Category Archives: software development

.net, microsoft, mobile, open source, software, software development, visual studio

SharpDevelop 3.0: everything .NET from Boo to F#

4 Comments

I’ve been researching open source .NET and noticed that SharpDevelop, the free IDE for .NET on Windows, completed version 3.0 earlier this month. Congratulations to the team. Along with Windows Forms and ASP.NET applications in C# or Visual Basic, you get extras like support for F#, Boo and Python. Another welcome feature is built-in support for Subversion version control. There’s even an ASCII table in the IDE, which brings back memories: 15 years ago every programming manual had one at the back.

SharpDevelop has two major challenges. One is keeping up with Microsoft; right now there are discussions about improving WPF support, for example. The other is that Microsoft offers free Express versions of Visual Studio, which leaves SharpDevelop with those niche users for whom the Express products are unsuitable, but who do not want to pay for a full version, or who are wedded to some exclusive SharpDevelop feature.

In favour of SharpDevelop, it installs more easily and loads more quickly than Microsoft’s effort, and certainly proves the point that native C# applications do not have to be slow.

A more interesting though less complete product is the forked MonoDevelop, which is cross platform and targets Mono, the open source implementation of .NET. Mono now looks good on Linux; but the idea of WORA (Write Once Run Anywhere) has never really caught on in the .NET world. How many significant Mono applications for Windows have you seen? My guess is that if it happens at all, it will be in the form of Silverlight/Moonlight running in the browser.

Technorati tags: , , , ,
.net, microsoft, software development, visual studio

First screenshots of Visual Studio 2010 UI

1 Comment

Jason Zander has posted some screenshots and info about the new WPF-based UI for Visual Studio 2010.

An early build of VS 2010 was handed out at PDC last year, but lacked the new UI.

Floating document windows is a great new feature. That said, Visual Studio 2008 works rather well; I hope the new version is equally fast and stable.

Technorati tags: , ,
adobe, cloud computing, flash, internet, microsoft, multimedia, silverlight, software, software development, Uncategorized, web authoring

How will Microsoft make money from Silverlight?

6 Comments

Indeed, will it do so? I like Silverlight a lot; though I appreciate that to a Flash developer it may seem pointless. It does a lot of stuff right: small download, powerful layout language, cross-platform (with caveats), rich media, fast just-in-time compiled code.

Still, what intrigues me is how Silverlight has come from nowhere to what seems to be a central position in Microsoft’s product strategy in just a few years. What’s the business case? Or is it just that someone high up experienced a moment of horror – “Flash is taking over in web media and browser-hosted applications, we gotta do something”?

Let’s eliminate a few things. It’s not the design and developer tools. Making a profit from tools is hard, with tough competition both from open source, and from commercial companies giving away tools to promote other products. I don’t know how Microsoft’s figures look for the Expression range, but I’m guessing they bleed red, irrespective of their quality. Visual Studio may just about be a profit centre (though the Express series is free); but Silverlight is only a small corner of what it does.

Nor is it the runtime. Adobe can’t charge for Flash; Microsoft can’t charge for Silverlight.

I asked Twitter for some ideas. Here are some of the responses:

migueldeicaza @timanderson, my guesses:WinServer built-in-steaming;Strengthening .NET ecosystem, and client-server interactions;Keep share in RIA space

IanBlackburn @timanderson Isn’t Silverlight going to become the "Microsoft Client" and central to s+s?  Apps built with it can be charged in many way

harbars @timanderson no doubt with annoying adverts

mickael @timanderson isn’t silverlight a defensive move against other RIA platforms (like Adobe’s one)? They might only plan selling developmt tools

jonhoneyball @timanderson In the long term by hosting tv stations’ internet traffic and providing the charging/hosting/download/player model.

jonhoneyball @timanderson ie azure cloud + silverlight + someone elses content = ms revenue. no, it wont work, but its not unexpected ms-think.

jonhoneyball @timanderson why no work? price war to come on cloud host/delivery etc Someone will host BBC for free. Game over

There are two main themes here. One is media streaming; as the Internet takes over an increasing proportion of broadcasting and media delivery (note recent comments on Spotify) Microsoft plans to profit from server-side services. The challenges here are that there may be little money to be made; Adobe has a firm grip on this already; and Apple will do its own thing.

The other is about applications. This is the bit that makes sense to me. Microsoft knows that the era of Windows desktop clients, while not over, is in long-term decline; and that applies to applications like Office as well as custom business applications. Silverlight is a strong client platform for web-based alternatives. So I’m voting for Ian Blackburn’s comment above: it’s the Microsoft Client.

If that’s right, we’ll see Silverlight embed itself into more and more of Microsoft’s products, from desktop to server, just as Adobe is gradually remaking everything it does around Flash.

The difference is that Microsoft has far more invested in the status quo: selling Windows and Office. I’m guessing that there are heated internal battles around things like Web Office. The briefing I attended at the 2008 PDC on Office Web Applications was fascinating in respect of its ambivalence; for every web feature shown, the presenters wanted to emphasise that desktop Office was still the thing you should have.

Technorati tags: , , ,
software development

QCon next month reports strong registrations

An email this morning reminds me that QCon takes place in London next month – this is one of my favourite developer-focused conferences, with excellent speakers covering a breadth of technology, though if you hate all things Agile it is probably not the place for you.

The organizers say that:

attendance for this year’s QCon London is actually ahead of last year’s, despite the problems in the economy

Given that it’s now common for conferences to be shrunk or cancelled, that’s impressive.

Technorati tags: ,
security, software development, sql

Kaspersky site hacked through SQL injection

There are millions of sites out there vulnerable to SQL injection; apparently one of them (at least until yesterday) was that of the security software vendor kaspersky.com. A hacker codenamed unu posted details – not all the details, but enough to show that the vulnerability was real. The hack exposed username tables and possibly personal details. Reddit has a discussion of the programming issues. According to the Reg, Kaspersky had been warned but took no action:

I have sent emails to info@kaspersky.com, forum@kaspersky.com, and webmaster@kaspersky.com warning Kasperky [sic] about the problem but I didn’t get any response," Unu, the hacker, said in an email. "After some time, still having no response from Kaspersky, I have published the article on hackersblog.org regarding the vulnerability.

The trouble with those kinds of email addresses is that they are unlikely to get to the right people. It’s still disappointing; and also disappointing that there is currently no mention of the issue (that I can see) on Kaspersky’s site. The company’s response to the security hole is equally as important as the vulnerability itself. When WordPress was hacked, founder Matt Mullenweg was everywhere responding to comments – on this blog, for example. I liked that a lot.

Technorati tags: , ,

microsoft, security, software development, vista, windows 7

Windows security and the UAC debate: Microsoft misses the point

2 Comments

Poor old Microsoft. When User Account Control was introduced in Windows Vista the crowd said it was too intrusive, broke applications, and not really more secure – partly because of the “OK” twitch reflex users may suffer from. In Windows 7 UAC is toned-down by default, and easy to control via an easy-to-find slider. Now the crowd is saying that Microsoft has gone too far, making Windows 7 less secure than Vista. The catalyst for this new wave of protest was Long Zheng’s observation that with the new default setting a malicious script could actually turn off UAC completely without raising a prompt.

Microsoft’s Jon DeVaan responds with a lengthy piece that somewhat misses the point. Zheng argues that Microsoft should make the UAC setting a special one that would:

force a UAC prompt in Secure Desktop mode whenever UAC is changed, regardless of its current state

DeVaan doesn’t respond directly to this suggestion which seems a minor change that would barely impact usability.

DeVaan also says:

There has been no report of a way for malware to make it onto a PC without consent. All of the feedback so far concerns the behavior of UAC once malware has found its way onto the PC and is running.

It’s an important point; though I wonder how DeVaan has missed the problems with autorun that can pretty much install malware without consent.

I am not one of those journalists whom Zheng lambasts:

This is dedicated to every ignorant “tech journalist” who cried wolf about UAC in Windows Vista.

Rather, I’ve been an advocate for UAC since pre-release days; see for example my post If Microsoft doesn’t use UAC, why should anyone else? which I later discovered upset some folk. One reason is that I see its real intent, best articulated by Mark Russinovitch, who writes:

UAC’s various changes and technologies will result in a major shift in the Windows usage model. With Windows Vista, Windows users can for the first time perform most daily tasks and run most software using standard user rights, and many corporations can now deploy standard user accounts.

and Microsoft’s Crispin Cowan:

Making it possible for everyone to run as Standard User is the real long term security value

In other words, UAC is a transitional tool, which aims to bring Windows closer to the Unix model where users do not normally run with local admin rights and data is cleanly separated from executables.

The real breakthrough will come when Microsoft configures Windows so that by default non-expert home and SME users end up running as standard users. Experts and system admins can make their own decisions.

In the meantime, I don’t see any harm in implementing the change Zheng is asking for, and I’d like to see Microsoft fix the autoplay problem; I believe users now understand that there is a trade-off between security and convenience, though they become irritated when they get the inconvenience without the security.

Update: Microsoft now says it will fix Windows 7 so that the UAC settings are better protected.

Technorati tags: , ,
javascript, microsoft, software development, visual studio, web authoring

Visual Studio 2008 as a JavaScript editor

1 Comment

I’ve been doing some work on JavaScript editors recently, and was impressed by Microsoft’s Visual Studio in this respect. Here’s my post on the subject. By the way, even the free Express edition works fine for this; and you don’t need to use ASP.NET. You do need to use Internet Explorer of course; that’s another story.

adobe, apple, internet, iphone, software development, web authoring

What’s the deal with Flash and the iPhone?

An brief comment from Adobe’s CEO Shantanu Narayen quoted by Bloomberg suggests that Apple and Adobe are actually working on putting Flash on the iPhone:

It’s a hard technical challenge, and that’s part of the reason Apple and Adobe are collaborating. The ball is in our court. The onus is on us to deliver.

Deliver what? I’d have thought it would be straightforward for Adobe to implement some level of Flash on the iPhone. There are at least two reasons though why Apple might be blocking it:

1. Flash is a client runtime. Apple may feel that allowing applications to run within Flash could threaten its App Store lock-in and market.

2. One of the frustrations of Flash on devices is that it lags behind the version of Flash available on desktops, and is often hard to update. That’s frustrating for users. Apple may want to address that by giving iPhone users an experience that comes close to that on the desktop.

So what is Apple waiting for Adobe to deliver? Better mobile performance and usability? Or some other piece that might address the first of the above concerns?

The outcome of this has a significance that goes beyond the iPhone. Although iPhone and iTouch users form only a small proportion of those browsing the web, it is an influential group and one that will grow. The lack of Flash support makes pure HTML and JavaScript solutions more attractive to web developers.

If anyone from Adobe can give us more insight into what it is working on with Apple, I’m keen to know.

Technorati tags: , , , ,
microsoft, security, software, software development, windows

Gears of War certificate expiry a reminder to developers: always timestamp signed code

Users of the PC version of Gears of War have been unable to run the game since yesterday (29th January 2009). If they try, they get a message:

You cannot run the game with modified executable code

Joe Graf from Epic has acknowledged the problem:

We have been notified of the issue and are working with Microsoft to get it resolved. Sorry for any problems related to this. I’ll post more once we have a resolution.

The workaround is to set back your system clock. An ugly solution. Of course, some users went through the agony of full Windows reinstalls in an effort to get playing again.

So what happened? This looks to me like a code-signing problem, not a DRM problem as such, though the motivation for it may have been to protect against piracy. Code signing is a technique for verifying both the publisher of an executable, and that it has not tampered with. When you sign code, for example using the signwizard utility in the Windows SDK, you have to select a certificate with which to sign, and then you have an option to apply a timestamp. The wizard doesn’t mention it, but the consequences of not applying a timestamp are severe:

Microsoft Authenticode allows you to timestamp your signed code. Timestamping ensures that code will not expire when the certificate expires because the browser validates the timestamp. The timestamping service is provided courtesy of VeriSign. If you use the timestamping service when signing code, a hash of your code is sent to VeriSign’s server to record a timestamp for your code. A user’s software can distinguish between code signed with an expired certificate that should not be trusted and code that was signed with a Certificate that was valid at the time the code was signed but which has subsequently expired … If you do not use the timestamping option during the signing, you must re-sign your code and re-send it out to your customers.

Unfortunately, there is no timestamping for Netscape Object Signing and JavaSoft Certificates. Therefore you need to re-sign your code with a new certificate after the old certificate expires.

I don’t know if this is the exact reason for the problems with Gears of War, and I’m surprised that the game refuses to run, as opposed to issuing a warning, but this could be where the anti-piracy measures kick in. Epic’s programmers may have assumed that the only reason the certificate would be invalid is if the code had been modified.

I blogged about a similar problem in February 2006, when a Java certificate expired causing APC’s PowerChute software (a utility for an uninterruptible power supply) to fail. That one caused servers to run slow or refuse to boot.

As far as I know, there is no way of telling whether other not-yet-expired certificates are sitting on our PCs waiting to cause havoc one morning. If there are some examples, I hope it does not affect software running, say, Air Traffic Control systems or nuclear power stations.

If you are a Windows developer, the message is: always timestamp when signing your code.

adobe, flash, software development

Adobe Flex community at odds over Fx prefix, lack of collaboration

1 Comment

Some members of the community around Adobe’s open source Flex SDK are fuming at a decision made by Adobe back in October 2008, to prefix the new skinnable components in the forthcoming “Gumbo” release with Fx. This means you can disambiguate old and new components such as Button without relying on namespaces. On the other hand, what is wrong with namespaces? The issue has provoked a lot of debate, partly on the merits or otherwise of the Fx prefix, and partly on the open source development process itself. The Fx decision was announced rather than discussed. Simeon Bateman, who is now all-but proposing an Fx-less fork of the SDK, says:

Creating an open source project is about openness in planning and development. Not just about giving people the right to do with the code what they will. And this part of the Flex project is a complete failure … The current Flex SDK team has about 20 developers and they are fiendishly working on the code for the next version of Flex, version 4 code named Gumbo. And they are doing all that development in private, behind closed doors with nothing but commit logs for us to know what is happening. This is an open source project and we have no idea what is going coming or what the timelines are for milestones. What the hell are the milestones?

Manish Jethani argues that Fx is a sign of haste and corporate pressure:

Even though Flex is an open source project, it is very much run per corporate interests. In a truly open source project like the Linux kernel, there are no deadlines — it’s ready when it’s ready. That’s how research departments work. But Flex is no research, Flex is business. Why, wouldn’t the ‘Fx’ prefix give Flex Builder yet another advantage over competing IDEs? Think about it.

Ben Clinkinbeard has created a survey to allow Flex developers to express their opinions, though as a commenter notes, it is more of an objection petition than a survey.

Adobe responded with an online open meeting to discuss this and other matters which took place this morning – you can play the recording online. It may have been frustrating for those who felt strongly about it, since after presenting the reasons for the change the presenters deferred further discussion to the online forum. As far as I can tell, the Fx decision is unlikely to change.

Well, there is open source, and there is collaborative development, and they are not the same thing. Adobe retains tight control over Flex for the sake of its commercial interests. It is a reminder that although the Flex SDK is open source it is not a community property in the same way as Apache.

Once crumb of comfort for Adobe is that this kind of intense debate shows the high value of Flex to its developers. It would be far, far worse if nobody cared.

Update: you can vote against the fx prefix or discuss it in Adobe’s bug-tracking system here.

Technorati tags: , , ,