Looks like Mix09 (March 18-20) is the stage where Microsoft will reveal details of Silverlight 3 (is it really 3 already?). On the session list is:
What’s new in Silverlight 3 (Joe Stegman)
What’s new in Silverlight 3 media (Larry Olson)
Deep Dive into Silverlight graphics – come hear about the Silverlight 3 rendering pipeline (Seema Ramchandani, Marshall Agnew)
Sophos informs us that job sites Monster and USAJobs (an official US Job site) have been hacked. Messages on Monster and USAJobs confirm this. I’d like to draw attention to the fact that passwords were stolen:
We recently learned our database was illegally accessed and certain contact and account data were taken, including Monster user IDs and passwords.
says Monster. And USAJobs says:
We recently learned that the Monster database was illegally accessed and certain contact and account data were taken, including user IDs and passwords, email addresses, names, phone numbers, and some basic demographic data.
Same wording – because Monster is the “technology provider” for USAJobs.
Sophos observes:
There is even more potential for danger, however, because passwords have been stolen. We know that too many people use the same password for every website that they access.
Right. But why is Monster even storing passwords? It is not necessary. All you need store is a one-way password hash, so the site can verify a password without recording it. This is easily done in every web platform out there.
There is a disadvantage. It means the site cannot email your lost password. Instead, it must reset your password. Since email passes in plain text, emailing passwords is a bad idea anyway, and I hate to see sites doing this; it’s a useful alert though that the site places a low value on security.
Any site can get hacked, but what isn’t stored can’t be stolen.
Technical blunders like this can be costly; there’s no excuse for it that I can think of.
I blinked when I tried the live demo of SandRibbon for Silverlight, from divelements. It looks remarkably like Office 2007:
The control is in beta, and promises:
All the commonly-used functionality of the Office 2007 UI is made available for you to use with this product, and most of the less common functionality too. Customers who have used SandRibbon for WPF will find the API familiar. The visual constructs used are compatible with all other Silverlight controls, both built-in and third-party.
The company already has a sandcontrol control for WPF. However, the Silverlight control shows how well you can replicate the look and feel of a desktop application in a cross-platform browser application. Now, put this together with the automatic online/offline synch in Live Mesh, and you could have a version of Office with seamless online and offline support. Microsoft may deliver something like this in the web versions of Office 14, though it is going to have one eye on its lucrative desktop sales and I doubt whether it will really exploit what is now possible.
I’ve been trying various mapping APIs and took a look at Google’s new Earth browser plug-in. It looked a bit odd in IE7 so I tried Google Chrome. Not supported:
Given that it now works in Safari on the Mac (which also uses Webkit) I’m a little surprised. No doubt the team will add it soon, but this sort of thing doesn’t help Chrome adoptiom.
I wrote a short summary of Microsoft’s latest (I think) guidelines for well-behaved Windows applications.
It is a significant topic. A large part of the thinking behind Vista’s contentious User Account Control (which is being continued in Windows 7) is to push app developers into writing applications that conform more closely to the guidelines, especially in respect of where they write data. If all applications conformed, there would be little need to log on as local administrator, and Windows would be more secure.
SQLite developer D Richard Hipp has posted to his mailing list to announce a third release in the space of a few days, to fix bugs discovered in version 3.6.10:
Some concern has been expressed that we are releasing too frequently. (Three releases in one week is a lot!) The concern is that this creates the impression of volatility and unreliability. We have been told that we should delay releases in order to create the impression of stability. But the SQLite developers feel that truth is more important than perception, not the other way around. We think it is important to make the highest quality and most stable version of SQLite available to users at all times. This week has seen two important bugs being discovered shortly after a major release, and so we have issued two emergency patch releases after the regularly scheduled major release. This makes us look bad. This puts "egg on our face." We do not like that. But, three releases also ensures that the best quality SQLite code base is available available to you at all times.
He goes on to say that an extended beta period would be unlikely to reduce the risk of bugs found on release, because most bugs in SQLite are found by internal testing rather than by external users. He also argues against withholding releases until they “testing is finished”:
The fallacy there is that we never finish testing. We are constantly writing new test cases for SQLite and thinking of new ways to stress and potentially break the code. This is a continuous, never-ending, and on-going process. All existing tests pass before each release. But we will always be writing new tests the day after a release, regardless of how long we delay that release. And sometimes those new tests will uncover new problems.
Anyone who has ever developed an application will know that sinking feeling when problems are discovered in code that has been distributed. Thoroughly implemented unit testing, as in SQLite, improves quality greatly. When bugs are found though, full disclosure and prompt fixes are the best possible response, so I agree with Hipp’s general approach here.
I’ve been messing around with SharePoint. When it works, it is a beautiful product. It is a smart file system with versioning, check-in and check-out, point-and-click workflow (eg document approval), offline support via Outlook, direct open and save from Office 2007, and more. It is an instant intranet with blogs, wikis, discussion forums, surveys, presence information, easy page authoring, and more. It is an application platform with all the features of ASP.NET combined with those of SharePoint. It is a content management system capable of supporting a public web site as well as an intranet. It is a search server capable of crawling the network, with a good-looking and sophisticated web UI. And in the high-end Enterprise version you get a server-side Excel engine and all sorts of Business Intelligence features. Fantastic.
Even better, the base product – Windows SharePoint Services 3.0 – comes free with Windows server. Search Server Express is also free and delivers all the search capability a small organization is likely to need.
What’s wrong with this picture? Here’s a few things:
I am out of sorts with SharePoint right now, after a difficult time with Search Server Express (SSX). I have a working WSS 3.0 installation, and I tried to install SSX on the same server. My setup is just slightly unusual, since I have both SharePoint and a default web site on port 80, using the host headers feature in IIS to direct traffic. The SSX install seemed to proceed reasonably well, expect for two things.
First, I puzzled for some time over what account to use as the default account for services. Setup asks you to specify this; and the documentation is a classic case of unhelpful help:
In the Default Account For Services section, type the user name and password for the default services account.
In the Search Center Account section, type the user name and password for the account for the application pool identity of the default Search Center site
Well, thanks, but I could have figured out that I have to type a user name where it says “User name”. But I would like help on how to create or select a suitable account. What permissions does it need? What are the security implications? The temptation is to use an administrator account just because it will most likely work.
Then there was the problem of creating the search site application manually. I had a go at this, helped by these notes from Ian Morrish. I set up a crawl rule and successfully indexed some content. Then I made a search, to be greeted by this error:
Your license for Microsoft Search Server has expired.
Well hang on, this is Search Server Express and meant to be free! A quick Google turns up this depressing recommendation from Microsoft:
To solve your immediate problem, however, it is suggested you uninstall WSS, MSS Express, repave your machine with a clean OS, and reinstall only MSS Express (WSS is installed with it).
Thanks but no thanks. See this thread for a more informative analysis. The user yanniemx reckons, after 10 reinstalls, that he has worked it out:
I realized it was due to using the Express version of Search and then not using the SQL install that is included in the install. From what I can tell if you use another SQL instance it thinks you are using multiple servers and that is not allowed for the Express version.
I think I’ll just uninstall. I did another install of the full MOSS on its own server, and that one works fine. Running on a virtual machine is another good idea.
I hate the way certain Microsoft server products like to be installed on their own dedicated server. That makes sense in an Enterprise, but what about small organizations? I don’t see any inherent reason why something like SSX shouldn’t install neatly and in a reasonably isolated manner alongside other products and web applications. Equally, I am sure it can be done, just as I used the host headers trick to get WSS installed alongside another web site on port 80; but working out how to do it can be a considerable effort.
At the Professional Developers Conference 2008, held at the end of October 2008, Microsoft unveiled Windows Azure, its new cloud platform. I was there, and got the impression that this is a big deal for Microsoft; arguably the future of the company depends on it. It is likely that the industry will reduce its use of on-premise servers in favour of hosted applications, and if Microsoft is to preserve its overall market share it needs a credible cloud platform.
That was nearly two months ago. What’s been the developer reaction, and how is it going with the early tech previews made available at PDC? It’s hard to tell; but there is less public activity than I expected. On the official Azure forums there are just 550 messages at the time of writing; and glancing through them shows that many of them are from people simply having difficulty signing up. One of the problems is that access to the preview is limited by developer tokens of various types, and although Microsoft gave the impression at PDC that all attendees would have these, that has not really been the case. Those who attended hands-on labs at PDC got tokens there; others have had to apply and wait like everyone else. Part of the reason for lack of activity may just be that not many have been able to get in.
There are other issues too. I’ve spent some time trying out Live Framework and building applications for Live Mesh. I’ve written this up separately, in a piece that will be posted shortly. However, I found it harder than I expected to get good information on how to proceed. There is plenty of high-level marketing, but hands-on documentation is lacking. Azure may be different – though I was interested to find another user with similar frustrations (it’s worth reading this thread, as Microsoft’s moderator Yi-Lun Luo gives a handy technical outline of Azure and Live Services).
Still, let’s bear in mind that PDC is where Microsoft shares early technical information about the Windows platform, which is subject to change. Anyone who built applications for the preview Windows Longhorn code doled out at PDC 2003 (Paul Thurrott’s report is a reminder of what it felt like at the time) would have been in for some disappointment – Longhorn was both greatly delayed and much altered for its eventual release as Windows Vista.
It’s possible then that most developers are wisely waiting for the beta of Azure before doing serious experimentation. Alternatively – the bleakest outcome for Microsoft – they are ignoring Azure and presuming that if and when they do migrate applications to the cloud they will use some other platform.
Nevertheless, I’d suggest that Microsoft’s evangelism of Azure has been poor since PDC. There is more buzz about other things presented there – including Windows 7, which in contrast to Azure seems nearly done.
Matt Rogers from Microsoft comments below that the service is not going to change radically between now and general release. He claims that feedback is extensive, but not evident in the online forums because it comes from other sources – he told me on Twitter that “we are getting much of it directly through relationships with customers, local user group meetings and through our evangelists”.
Maarten Balliauw has converted an application to Azure and written up the experience on his blog. He is using Azure TableStorage for data and Live ID for authentication. He says:
Overall, Microsoft is doing a good job with Azure. The platform itself seems reliable and stable, the concept is good.
Unfortunately the app itself does not work at the time of writing.
I hate this Program compatibility Assistant in Vista. Why?
First, because it applies settings whether you like it or not. There’s no option to say, “I was happy with how it ran, just leave it alone”.
Second, because it does not tell you what it has done. Sure, there is a link that says, What settings are applied? So you click it.
And you get a generic help dialog with six headings. You click the most promising: What changes does it make? It says:
It depends on the problem, but any changes made are related to how Windows runs the program. No changes are made to the program itself. For example, the Program Compatibility Assistant can resolve conflicts with User Account Control, a new security feature in this version of Windows that can help make your computer safer. Or, it can run the program in a mode that simulates earlier versions of Windows. The changes that Program Compatibility Assistant makes are done automatically, so you don’t need to make them.
Vague and uninformative. And that’s it.
So how do you really discover? Well, you could read this article. Then you can fire up RegEdit and look at:
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
under both HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE. Here I found an entry for FlexBuilder.exe as follows:
OK, so Flex Builder will now have ELEVATECREATEPROCESS applied. What does that mean? Here’s the scoop:
Here the test program was trying to launch an updater which is required to run as administrator and failed. In this case, PCA will apply the ELEVATECREATEPROCESS compatibility mode, which will enable the program to successfully launch the child exe as administrator the next time. Now when the program is run the next time and while trying to launch the updater, it will not fail and will successfully run as administrator. The user will see the UAC consent UI.
More details on what happens under the covers is explained through Q/A below.
- What is the detection logic and how does PCA know that the program failed to launch a child exe which needs to run as administrator?The detection for this scenario is accomplished through instrumentation at the CreateProcess API to detect the cases when a child process launch fails due to the requirement to run as administrator.
- Why are there no options in this PCA dialog?Due to the high confidence on the issue detection in this scenario, the solution (ELEVATECREATEPROCESS compatibility mode) is automatically applied and the user is not given any options.
In my case I believe there was some problem with the Flex Builder debugger trying to launch FireFox, which was also trying to update itself.
I believe Adobe could avoid this problem by marking Flex Builder as UAC-aware. Then Windows will leave it alone.
Someone asked me today where developers hang out on the Net. Excluding platform-specific sites like MSDN, here’s my first go at a top ten list, in alphabetical order – but I’d love to hear other suggestions.
Coding Horror Jeff Attwood’s site. Both Attwood and Spolsky are on the Stack Overflow team
Dzone – DIGG for developers, also includes Javalobby, which was set up on a wave of indignation back in the nineties when Microsoft seemed to be endangering Java’s run-anywhere promise, now a general Java discussion site.
Joel on Software I don’t always agree with Joel Spolsky, but he’s an excellent writer and deserves inclusion if only for his piece on leaky abstractions.
Reddit programming – another DIGG for developers, actually I prefer this one to Dzone
Slashdot – Geek news discussion site, not just for developers though you’ll find plenty of them there. If you need to know the meaning of the site name, you are outside the target readership.
Stack Overflow – community question and answer site for developers, mentioned by everyone when I asked about developers’ favourite sites on Twitter.
The Code Project – masses of code samples, mainly .NET but also Java, SQL, Linux
The Daily WTF – where WTF stands for “Worse than failure”, allegedly
The Register – IT news site willing to “Bite the hand that feeds IT”, includes a developer section. Disclaimer: I am a contributor.
TheServerSide which has mainly Java but also a .NET site, both geared to enterprise development. Seems less busy of late.
Other developer haunts I considered:
DaniWeb – IT discussion community with an active software development forum
DeveloperFusion – based in the UK, developer-focused articles, blogs and resources
Dr Dobbs – web site for the best software development magazine, docked several points for ad videos that auto-play when you visit
Rick Strahl’s web log – where you go to discover what really works or does not work in ASP.NET
SDTimes – web site for a family of Software development magazines, some good articles but not really a community
Update: Other sites I probably should have included:
InfoQ – developer-focused articles, Agile/Enterprise focus, sponsor the excellent QCon conferences