RSS 2.0  Frustrated by Design
# Thursday, June 26, 2008

microsoftmilan

Most people haven't had a chance to play with Microsoft Surface.

It's one of the coolest technologies in a long time !

[ Click HERE to watch the video. ]

Thursday, June 26, 2008 9:01:32 AM (Atlantic Standard Time, UTC-04:00)  #    Comments [0] - Trackback
Op-Ed | Videos
# Wednesday, June 25, 2008

WithGerogio

While at TechEd 2008 I got to spend some time in the "Fish Bowl" with Georgeo Pulikkathara.

Georgeo interviewed me on Microsoft's Secure Development Lifecycle (SDL) and my upcoming Developer Security Activities.

Please [ click HERE ] to check out Georgeo's blog post and [ Click HERE ] to have a listen to the show.

Wednesday, June 25, 2008 9:55:36 AM (Atlantic Standard Time, UTC-04:00)  #    Comments [0] - Trackback
Misfit Geek [IIS] | Misfit Geek [Silverlight] | Misfit Geek [Syndicated] | Misfit Geek [WindowsClient] | Security

cs-gallery

ComponentArt releases Charting 2008.1, introducing advanced AJAX interactivity, dual 3D rendering engines, and a wealth of core charting features.

Grate for AJAX style data visualization !

Visit the Charting Gallery for live demos.

Wednesday, June 25, 2008 8:58:42 AM (Atlantic Standard Time, UTC-04:00)  #    Comments [0] - Trackback
AJAX | ASP.NET | Misfit Geek [Syndicated] | Partners & Products
# Tuesday, June 24, 2008

Microsoft has released an advisory for the recent SQL Injection attacks which points to several tools that will help identify and block these type of attacks. The goal of this blog post is to help our audience identify the best tool depending on their role (i.e. Web Developers vs IT administrators). Currently, there are three tools available which serve different purposes and they complement each other.

 Web developers Recommendations

·         The Microsoft ® Source Code Analyzer for SQL Injection is a static code analysis tool that identifies SQL Injection vulnerabilities in ASP code (ASP pages are the ones that have been under attacked). In order to run this tool you will need source code access and the tool will output areas vulnerable to SQL injection (i.e. the root cause and vulnerable path is identified). In our view fixing the root cause of the bug is the best way to eradicate vulnerabilities. The tool scans ASP source code and generates warnings for first order and second order SQL Injection vulnerabilities.

 

IT/Database administrators Recommendations (Web developers can benefit from this as well)

We are recommending two tools, one can help identify SQL injection vulnerabilities by crawling the website (for example, when access to the source code is not possible) and the other one aims to block potential SQL injection attacks.

·         HP Scrawlr, developed by the HP Web Security Research Group, will crawl a website, simultaneously analyzing the parameters of each individual web page for SQL Injection vulnerabilities (Microsoft has worked with HP in this effort). Scrawlr uses some of the same technology found in WebInspect but has been built to focus only on SQL Injection vulnerabilities. This will allow an IT/DB admin to easily find vulnerabilities similar to the ones that have been used to compromise sites in the recent attacks. No source code is required to run this tool. From a starting URL, the tool recursively crawls that URL in order to build up a site tree that will be then analyzed for SQL injection vulnerabilities. For more information check out https://download.spidynamics.com/products/scrawlr/ 

 

·         Second, in order to block and mitigate SQL injection attacks (while the root cause is being fixed), one can deploy filters using URLScan 3.0. This tool restricts the types of HTTP requests that Internet Information Services (IIS) will process. By blocking specific HTTP requests, UrlScan helps prevent potentially harmful requests from being executed on the server. Basically, it uses a set of keywords to block certain requests (i.e. the request will get drop and never processed by SQL) That said, we highly encourage fixing the root cause of the problem instead of attempting on producing a perfect filter that will block all type of attacks (since in our view this is not possible and error prone).

 

The following table summarizes the pros and cons of these tools.

 

Tool

Usage

Pros

Cons

Users

Microsoft Source Code Analyzer for SQL Injection

Identifies SQL Injection vulnerabilities in ASP code through static code analysis.

Identify the root cause of the bug at the source code level.

This version currently only works on ASP pages

Web developers

Scrawlr

Detect SQL vulnerability by crawling a website.

No source code is required.

Cannot identify the line of code responsible.

IT/DB Administrator

Web developers

UrlScan v3.0 Beta

Blocks the types of HTTP requests that Internet Information Services (IIS) will process.

URLScan filter can be easily deployed to mitigate SQL injection attack while the root cause is being fixed.

Not fixing the root cause, thus the risk has not been eliminated completely.

IT Administrators

 


 
Tuesday, June 24, 2008 2:21:21 PM (Atlantic Standard Time, UTC-04:00)  #    Comments [4] - Trackback
Misfit Geek [IIS] | Misfit Geek [Syndicated] | Partners & Products | Security

080616170839

Since most of us Geeks are caffeine addicts......

"Coffee consumption has been linked to various beneficial and detrimental health effects, but data on its relation with death were lacking," says Esther Lopez-Garcia, PhD, the study's lead author. "Coffee consumption was not associated with a higher risk of mortality in middle-aged men and women. The possibility of a modest benefit of coffee consumption on heart disease, cancer, and other causes of death needs to be further investigated."

[ Read the article HERE at Science Daily. ]

Tuesday, June 24, 2008 8:24:16 AM (Atlantic Standard Time, UTC-04:00)  #    Comments [1] - Trackback
Op-Ed
# Monday, June 23, 2008

DevExpress

This years Reader's Choice Awards conducted by ASPnet Pro Magazine showed some great appreciation for DevExpress' recent work.

Their awards included.....

Product of the Year - DXperience ASP.NET

Best Component Set - DXperience ASP.NET

Best Grid - ASPxGridView Suite

Best Add-In - CodeRush with Refactor! Pro

Best Printing/Reporting Tool - XtraReports Suite

Best Charting - XtraCharts Suite

Best Navigation Suite - ASPxperience Suite / ASPxNavBar

Best Online Editor - ASPxHTML Editor

Best Scheduling/Calendar Tool - ASPxScheduler Suite

Check them out at: www.devexpress.com

Monday, June 23, 2008 9:20:08 AM (Atlantic Standard Time, UTC-04:00)  #    Comments [0] - Trackback
ASP.NET | Misfit Geek [Syndicated] | Partners & Products
# Thursday, June 19, 2008

HHacker

Baseline Magazine [ Click HERE ] has outlined the 5 Big Security Threats that Anti-virus software and firewalls MISS.

1 Trusted Users and Partners

2 Web Application Vulnerabilities

Gartner estimates that 75 percent of today’s attacks are carried out through the application layer.

Many of these application attacks are conducted through quickly coded Web applications, with little or no security baked in.

Yet these Web apps are often connected to some of the most sensitive databases businesses own.

3 Missing Devices

4 Custom Malware

5 Social Engineering

[ CLICK HERE to read the whole article. ]

Thursday, June 19, 2008 7:55:24 PM (Atlantic Standard Time, UTC-04:00)  #    Comments [0] - Trackback
Misfit Geek [Syndicated] | Security

logo_xna

75k

Today the XNA Team has launched Dream-Build-Play 2008.

In Dream-Build-Play 2008 you can build your dream game to compete with other game developers around the world.  This year’s contest will feature Xbox360 development only and to ensure that everyone has access we will be giving away one free 12-Month XNA Creators Club Trial membership to everyone that registers.  Contestants will compete for $75,000 in prizes and the bragging rights to say their game was the best.  Additionally, one of the top ten finalists will win an opportunity for an Xbox LIVE publishing contract.  For more information log on to www.dreambuildplay.com

· The XNA team has launched Dream-Build-Play 2008. 

· $75,000 in prizes and the chance to receive an Xbox Live Arcade Contract.

· Create and deploy Xbox360 games using XNA Game Studio 2.0

· Everyone who registers will receive a FREE 12-Month Trial Creator Club Membership

Thursday, June 19, 2008 6:11:46 PM (Atlantic Standard Time, UTC-04:00)  #    Comments [0] - Trackback
Dev Community | Misfit Geek [Syndicated] | Misfit Geek [WindowsClient]

microsoft_silverlight_c

Microsoft Silverlight Streaming offers free and inexpensive hosting services that make exposing your video and audio content as easy as pie.

An article by Rob Blackwell

 

Read the article HERE at Devx!

Thursday, June 19, 2008 6:03:06 PM (Atlantic Standard Time, UTC-04:00)  #    Comments [0] - Trackback
Misfit Geek [Silverlight] | Misfit Geek [Syndicated] | Silverlight
# Wednesday, June 18, 2008

I recently had an email exchange with someone asking me about how to approach writing their own WYSIWYG editor control for web applications.

Perhaps an interesting academic exorcize, or maybe he has some very specific application  but it got me thinking about how many implementations there are out there already !

While searching I found this great list which is lifted entirely from Mike Pope [ Click HERE to Read at Mike's Blog ] - THANKS MIKE !

Rich Editor Controls that you can use with ASP.NET

HTML Editors
As near as I can tell, all of these work in-browser and produce HTML or XHTML.

Word Processing, RTF, PDF, and more
These variously support other formats, notably non-HTML (e.g. RTF) and sometimes PDF. Other/Not Sure
I'm not sure how exactly these fit into the picture; they're listed at least in one location as being ASP.NET editors.
  • Community Editor (BigByte). Desktop editing, it says; possibly not in-page HTML editing? Appears to be free.
  • DevEdit NX (Interspire). Not 100% clear that it supports ASP.NET.
More Information
  • A similar list is available at 123aspx.com.
  • Daniel Walzenbach published a list as well in December 2007. With pictures! :-)
  • Scott Mitchell has an article on using FreeTextBox.
  • "Building a WYSIWYG HTML Editor" A two-part article by Mitchell Harper. I'm pretty certain that this is for Internet Explorer only, tho.
Wednesday, June 18, 2008 11:11:24 AM (Atlantic Standard Time, UTC-04:00)  #    Comments [4] - Trackback
AJAX | ASP.NET | Misfit Geek [Syndicated]

mozdev01 OK you AJAX Masters !

Check out ScriptLoader

ScriptLoader is a framework to manage your and third-part javascript libraries.

It will make you easier to call any script library(your or third-part) without injecting any dirty code.for that,you just configure some info in a configuration file.

http://sourceforge.net/projects/scriptloader/
Wednesday, June 18, 2008 10:38:11 AM (Atlantic Standard Time, UTC-04:00)  #    Comments [0] - Trackback
AJAX | ASP.NET | Misfit Geek [Syndicated]
# Monday, June 16, 2008

20447764_thb Want to join the bloggers at weblogs.asp.net ?

Just go here to read the terms of use. (http://www.microsoft.com/info/cpyright.mspx)

If you agree to the Terms and Agree not to change or add any advertising on the site then email me and state that you agree to the terms.

Make sure you send me your EXISTING user ID on www.asp.net (you mush create this yourself.)

Then, before your first post GO HERE and read the post before you start posting.

It's that easy !

Monday, June 16, 2008 7:30:32 PM (Atlantic Standard Time, UTC-04:00)  #    Comments [0] - Trackback
Dev Community | Misfit Geek [Syndicated]

I was supposed to leave on Wednesday for Mix Essentials South Africa next week.

Unfortunately, my paternal grandmother died early this morning and I'll be forgoing the trip to stay home, support my family and see Muth (as she was called - short for Mother) or Ginny (as I called her) off on her journey to whatever comes next.

I agonized a bit over the decision. Ginny was a strong, pragmatic women and would have told me to travel. Many Many thanks to my great boss Simon, who never EVER asks me to put work before my family, to Brad Abrams who was to be my travel companion, who is so completely understanding, and who will have to pick up much of the slack that my absence creates, and to Microsoft South Africa who is also being very understanding, and who I owe a visit in the near future !

I must confess that natural events such as these seldom catch me off guard, but this one has, I grew up just down he street from Ginny and she has always had a special place in my Heart.

I'll be a it slow reconnecting, but am already feeling a strong urge to settle in for the summer and PRODUCE !  The spring travel always leaves me feeling this way.

So....  Before I go prolific !  If you don't subscribe to my blog (www.MisfitGeek.com) I hope you will.

My summer is YOURS ! I have video series in the works on ASP.NET Security and Data Access, and some Windows Forms stuff.

What would YOU like me to add to the list ?

Patterns ?

Architecture ?

ASP.NET Themes and Skins ?

Controls ?

More AJAX Techniques ?

You're the boss(es) !

Monday, June 16, 2008 6:37:29 PM (Atlantic Standard Time, UTC-04:00)  #    Comments [2] - Trackback
Dev Community | Misfit Geek [Syndicated] | Off-Topic
# Thursday, June 12, 2008

BradA referred me to some Internal Coding Guidelines hat I thought I'd share...

Table of Contents

1. Introduction.......................................................................................................................................... 1

2. Style Guidelines.................................................................................................................................... 2

2.1 Tabs & Indenting................................................................................................................................ 2

2.2 Bracing............................................................................................................................................... 2

2.3 Commenting........................................................................................................................................ 2

2.3.1 Documentation Comments............................................................................................................. 2

2.3.2 Comment Style............................................................................................................................. 3

2.4 Spacing............................................................................................................................................... 3

2.5 Naming............................................................................................................................................... 4

2.6 Naming Conventions............................................................................................................................ 4

2.6.1 Interop Classes............................................................................................................................. 4

2.7 File Organization................................................................................................................................. 5

1. Introduction

First, read the .NET Framework Design Guidelines. Almost all naming conventions, casing rules, etc., are spelled out in this document. Unlike the Design Guidelines document, you should treat this document as a set of suggested guidelines. These generally do not effect the customer view so they are not required.

2. Style Guidelines

2.1 Tabs & Indenting

Tab characters (\0x09) should not be used in code. All indentation should be done with 4 space characters.

2.2 Bracing

Open braces should always be at the beginning of the line after the statement that begins the block. Contents of the brace should be indented by 4 spaces. For example:

if (someExpression)
{
DoSomething();
}
else
{
DoSomethingElse();
}

“case” statements should be indented from the switch statement like this:

switch (someExpression)
{

case 0:
DoSomething();
break;

case 1:
DoSomethingElse();
break;

case 2:
{
int n = 1;
DoAnotherThing(n);
}
break;
}

Braces should never be considered optional. Even for single statement blocks, you should always use braces. This increases code readability and maintainability.

for (int i=0; i<100; i++) { DoSomething(i); }

2.3 Single line statements

Single line statements can have braces that begin and end on the same line.

public class Foo
{
int bar;

public int Bar
{
get { return bar; }
set { bar = value; }
}

}

It is suggested that all control structures (if, while, for, etc.) use braces, but it is not required.

2.4 Commenting

Comments should be used to describe intention, algorithmic overview, and/or logical flow. It would be ideal, if from reading the comments alone, someone other than the author could understand a function’s intended behavior and general operation. While there are no minimum comment requirements and certainly some very small routines need no commenting at all, it is hoped that most routines will have comments reflecting the programmer’s intent and approach.

2.4.1 Copyright notice

Each file should start with a copyright notice. To avoid errors in doc comment builds, you don’t want to use triple-slash doc comments, but using XML makes the comments easy to replace in the future. Final text will vary by product (you should contact legal for the exact text), but should be similar to:

//-----------------------------------------------------------------------
// <copyright file="ContainerControl.cs" company="Microsoft">
// Copyright (c) Microsoft Corporation. All rights reserved.
// </copyright>
//-----------------------------------------------------------------------

2.4.2 Documentation Comments

All methods should use XML doc comments. For internal dev comments, the <devdoc> tag should be used.

public class Foo
{

/// <summary>Public stuff about the method</summary>
/// <param name=”bar”>What a neat parameter!</param>
/// <devdoc>Cool internal stuff!</devdoc>
///
public void MyMethod(int bar) { … }

}

However, it is common that you would want to move the XML documentation to an external file – for that, use the <include> tag.

public class Foo
{

/// <include file='doc\Foo.uex' path='docs/doc[@for="Foo.MyMethod"]/*' />
///
public void MyMethod(int bar) { … }

}

UNDONE§ there is a big doc with all the comment tags we should be using… where is that?

2.4.3 Comment Style

The // (two slashes) style of comment tags should be used in most situations. Where ever possible, place comments above the code instead of beside it. Here are some examples:

// This is required for WebClient to work through the proxy
GlobalProxySelection.Select = new WebProxy("http://itgproxy");

// Create object to access Internet resources
//
WebClient myClient = new WebClient();

Comments can be placed at the end of a line when space allows:

public class SomethingUseful
{
private int itemHash; // instance member
private static bool hasDoneSomething; // static member
}

2.5 Spacing

Spaces improve readability by decreasing code density. Here are some guidelines for the use of space characters within code:

  • Do use a single space after a comma between function arguments.
    Right: Console.In.Read(myChar, 0, 1);
    Wrong: Console.In.Read(myChar,0,1);
  • Do not use a space after the parenthesis and function arguments
    Right: CreateFoo(myChar, 0, 1)
    Wrong: CreateFoo( myChar, 0, 1 )
  • Do not use spaces between a function name and parenthesis.
    Right: CreateFoo()
    Wrong: CreateFoo ()
  • Do not use spaces inside brackets.
    Right: x = dataArray[index];
    Wrong: x = dataArray[ index ];
  • Do use a single space before flow control statements
    Right: while (x == y)
    Wrong: while(x==y)
  • Do use a single space before and after comparison operators
    Right: if (x == y)
    Wrong: if (x==y)

2.6 Naming

Follow all .NET Framework Design Guidelines for both internal and external members. Highlights of these include:

  • Do not use Hungarian notation
  • Do not use a prefix for member variables (_, m_, s_, etc.). If you want to distinguish between local and member variables you should use “this.” in C# and “Me.” in VB.NET.
  • Do use camelCasing for member variables
  • Do use camelCasing for parameters
  • Do use camelCasing for local variables
  • Do use PascalCasing for function, property, event, and class names
  • Do prefix interfaces names with “I”
  • Do not prefix enums, classes, or delegates with any letter

The reasons to extend the public rules (no Hungarian, no prefix for member variables, etc.) is to produce a consistent source code appearance. In addition a goal is to have clean readable source. Code legibility should be a primary goal.

2.7 Naming Conventions

2.7.1 Interop Classes

Classes that are there for interop wrappers (DllImport statements) should follow the naming convention below:

  • NativeMethods – No suppress unmanaged code attribute, these are methods that can be used anywhere because a stack walk will be performed.
  • UnsafeNativeMethods – Has suppress unmanaged code attribute. These methods are potentially dangerous and any caller of these methods must do a full security review to ensure that the usage is safe and protected as no stack walk will be performed.
  • SafeNativeMethods – Has suppress unmanaged code attribute. These methods are safe and can be used fairly safely and the caller isn’t needed to do full security reviews even though no stack walk will be performed.

class NativeMethods
{
private NativeMethods() {}

[DllImport(“user32”)]
internal static extern void FormatHardDrive(string driveName);
}

[SuppressUnmanagedCode]
class UnsafeNativeMethods
{
private UnsafeNativeMethods() {}

[DllImport(“user32”)]
internal static extern void CreateFile(string fileName);
}

[SuppressUnmanagedCode]
class SafeNativeMethods
{
private SafeNativeMethods() {}

[DllImport(“user32”)]
internal static extern void MessageBox(string text);
}

All interop classes must be private, and all methods must be internal. In addition a private constructor should be provided to prevent instantiation.

2.8 File Organization

  • Source files should contain only one public type, although multiple internal classes are allowed
  • Source files should be given the name of the public class in the file
  • Directory names should follow the namespace for the class

For example, I would expect to find the public class “System.Windows.Forms.Control” in “System\Windows\Forms\Control.cs”…

  • Classes member should be alphabetized, and grouped into sections (Fields, Constructors, Properties, Events, Methods, Private interface implementations, Nested types)
  • Using statements should be inside the namespace declaration.

namespace MyNamespace
{

using System;

public class MyClass : IFoo
{

// fields
int foo;

// constructors
public MyClass() { … }

// properties
public int Foo { get { … } set { … } }

// events
public event EventHandler FooChanged { add { … } remove { … } }

// methods
void DoSomething() { … }
void FindSomethind() { … }

//private interface implementations
void IFoo.DoSomething() { DoSomething(); }

// nested types
class NestedType { … }

}

}

Thursday, June 12, 2008 8:35:30 AM (Atlantic Standard Time, UTC-04:00)  #    Comments [4] - Trackback
.NET | ASP.NET | Misfit Geek [Syndicated]
Navigation
About Me
    Joe Stagner
Follow me on Twitter.

View Joe Stagner's profile on LinkedIn

MSDN

Search
RSS/Subscribe
  RSS 2.0 | Atom 1.0 | CDF  
Archive
<June 2008>
SunMonTueWedThuFriSat
25262728293031
1234567
891011121314
15161718192021
22232425262728
293012345
Contact
Send mail to the author(s)  Send me email.
Statistics
Total Posts: 447
This Year: 3
This Month: 3
This Week: 3
Comments: 1449
Disclaimer

Disclaimer
The opinions expressed herein are my own personal opinions and do not represent my employer's view in any way.

© Copyright 2009
Joe Stagner
Sign In
Gaciously Hosted by MaximumASP.net
MaximumASP ROCKS !!!.
All Content © 2009, Joe Stagner