Thursday, February 09, 2006

Why on earth do I find myself reading whitepapers on the NASA or ACM websites? (read more ...)

[A DevLife post]



Don't Forget: www.acehaid.org
Thursday, February 09, 2006 9:57:38 AM (Eastern Standard Time, UTC-05:00)  #     |  Comments [0]  | 
 Wednesday, February 08, 2006

Next Mondays VTdotNET meeting marks our 4th anniversary. I think after 4 years, I'm allowed to say that I'm very proud of this! VTdotNEt has created a real community out of the many .NET developers in Northwest Vermont. That was my ultimate goal. We also have a bevy of highly skilled .NET developers in the area, many of whom are already deploying .NET 2.0 applications. We have brought amazing speakers here month after month and definitely put the .NET developer community on the map.

I think everyone in the whole group should give themselves a pat on the back.

Mondays' meeting is the part 2 of the VS/SQL 2005 launch, and a joint meeting with the VTSQL.org group. Since INETA and PASS were both creating these user group events, we got to do two between our two groups. So we have another 5 sets of VS2005 Pro/SQL Server 2005 Standard licenses to raffle off, certification test vouchers and some other swag. Laura Blood and Roman Rehak will be presenting. Rumor has it that Roman is going to be the demo god for the night.

Competitive Computing, who is hosting the meeting, is also providing the group with pizza and soda for the evening.

And, we will, of course, have birthday cake.

Thanks to everyone who has helped make this group be a great success!! That includes not only our members, but INETA, Thom Robbins, Joe Stagner, Russ Fustino (who encouraged me to start the group) and the many sponsors who have helped us with pizza, books and other awesome swag over the years.

Here's to many more!



Don't Forget: www.acehaid.org
Wednesday, February 08, 2006 2:51:11 PM (Eastern Standard Time, UTC-05:00)  #     |  Comments [0]  | 
 Tuesday, February 07, 2006

I decided this needed it's very own post as it is buried in another one.

I was way too eager to finally get .NET 2.0 onto my web server and missed a step and did not recognize the red flags going up trying to tell me that I missed this step.

If you are putting .NET 2.0 onto a web server already running 1.1, you need to create a separate application pool and set the app pool for .NET 1.1 apps to one of them and .NET 2.0 apps to the other one.

Most likely, if you are not creating any new 1.1 apps, you should attach the 1.1 apps to the new app pool and if you use a default app pool, let the .NET 2.0 apps own that.

Each application pool owns a different process. So I had the 1.1 and 2.0 apps running in the same process and they were really tangling with each other. I was getting Server Unavailable errors and even had a bizarre effect on a web service*.

In case you haven't dealt explicity with application pools yet, that is a separate section in IIS. You have Application Pools Websites and Web Service Extensions. You can easily create a new application pool.

Then, in the properties of each web site you want to change, the application pool option is a drop down at the bottom of the first tab (Directory).

*That was a doozy. It was a 1.1 service that returns a DataSet comprised of 8 tables. Before returning the ds, I use XCeed stream compression to compress the stream. On the client end, I decompress and then read the stream into a new dataset. Suddenly the resulting dataset had taken two columns from the first table and created new tables out of each one. Once I figured out what was happening, I had no clue how to deal with it other than remove the compression and just return the datatable. In the end, the problem disappeared when I sorted out the App Pools!!



Don't Forget: www.acehaid.org
Tuesday, February 07, 2006 9:08:08 AM (Eastern Standard Time, UTC-05:00)  #     |  Comments [0]  | 
 Monday, February 06, 2006

I had an email today from someone asking this question. They have a web service and a client app that use WSE2 to encrypt, sign and otherwise secure their data.

However, they were able to open up the asmx file, the operation and look at raw xml data in a web browser over the web. No authentication, no encryption, no signing. I could see it, too!

What a nightmare after all of the work to secure this data.

The reason for this problem was another case of debugging tools getting deployed to the production web server. Something I tend to rant about occasionally.

In order to browse from their development machine to the web service on a remote web server, they had added

<webServices>
 <protocols>
   <add name="HttpGet" />
   <add name="HttpPost" />
 </protocols>
</webServices>

and left them in the web.config when it was deployed to the server.

I was able to guess this pretty quickly since I once learned this the hard way, too. Sadly most of our best lessons are the ones that leave bruises. :-)

For some more web.config tricks to hide your web service from public view as well as the wsdl, see this msdn doc on configuring web services for deployment.

Don't Forget: www.acehaid.org
WSE
Monday, February 06, 2006 7:37:18 PM (Eastern Standard Time, UTC-05:00)  #     |  Comments [0]  | 

What do you think is going to be the most likely need for ClickOnce?

Deploying apps to anyone in the world? Not for me, I write custom apps for my client.

Deploying apps on the intranet? Sure, but we have had a very simple hack for that for a long time.

C'mon, think smart client....

Yep - deploying apps to users on the go over the web.

I need ClickOnce to work for mobile workers who need to be able to install and update their company's custom software.

And what's the best way to do this? You would think it was Forms Authentication. That's what I want to use. Not all of these people have windows accounts or will be using VPN. But they do have logins to get to the company portal, fill out their timesheets online, etc. Additionally, we are already using web services as the back end to their smart-client applications so that they can do their work over HTTP.

But guess what - sure I have had two years to discover this, but I am just coming up for air on this one now - Forms Authentication is not supported for Click Once. See this msdn document.

Their suggestion? Just let anyone in the whole world download your client's application and then use web service based authentication (which I just happen to already have built into this smart client app) to make sure they can't use it.

No no no no no.  I do not think this would make my client very happy at all.

So I am struggling wtih hacking this together. The forms authentication works just great for accessing the installation page, but setup.exe and myapp.application are not protected by forms authentication. Anyone can browse right to them.

Next step is to feed them to ISAPI for this web app, which for some reason I can't get to work yet.

I'm sure there have already been many discussions and rants about this problem but I have been focused on other things and am pretty late to the game.

Web deployment has become my a#1 pet peeve with .NET. I have been trying to use it since it was called zero touch deployment. ClickOnce is supposed to be my savior and I have ported their app to VS2005 just for ClickOnce. I won't give up, but I might have to rant and rave every so often as I get this to work for me.



Don't Forget: www.acehaid.org
Monday, February 06, 2006 11:07:21 AM (Eastern Standard Time, UTC-05:00)  #     |  Comments [0]  | 

I put .NET 2.0 on my client's web server the other day. Both 2.0 and 1.1 asp.net apps continued to run just fine.

Last night I was mucking with some of the mappings in .NET 2.0 and they weren't taking. So I did an iisreset. Here's where that led me (to the best of my recollection)

  • 1.1 apps: Server Unavailable, 2.0 apps okay
  • run aspnet_regiis -i  for 1.1
  • 2.0 apps Server Unavailable, 1.1 apps okay
  • iis reset
  • 1.1 apps: Server unavailable, 2.0 apps okay
  • aspnet_regiis -i for 1.1
  • 1.1 apps okay, 2.0 apps okay
  • close the MMC for iis
  • 1.1 apps okay, 2.0 apps server unavailable
  • aaargh!! That shouldn't have happened.
  • aspnet_regiiis -i for 2.0
  • 1.1 apps: Server Unavailable, 2.0 apps okay
  • aspnet_regiiis -i for 1.1
  • both okay
  • don't touch a damned thing
  • slept with my fingers crossed
  • this morning - both still okay but I realize that clickonce deployment on the 2.0 site is broken.

Most of the above problems could have probably been avoided if I used some of the other available parameters for aspnet_regiis, such as -sn for fixing the mappings on just one application.

Update, though using the -sn was a good thing, the root of the problem (thanks to some reminders in the comments) was that I had neglected to create a separate Application Pool for the .net 2.0 websites. They were running in the same process as the asp.net 1.1 sites. So far, everyone has been behaving properly.

Don't Forget: www.acehaid.org

Monday, February 06, 2006 9:31:51 AM (Eastern Standard Time, UTC-05:00)  #     |  Comments [0]  | 

CAS is confusing! Mike Downen's MSDN Mag article about CAS in 2.0 is really an excellent explanation of CAS along with some great info on what's new in 2.0 as well. [read more ...]

[A DevLife post]



Don't Forget: www.acehaid.org
Monday, February 06, 2006 9:03:24 AM (Eastern Standard Time, UTC-05:00)  #     |  Comments [0]  | 
 Saturday, February 04, 2006

One of the big factors that drew us to move to Vermont in 1999 was the skiing. We can ski out our back door to the back country or drive 7 miles to our favorite lift-serve ski area: Mad River Glen.

But what is this?

I took this on Jan 21 out my front window

and this one I took 5 minutes ago

Saturday, February 04, 2006 10:15:36 AM (Eastern Standard Time, UTC-05:00)  #     |  Comments [0]  | 

Congratulations to the Windows Live Local team on being selected for an Editors Choice Award by PC Magazine!!

I had to laugh when I saw the screen shot in the PC Mag article. One of the tags is for Ft. Green Park in Brooklyn. In a former life (my 20's) I lived 1/2 block from that park.

(add'l plug for the WLL team: Want to join this "winning team"? They are hiring!!)



Don't Forget: www.acehaid.org
Saturday, February 04, 2006 9:47:48 AM (Eastern Standard Time, UTC-05:00)  #     |  Comments [0]  | 
 Friday, February 03, 2006

Now here's a guy about whom I can literally say "I knew him when."

I knew Ken Levy when he was a wee lad (a teen) who had written the most popular add-in for professional FoxPro developers everywhere - GenScrnX!

This was so long ago that rather than an email, Ken used an ID of  76350,2610. Yep, Compuserve.

Ken, along with YAG, has been doing great things at Microsoft for a whole lotta years now. But now Ken is straying from the fold and got lured over to Windows Live.



Don't Forget: www.acehaid.org
Friday, February 03, 2006 10:37:34 PM (Eastern Standard Time, UTC-05:00)  #     |  Comments [0]  | 

Well, I'm quoting Scott Watermasysk on that, but since he and I talked about this frequently over the years while I was heavily involved with INETA, I'm happy to see this finally happen! Looks like newlywed Jason Beres has a hand in this, too. Excellent!

Hopefully, everyone gets the little joke in the upper right hand corner of the home page. ;-)



Don't Forget: www.acehaid.org
Friday, February 03, 2006 9:54:15 PM (Eastern Standard Time, UTC-05:00)  #     |  Comments [0]  | 
Scott Hanselman comes out with his confession of being an A/V geek. I am always happy to know that I have a room filled with closet a/v geeks at the Vermont.NET meetings when we have problems iwth the project, or the screen, or the light bulb. Check Scott's latest list to see if you exhibit signs of an A/V geek.

Don't Forget: www.acehaid.org
Friday, February 03, 2006 9:50:48 PM (Eastern Standard Time, UTC-05:00)  #     |  Comments [0]  | 

These guys are NOT to be missed if you are able to get to Waltham, MA on March 25th. It's a "mini-code camp." A one day one track event.

Patrick Hynds and Duane LaFlotte are two guys you want on YOUR side when it comes to hacking. Had Duane found a different mentor in his youth, he'd be the guy downloading all of your credit card companies most secure data! Phew, we lucked out.

Not only do they know amazing things about security, but they are one hell of an entertaining duo!

One word of advice though. If Patrick offers to drive you around Boston, do NOT, I repeat, do NOT sit in the back seat! :-)



Don't Forget: www.acehaid.org
Friday, February 03, 2006 9:46:01 PM (Eastern Standard Time, UTC-05:00)  #     |  Comments [0]  | 

For as long as I've been using outlook, I have always clicked on the "new message" icon to create a message.

I just accidentally double clicked on a whitespace below my message list in unread mail (where I have a red circle and yes I did that with a mouse, not on a tablet) and voila!! A new email message window opened up. Man, this is going to help me be even lazier. I won't have to move the  mouse all the way up into that corner any more!

It works when you are at the bottom of any view that lists emails. Of course, most of my email folders are bottomless pits of endless emails, but at least the unread mail looks minimal when I have the groups closed.



Don't Forget: www.acehaid.org
Friday, February 03, 2006 3:16:10 PM (Eastern Standard Time, UTC-05:00)  #     |  Comments [0]  | 

Did you know that there are 40 command line utitiles in .NET? [read more ...]

[A DevLife post]



Don't Forget: www.acehaid.org
Friday, February 03, 2006 9:08:20 AM (Eastern Standard Time, UTC-05:00)  #     |  Comments [0]  | 
 Thursday, February 02, 2006

I saw this question in the newgroups and wanted to blog about it because it is a real gotcha that gotme too when I first started working with WSE 3.0.

If you set the WSE 3.0 diagnostics tab to output trace files, you can get a look at the messages going out of and coming into your client as well as going out of and coming into your webservice.

Tip #1 Remember to turn OFF this tracing when you send your client app or web service into production. Left to it's own devices, the trace files will grow and grow and grow and one day you will be wondering why your web service is acting so slowly. That's because of the effort of opening up a 60MB file to add some text to the bottom of it!

Tip #2 The default file names are TraceInput.webinfo and TraceOutput.webinfo. Those extensions suck because you can't open them up in anything easily. I always change them to TraceInput.webinfo.xml and TraceOutput.webinfo.xml. Then I can double click on them and open them up in something like I.E. or an even more intelligent angle bracket reader. (Note:Nathan (a tester on the WSE team) makes a good point about this. If you forget to do #1, then #2 could very easily expose some super critical data for hackers on your production server! So you might be better off without this particular little trick of mine.)

Tip #3: Reading the trace files, remember that there is more than the header and body of the message in there. There is also processing info. That means that in an output file, the first thing you will see is the unprocessed message. Your app has created the message, but it hasn't been through WSE yet to get all it's protection before it's sent out on the wire. This is very confusing and can even be a little frightening because if you have encrypted your message, the first thing you see is a message body with clear text! Notice,though, that it is surrounded by tags that say <processingStep description="Unprocessed Message">. Now at the bottom of that <outputMessage> and you will see the <processingStep description="Processed message">. That is the message that is going out on the wire and hopefully looks more like what you expected.

On the incoming message, the first thing in the door (again the Unprocessed Message) is what just came in off the wire. So that is the real soap message and should display all of the properties you expected - encryption and any thing else you demanded of the message. Then you can read through the processing steps and the last step has the fully processed message that is about to get passed to your application. All of the security goo is gone and you will see clear text again, even when the actual message was totally secured.

Tip #4: If you want to see only the soap that went over the wire, bag the built in tracing and use Mike Taulty's sweet little WSE 3.0 Tracing Tool.

Tip #5: For even more detailed inspection and diagnostics of your web service messages, check out Mindreef's SoapScope.



Don't Forget: www.acehaid.org
WSE
Thursday, February 02, 2006 10:17:18 PM (Eastern Standard Time, UTC-05:00)  #     |  Comments [0]  | 

Three years ago I did a presentation at Vermont.NET on Architecting Applications with Web Services. (Proof is at the past events page - check Feb 2003!) 

I clearly remember the question of overloaded web methods coming up in that session. I didn't know the answer so I tried it right then and there and it didn't work. Someone mentioned there was a way to get around it and we found that solution another day.

It's still a question for a lot of people who are coming to Web Services as OO programmers (which Visual Studio lets us do) and that is because many are unfamiliar with the attributes that can be used for web services. Or they see them but have no idea what they are there for.

Thom Robbins recently had someone ask the same question and blogged how to use attributes to enable overloading when defining web methods in Visual Studio.NET.

Three years ago, it seemed like a good idea to me. I didn't really grokWeb Services. I was just using them as a means to an end and I knew OO programming, not messaging.

However, now my perception has changed and it's important to note (as Thom does (thanks Thom!)) that just because you can do it, doesn't mean it's a good thing. It's the OO way, for sure, but it just does not jibe with messaging and contracts and it does not conform to WSI Basic profile which demands unique names for operations (web methods). So if you have any intentions of going outside of .NET with your messaging, don't do it. A contract needs to be clearly defined and by providing overloads, that just blows the contract away.

If you are writing what the plumbers call "silo" apps, .NET all the way through and you are controlling the client and the service, there's no harm outside of the damage you are doing to your brain. Still, it's important for the WSDL that represents your web service identifies does not identify itself as conforming to WSI Basic profile. When you create a new web service in VS2005, by default, the service has attributes that claim to conform to the Basic Profile. Thom includes the caveat in there to set the services' conformance claims to "none".

Here's what a .Net web service class that shows what Conformance Claims  looks like. ConformsTo is the claim. Emit embeds the claim in the wsdl.

<WebServiceBinding(ConformsTo:=WsiProfiles.BasicProfile1_1, EmitConformanceClaims:=True)> _
<WebService(
)> _
Public Class
ShowConformance
  <WebMethod> _
  Public Function HelloWorld() As
String
   Return
"Hello"
  End Function
End Class

If you look at the wsdl (eg http:\\localhost\myservice.asmx?wsdl) you can see that claim. Here is the appropriate section of the wsdl.

- <wsdl:binding name="ServiceSoap" type="tns:ServiceSoap">
- <wsdl:documentation>
  <wsi:Claim conformsTo="http://ws-i.org/profiles/basic/1.1" xmlns:wsi="http://ws-i.org/schemas/conformanceClaim/" />
  </wsdl:documentation>
  <soap:binding transport="http://schemas.xmlsoap.org/soap/http" />
- <wsdl:operation name="HelloWorld">

When you explicitly define that the service does NOT conform, there is no claim in the WSDL that says "I do not conform". In that case, no claim is made at all.

So by marking your service with

ConformsTo:=WsiProfiles.None

even if you have EmitConformanceClaims set to true, there will be no wsi:Claim in the wsdl.

If you forget to remove the conformance claims, you will get a big fat error message when you try to call the asmx.

Service 'Service' does not conform to WS-I Basic Profile v1.1. Please examine each of the normative statement violations below.

and the detail tells you:

To make service conformant please make sure that all web methods belonging to the same binding have unique names.

The more you start understanding these things today, the more prepared you will be for WCF.



Don't Forget: www.acehaid.org
WSE
Thursday, February 02, 2006 12:29:55 PM (Eastern Standard Time, UTC-05:00)  #     |  Comments [0]  | 
I noticed an ad in the current edition of 7 Days classifieds for someone who is looking for a C++ tutor. Look under Professional Services/Services Wanted.

Don't Forget: www.acehaid.org
Thursday, February 02, 2006 9:34:23 AM (Eastern Standard Time, UTC-05:00)  #     |  Comments [0]  | 
 Tuesday, January 31, 2006

I have a web service that I wrote for one of my smart client apps to check for one of three states of connectivity: no network, local network connection to web server, web connection to the web server.

So I ping the web service at the local i.p. The operation returns a mystical "hello world". If that times out, then I ping the service at the i.p. of the web server as it is exposed to the web via ISA Server. If that times out as well, then they are told (politely of course) that they are S.O.L. and need some type of network access to run these particular functions.

I have a client side assembly dedicated to this as well as the web service.

Now Visual Basic .NET 2.0 has My.Computer.Network.Ping to which you pass a URI and a timeout period. There is one small code benefit to me as I have to dynamically construct the web service URL and using the new method, I can just ping the i.p. and not care about a complete path to the web service. However, the Network.Ping method requires a bunch of permission that I don't need in order to hit the web service. So I think that for now, I'll leave it alone and wokr on other things for my migration.



Don't Forget: www.acehaid.org
Tuesday, January 31, 2006 10:33:46 PM (Eastern Standard Time, UTC-05:00)  #     |  Comments [0]  | 

Pondering about being a user of development tools vs. being an inventor of these same tools... [read more...]

[A DevLife post]



Don't Forget: www.acehaid.org
Tuesday, January 31, 2006 5:38:16 PM (Eastern Standard Time, UTC-05:00)  #     |  Comments [0]  |