When the pain didn’t go away for days and was uncomfortable just walking or sitting I decided to get it looked at by a doctor. The doctor took a number of X-rays and performed various mobility tests. Upon reviewing the X-rays it was clear what the problem was. My right hip joint was not properly formed. Specifically the socket portion of the “ball and socket” connection was under-formed and thus the ball portion slipped around causing inflammation. To the best of my memory he called it hip dysplasia.

This is a somewhat common issue with newborn babies where the hip joints aren’t properly aligned or the ball remains out of the socket. In most cases some quick tests and manual adjustments pop the hip back into place. Apparently this wasn’t the case for me. At the time the doctor told me that I would need a hip replacement by the time I was 40-45, but to continue exercising and avoid any activities that caused pain. For me that meant no more running or climbing large amounts of stairs.

Run Training

Fast forward to a few years ago, I read an article discussing different running styles. One that stood out to me was toe running. Instead of landing on the heel (and absorbing all the shock with your bones) you focus on running on the ball or toes of your feet (and thus absorb the shock in your muscles). For a year I started to walk on the balls of my feet rather than the traditional heel to toe stride. I noticed a decrease in my hip pain as well as increased calf muscle strength. I then tried running on my toes and found it to be much easier than expected.

I joined my fiancé's gym at the beginning of this year intending to lift weights and do some minimal cardio. I started out with running half a mile and worked my way up to 2 miles. In Feb I found out the gym was holding a 5k run / walk for charity. I thought this would be a great opportunity to see if I could run the full race and not have hip pain. Sarah and I trained over the next few months increasing our distance and lowering our pace per mile.

The Race

On April 27th, 2013 Sarah and I ran our 5K. I finished with a time of 32:59 (just under 33 mins :) ) and Sarah finished at 34:56. I’m very proud of both of our times and for completing. The icing on the cake was that I had very minimal hip pain after the race (and even the days following the race). The below picture was taken just before our race.

Conclusion

When my doctor told me that I wouldn’t be able to do many things that I enjoyed when I was younger it was discouraging. Thankfully through changing the way that I walk, run, and get around I’ve found ways to cope with my hip issue. I may still have to have an early hip replacement, but the fact that I could complete a 5K (with Sarah’s help and motivation) was a big boost to my confidence that I won’t let that keep me down. Now to find the next race and continue on!

-Frog Out

Tip Of the Day - Modal Popup and ValidationSummary Controls: Fixing Object Expected Error

Vincent Maverick Durano — Fri, 10 May 2013 06:01:43 GMT

Originally posted on: http://geekswithblogs.net/dotNETvinz/archive/2013/05/10/tip-of-the-day---modal-popup-and-validationsummary-controls.aspx

If you are working with ASP.NET AJAX controls and encounter "Object Expected" error when using ValidationSummary and ModalPopup. The quick fix for this is to put your ModalPopup declaration at the top before any ValidationSummary controls in your page.

That's it! I hope someone find this post useful!

Chrome Responsive Inspector extension

ihaynes — Fri, 10 May 2013 01:42:01 GMT

Originally posted on: http://geekswithblogs.net/ihaynes/archive/2013/05/09/chrome-responsive-inspector-extension.aspx

Adobe developers Piotr Walczyszyzn and Filip Lysyzyn have released a beta of their Responsive Inspector extension for Chrome.

This cool tool allows you to view the media queries on a responsive web page and see them in action as you resize the page. It shows the media query currently applied, the name of the stylesheet it's on, and lets you view the stylsheet. Plus it allows pixel-perfect resizing and allows you to take screen shots.

There's demo video on Piotrs blog. http://outof.me/responsive-inspector-beta-released/

PowerShell function to create a password protected zip file

deadlydog — Thu, 09 May 2013 17:45:01 GMT

Originally posted on: http://geekswithblogs.net/deadlydog/archive/2013/05/09/powershell-function-to-create-a-password-protected-zip-file.aspx

There are a few different ways to create zip files in powershell, but not many that allow you to create one that is password protected. I found this post that shows how to do it using 7zip, so I thought I would share my modified solution.

Here is the function I wrote that uses 7zip to perform the zip, and 7zip supports using a password to zip the files.

ADMT – How to migrate users and computers from domain to the other

Waclaw Chrabaszcz — Thu, 09 May 2013 08:57:17 GMT

Originally posted on: http://geekswithblogs.net/Wchrabaszcz/archive/2013/05/09/admt--how-to-migrate-users-and-computers-from-domain.aspx

As a first step you should prepare SQL server within destination domain, and install ADMT on server within destination domain. I am going to use Domain Controller for this role, what might not be a best practice. In production env DC should remain untouched. SQL 2005 Express SP3 is recommended for this build.
Then we have to create DNS conditional forwarding to source domain
Choose what you want to migrate
Select Source and destination domain and DC
Select users you are going to migrate
Select target OU
Migrate old passwords
And what is the most important migrate SID history
You can migrate related groups as well
Or skip some account properties
Conflict handling

Exchange 2010: Generating test data for your lab environment

marc dekeyser — Thu, 09 May 2013 07:04:19 GMT

Originally posted on: http://geekswithblogs.net/marcde/archive/2013/05/09/exchange-2010-generating-test-data-for-your-lab-environment.aspx

As an addition on populating this post gives an easy way to create test data in your lab:

http://www.mikepfeiffer.net/2010/04/generating-test-email-data-for-exchange-labs-with-powershell/

Exchange 2010: Populating your test environment with users

marc dekeyser — Thu, 09 May 2013 07:03:12 GMT

Originally posted on: http://geekswithblogs.net/marcde/archive/2013/05/09/exchange-2010-populating-your-test-environment-with-users.aspx

I came across this article and it is pretty easy and decent!

http://www.mikepfeiffer.net/2010/03/populating-exchange-labs-with-mailboxes-using-powershell/

PowerShell Format Idiosyncrasy

PointsToShare — Thu, 09 May 2013 05:40:35 GMT

Originally posted on: http://geekswithblogs.net/PointsToShare/archive/2013/05/09/powershell-format-idiosyncrasy.aspx

Here is a piece of code I tested for the conversion of the numbers 0 thru 99 into 20 strings of exactly 2 digits. The first is 04, the next 09, then 14,19,24,29, etc. all the way to 94, 99.

The code: "{0:D2}" -f $d formats each number to exactly 2 digits.

The $i used in the “for” loop is interpreted by PowerShell – it automatically assigns it to a float. So when dividing by 5, we get fractions. I needed it to be whole numbers, hence the [math]::floor($i/5).

cls

for ($i = 0; $i -lt 100; $i++)
{
    $n = [math]::floor($i/5)
    $d = $n * 5 + 4
    "{0:D2}" -f $d
}

I erroneously assumed that the result $d will be formattable ("{0:D2}" -f $i renders the desired result), alas this results in the following error:

Error formatting a string: Format specifier was invalid..

At E:\HA\testformat.ps1:6 char:2

+ "{0:D2}" -f $d

+ ~~~~~~~~~~~~~~

+ CategoryInfo : InvalidOperation: ({0:D2}:String) [], RuntimeException

+ FullyQualifiedErrorId : FormatError

I tried all sorts of things, but the error was persistent, then I tried coercing – the PowerShell term for casting. I used [float] and [decimal] to no avail, but my 3^rd (and obviously last*) attempt was [int] and it worked.

cls

for ($i = 0; $i -lt 100; $i++)

{

$n = [math]::floor($i/5)

[int]$d = $n * 5 + 4

"{0:D2}" -f $d

}

Generated the desired results.

* Why is it that we always find what we look for in the VERY LAST place we looked?

That’s all Folks

BizTalk Server 2010 - Add New Item Schema Missing in Visual Studio

Stuart Brierley — Thu, 09 May 2013 02:45:26 GMT

Originally posted on: http://geekswithblogs.net/StuartBrierley/archive/2013/05/09/152902.aspx

I recently encountered an issue when developing a BizTalk Server 2010 solution using Visual Studio 2010. When selecting to add a new item to a project, the schema item was missing in the Visual Studio dialog box:

I fixed this issue by repairing the Visual Studio 2010 installation as follows:

Open Control Panel and select Programs and Features
Find the listing for the edition of Visual Studio you are having a problem with and select it.
Select to Uninstall/Change from the top of the program listing.
In the Visual Studio Setup Wizard, select Repair/Reinstall and then select next.

You may be prompted to restart you computer to complete the installation.

Follow any instructions until the Wizard completes and then select finish. In my case I had an error related to SQL Server Compact Edition, but this is not installed when developing for BizTalk and is an optional component:

Once the Repair process was completed the option to add a BizTalk schema in Visual Studio was once again available:

Nokia Developer Ambassador Bill Reiss and Big Southeast Nokia Ambassador Giveaway

Nikita Polyakov — Thu, 09 May 2013 02:32:16 GMT

Originally posted on: http://geekswithblogs.net/campuskoder/archive/2013/05/09/152909.aspx

I am happy to say that one of my good friends, not only to me but to our entire developer community, is Bill Reiss. Clearly I am not the only one that noticed and Nokia has awarded him with Nokia Developer Ambassador title for Southeast US region. This will empower Bill to help Developers ever more. Join me in congratulating Bill in his achievement.

If you are in Alabama, North Carolina, South Carolina, Georgia, or Florida there is a great giveaway for writing a Windows Phone app waiting for you - more details here: http://www.billreiss.com/big-southeast-nokia-ambassador-giveaway/

New Syncfusion 'Succinctly iOS' e-Book

ihaynes — Thu, 09 May 2013 05:13:59 GMT

Originally posted on: http://geekswithblogs.net/ihaynes/archive/2013/05/08/new-syncfusion-succinctly-ios-ebook.aspx

I mentioned a while back the excellent 'Succinctly' series of free eBooks by Syncfusion. Well there's a new one, 'iOS Succinctly' written as a companion to 'Objectice-C Succinctly'. Both excellent resources for a fast way to get started with iOS development.

Details and download from http://www.syncfusion.com/resources/techportal/ebooks/ios

Windows 8.1 Start Button - Again

ihaynes — Thu, 09 May 2013 02:21:45 GMT

Originally posted on: http://geekswithblogs.net/ihaynes/archive/2013/05/08/windows-8.1-start-button---again.aspx

To quote from an article on the UK PC Pro site:

Julie Larson-Green, corporate vice-president for Windows, revealed that Windows Blue will arrive as a "public preview" at Microsoft's Build conference, which starts 26 June. While Build is targeted at developers, the public preview will be available to anyone with Windows 8, according to ZDNet.

She also revealed Microsoft was having "meaningful discussions" about whether to bring back the Start button, but said the company remained fully behind the Start screen with live tiles.

"The Start menu was never built for a lot of applications," Larson-Green said, according to CNet. "The Start menu is not the be-all end-all. But a button might be useful for some people to have on the screen."

The full article at http://www.pcpro.co.uk/news/380713/windows-blue-8-1-release-date-screenshots-features

So, the Start Button was never built for a lot of applications!

Well, if the MS Windows Team haven't noticed, it works far better for a lot of applications that the 'Modern' tiled start screen.

Increasing the number of lists a Content Query Webpart can enumerate through

simonh — Wed, 08 May 2013 07:01:05 GMT

Originally posted on: http://geekswithblogs.net/simonh/archive/2013/05/08/increasing-the-number-of-lists-a-content-query-webpart-can.aspx

Issue:

By default the Content Query WebPart can only enumerate through 1000 lists/libraries/etc, this is for performance reasons, if this amount is increased too far, then the SQL server can experience issues responding.

Solution:

To increase the number, the CQWP needs to be edited, as usual with customising webparts as well as pretty much any OOB features in SharePoint, it is best to take a copy of the existing webpart and create a new one.

To do this:
1.    Add the CQWP to a webpart page and from the small dropdown menu on the webpart; choose Export, save it somewhere on either your local disk or a fileshare,
2.    Open the .webpart file in an XML editor and search for:
   <property name="ListsOverride" type="string"/>
3.    Change to:
           <property name="ListsOverride" type="string">
           <![CDATA[<Lists Servertemplate="XXX" MaxListLimit="YYYY"></Lists>]]>
           </property>

Where XXX is the list template number (see below) and YYYY is the maximum number of lists to go through. This maximum should be increased only to the point at which the webpart functions as too large a number can have a negative impact on performance.

4.    Save the new webpart with a meaningful such as Content Query High List Numbers.webpart
5.    Go to the page where you want to add the new webpart, click Editing Tools > Insert > Web Part. Click Upload a Web Part beneath the Categories, navigate to and select your new webpart.
6.    Click Add, select the correct Content and item type as you would with any Content Query WebPart. The rest of the options should be select as usual including Filtering and Grouping.

Ideally attempts should be made to reduce the number of lists/libraries that this webpart has to enumerate through, increasing this limit should really be a temporary fix rather than a long term solution, the more lists/libraries the webpart has to go through the more work the SQL server has to perform.

SharePoint 2010 List Type Codes:

100 Generic list
101 Document library
102 Survey
103 Links list
104 Announcements list
105 Contacts list
106 Events list
107 Tasks list
108 Discussion board
109 Picture library
110 Data sources
111 Site template gallery
112 User Information list
113 Web Part gallery
114 List template gallery
115 XML Form library
116 Master pages gallery
117 No-Code Workflows
118 Custom Workflow Process
119 Wiki Page library
120 Custom grid for a list
130 Data Connection library
140 Workflow History
150 Gantt Tasks list
200 Meeting Series list
201 Meeting Agenda list
202 Meeting Attendees list
204 Meeting Decisions list
207 Meeting Objectives list
210 Meeting text box
211 Meeting Things To Bring list
212 Meeting Workspace Pages list
300 Portal Sites list
301 Blog Posts list
302 Blog Comments list
303 Blog Categories list
850 Page Library
1100 Issue tracking
1200 Administrator tasks list
2002 Personal document library
2003 Private document library

Blogging Withdrawal

Tim Murphy — Wed, 08 May 2013 05:44:50 GMT

Originally posted on: http://geekswithblogs.net/tmurphy/archive/2013/05/08/blogging-withdrawal.aspx

Did you know that blogging is a drug and that if you go too long without posting something you actually go into withdrawal? It turns out to be the case, at least for me. Whatever the excuse may be, when I go for a long stretch without a significant topic posted I feel anxious, almost as if I had abandoned my child.

Lately the IT consulting business has been so busy it just doesn’t leave much time to blog. Working a full day at one client and then doing support work for others in the evening is seems to be the norm lately. I figured it was time to at least put together an off topic post like this to break up the routine.

Blogging for me is both an writing outlet while also allowing me to document my work and give others a place to learn from my experiences. Stay tuned here while I try to find some cracks of time to post some content of value.

del.icio.us Tags: blogging

jQuery 1.9.1+ Ajax Post is Failing even though it has a 200 Status

Aligned — Wed, 08 May 2013 02:41:27 GMT

Originally posted on: http://geekswithblogs.net/Aligned/archive/2013/05/08/jquery-1.9.1-ajax-post-is-failing-even-though-itrsquos-a.aspx

I’m using my DataService and AjaxService for JavaScript and upgraded to jQuery 1.9.1. One of my post methods, which was working before, started hitting the deferred fail, instead of the deferred’s done, even though the status code was 200. This method is not returning any JSON to the caller. The 1.9 upgrade guide states “Prior to 1.9, an ajax call that expected a return data type of JSON or JSONP would consider a return value of an empty string to be a success case, but return a null to the success handler or promise. As of 1.9, an empty string returned for JSON data is considered to be malformed JSON (because it is); this will now throw an error. Use the error handler to catch such cases.”. This question on the forums lead me to the upgrade guide and “Identifier” says to return a 204 instead. I change my WebApi method to return a 204 and now it’s working again.

I now am using return this.Request.CreateResponse(HttpStatusCode.NoContent);

Here’s the method:

[System.Web.Mvc.HttpPost]
public HttpResponseMessage UpdateAlias(JObject jsonData)
{
    // http://www.asp.net/web-api/overview/web-api-routing-and-actions/exception-handling
    // http://www.west-wind.com/weblog/posts/2012/May/08/Passing-multiple-POST-parameters-to-Web-API-Controller-Methods
    int assetId = 0;
    int userId = 0;
    string alias = string.Empty;
    try
    {
        assetId = jsonData["AssetId"].Value<int>();
        userId = jsonData["UserId"].Value<int>();
        alias = jsonData["Alias"].Value<string>();
        if (assetId == 0)
        {
            throw new ArgumentException("Asset Id is required.");
        }

        if (userId == 0)
        {
            throw new ArgumentException("User Id is required.");
        }

        if (string.IsNullOrWhiteSpace(alias))
        {
            throw new ArgumentException("Alias is required and cannot be empty.");
        }
        
        // more code here…

        // notice the noContent
        return this.Request.CreateResponse(HttpStatusCode.NoContent);
    }
    catch (Exception ex)
    {
        this._logger.Warn(string.Format("Error in UpdateAlias assetId:{0}, userId:{1}, new alias: {2}", assetId, userId, alias), ex);
        throw new HttpResponseException(new HttpResponseMessage
                                        {
                                            StatusCode = HttpStatusCode.InternalServerError,
                                            Content = new StringContent("Error!")
                                        });
    }
}

Semantic Versioning

Bob Hardister — Wed, 08 May 2013 00:24:08 GMT

Originally posted on: http://geekswithblogs.net/BobHardister/archive/2013/05/08/semantic-versioning.aspx

In a discussion about software product versioning, the post on Semantic Versioning came up. I found the essay to reflect commonly recognized best practices. However, the value of the essay is in the concise and rigorous rules for incrementing version numbers.

.NET Security Part 2

simonc — Tue, 07 May 2013 09:15:39 GMT

Originally posted on: http://geekswithblogs.net/simonc/archive/2013/05/07/.net-security-part-2.aspx

So, how do you create partial-trust appdomains? Where do you come across them?

There are two main situations in which your assembly runs as partially-trusted using the Microsoft .NET stack:

Creating a CLR assembly in SQL Server with anything other than the UNSAFE permission set. The permissions available in each permission set are given here.
Loading an assembly in ASP.NET in any trust level other than Full. Information on ASP.NET trust levels can be found here. You can configure the specific permissions available to assemblies using ASP.NET policy files.

Alternatively, you can create your own partially-trusted appdomain in code and directly control the permissions and the full-trust API available to the assemblies you load into the appdomain. This is the scenario I'll be concentrating on in this post.

Creating a partially-trusted appdomain

There is a single overload of AppDomain.CreateDomain that allows you to specify the permissions granted to assemblies in that appdomain - this one. This is the only call that allows you to specify a PermissionSet for the domain. All the other calls simply use the permissions of the calling code. If the permissions are restricted, then the resulting appdomain is referred to as a sandboxed domain.

There are three things you need to create a sandboxed domain:

The specific permissions granted to all assemblies in the domain.
The application base (aka working directory) of the domain.
The list of assemblies that have full-trust if they are loaded into the sandboxed domain.

The third item is what allows us to have a fully-trusted API that is callable by partially-trusted code. I'll be looking at the details of this in a later post.

Granting permissions to the appdomain

Firstly, the permissions granted to the appdomain. This is encapsulated in a PermissionSet object, initialized either with no permissions or full-trust permissions. For sandboxed appdomains, the PermissionSet is initialized with no permissions, then you add permissions you want assemblies loaded into that appdomain to have by default:

PermissionSet restrictedPerms = new PermissionSet(PermissionState.None);

// all assemblies need Execution permission to run at all
restrictedPerms.AddPermission(
    new SecurityPermission(SecurityPermissionFlag.Execution));

// grant general read access to C:\config.xml
restrictedPerms.AddPermission(
    new FileIOPermission(FileIOPermissionAccess.Read, @"C:\config.xml"));

// grant permission to perform DNS lookups
restrictedPerms.AddPermission(
    new DnsPermission(PermissionState.Unrestricted));

It's important to point out that the permissions granted to an appdomain, and so to all assemblies loaded into that appdomain, are usable without needing to go through any SafeCritical code (see my last post if you're unsure what SafeCritical code is). That is, partially-trusted code loaded into an appdomain with the above permissions (and so running under the Transparent security level) is able to create and manipulate a FileStream object to read from C:\config.xml directly. It is only for operations requiring permissions that are not granted to the appdomain that partially-trusted code is required to call a SafeCritical method that then asserts the missing permissions and performs the operation safely on behalf of the partially-trusted code.

The application base of the domain

This is simply set as a property on an AppDomainSetup object, and is used as the default directory assemblies are loaded from:

AppDomainSetup appDomainSetup = new AppDomainSetup {
    ApplicationBase = @"C:\temp\sandbox",
};

If you've read the documentation around sandboxed appdomains, you'll notice that it mentions a security hole if this parameter is set correctly. I'll be looking at this, and other pitfalls, that will break the sandbox when using sandboxed appdomains, in a later post.

Full-trust assemblies in the appdomain

Finally, we need the strong names of the assemblies that, when loaded into the appdomain, will be run as full-trust, irregardless of the permissions specified on the appdomain. These assemblies will contain methods and classes decorated with SafeCritical and Critical attributes. I'll be covering the details of creating full-trust APIs for partial-trust appdomains in a later post. This is how you get the strongnames of an assembly to be executed as full-trust in the sandbox:

// get the Assembly object for the assembly
Assembly assemblyWithApi = ...    

// get the StrongName from the assembly's collection of evidence
StrongName apiStrongName = assemblyWithApi.Evidence.GetHostEvidence<StrongName>();

Creating the sandboxed appdomain

So, putting these three together, you create the appdomain like so:

AppDomain sandbox = AppDomain.CreateDomain(
    "Sandbox", null, appDomainSetup, restrictedPerms, apiStrongName);

You can then load and execute assemblies in this appdomain like any other. For example, to load an assembly into the appdomain and get an instance of the Sandboxed.Entrypoint class, implementing IEntrypoint, you do this:

IEntrypoint o = (IEntrypoint)sandbox.CreateInstanceFromAndUnwrap(
    "C:\temp\sandbox\SandboxedAssembly.dll", "Sandboxed.Entrypoint");

// call method the Execute method on this object within the sandbox
o.Execute();

The second parameter to CreateDomain is for security evidence used in the appdomain. This was a feature of the .NET 2 security model, and has been (mostly) obsoleted in the .NET 4 model. Unless the evidence is needed elsewhere (eg. isolated storage), you can pass in null for this parameter.

Conclusion

That's the basics of sandboxed appdomains. The most important object is the PermissionSet that defines the permissions available to assemblies running in the appdomain; it is this object that defines the appdomain as full or partial-trust. The appdomain also needs a default directory used for assembly lookups as the ApplicationBase parameter, and you can specify an optional list of the strongnames of assemblies that will be given full-trust permissions if they are loaded into the sandboxed appdomain.

Next time, I'll be looking closer at full-trust assemblies running in a sandboxed appdomain, and what you need to do to make an API available to partial-trust code.

BREAKING CHANGE on GeeksWithBlogs for Custom Domains - IP Address Change

Staff of Geeks — Tue, 07 May 2013 07:09:37 GMT

Originally posted on: http://geekswithblogs.net/Administrator/archive/2013/05/07/breaking-change-on-geekswithblogs-for-custom-domains---ip-address.aspx

UPDATE 05/08/2013 - IP address of 208.67.195.49 is also affected.

Hi Bloggers,

I’m posting this urgent message because we've decided to move the hosting of GeeksWithBlogs to Azure. This means that any custom domain names that are currently pointing to the old IP address of 208.67.195.100 or to 208.67.195.49 will break around June 1st when we do the switchover.

If you have a custom domain that points to GeeksWithBlogs, please change the DNS "A record" to point to the new Azure IP address of 168.62.30.182 as soon as possible. The GWB site is already live at this new IP address so you should continue to see your usual blog after you've made the switch. Please email us immediately if you experience any problems.

Thanks for your patience while we finish this important upgrade!

Ben Barreth – GWB Software Dev & Community Builder

Handling IE 9 & 10's and Chrome’s clear button with Knockout binding

Aligned — Tue, 07 May 2013 04:02:18 GMT

Originally posted on: http://geekswithblogs.net/Aligned/archive/2013/05/07/handling-ie-9-amp-10s-and-chromersquos-clear-button-with.aspx

Our tester found a bug with my search box. The search box filters a grid using observables. IE 9 and 10, and Crome adds in a x clear option, this wasn’t changing the observable, so the filter wasn’t getting cleared out.

(image from SO question)

<input id="searchTextBox" class="searchTextBox" type="text" maxlength="25"
       title="Search" placeholder="Search"
       data-bind="value: GridVm.FilterText,
       valueUpdate: 'afterkeydown',
       disable: GridVm.Data().length == 0" />

I posted my question and ended up answering my own question on StackOverflow and thought I would share it here as well.

My solution involves using the http://knockoutjs.com/documentation/event-binding.html and the input event.

<input type="search" id="input1"

  data-bind="value: textForBox,

    valueUpdate: 'afterkeydown',
    event: { input: cleared }" />

var vm = {
    textForBox: ko.observable(),
    cleared: function (data, event) {
        if (event.currentTarget.value === '') {
           this.textForBox('');
        }
    }
};
ko.applyBindings(vm);

See my jsFiddle showing the solution.

Hope it helps!

Webinar: Async Programming in C#

Joe Mayo — Tue, 07 May 2013 03:40:52 GMT

Originally posted on: http://geekswithblogs.net/WinAZ/archive/2013/05/07/webinar-async-programming-in-c.aspx

Tomorrow, I’m doing a live webinar with Learn Now on Async Programming in C#. More details here: http://bit.ly/17JT792.

@JoeMayo