Category Archives: software development

database, microsoft, software development, vista, web authoring, windows

WinFS reborn: SQL Server as a file system

Fascinating interview with Quentin Clark, who led the cancelled WinFS project at Microsoft. Jon Udell is the interviewer.

Clark talks about how technology from WinFS is now emerging as the Entity Framework in ADO.NET (part of .NET 3.5 SP1) and the FileStream column type in SQL Server 2008 – a connection I’d already made at the Barcelona TechEd last year. He also mentions the new HierarchyID column type that enables fast querying of paths, the concept of rows which contain other rows. He adds that a future version of SQL Server will support the Win32 API so that it can support a file system:

In the next release we anticipate putting those two things together, the filesystem piece and the hierarchical ID piece, into a supported namespace. So you’ll be able to type //machinename/sharename, up pops an Explorer window, drag and drop a file into it, go back to the database, type SELECT *, and suddenly a record appears.

Put that together with the work Microsoft is doing on synchronization, and you get offline capability too – something more robust than offline files in Vista. Clark says SharePoint will also benefit from SQL Server’s file system features.

Note that Live Mesh does some of this too. I guess SQL Server is there in the Live Mesh back end, but it strikes me Microsoft is at risk of developing too many ways to do the same thing.

The piece of WinFS that shows no sign of returning is the shared data platform, which was meant to enable applications to share data:

… all that stuff is gone. The schemas, and a layer that we internally referred to as base, which was about the enforcement of the schemas, all that stuff we’ve put on the shelf. Because we didn’t need it.

.net, internet, php, software development, web authoring

Cenzic web app report highlights security problems

Will we ever get a secure Internet? There’s no cause for optimism in the latest Cenzic report into web app security. A few highlights:

  • 7 out of 10 Web applications analyzed by Cenzic were found vulnerable to Cross-Site Scripting attacks
  • 70% of Internet vulnerabilities are in web applications
  • FireFox has the most reported browser vulnerabilities at 40%; IE is 23%
  • Weak session management, SQL Injection, and poor authentication remain very common problems
  • 33% of all reported vulnerabilities are caused by insecure PHP coding, compared to 1% caused by insecurities in PHP itself.

OK, it’s another report from a security company with an interest in hyping the figures; but I found this one more plausible than some.

The PHP remarks are interesting; it would be good to see equivalent figures for ASP.NET and Java.

internet, security, software, software development

My high risk blog reader

I posted yesterday about the report from PC Tools saying that Vista is more prone to malware than Windows 2000.

The company kindly sent me its press release on the subject and is promising more information. According to the release, the figures are based on a tool called ThreatFire, available in free and commercial editions, which by default reports threats discovered back to PC Tools for analysis and statistics. ThreatFire is a behavioural tool; that is, it does not rely on signatures of known malware, but detects suspicious behaviour.

I thought I should try this tool on my own machine. I probably count as a high-risk user, since I frequently browse the web and download and run software, sometimes unsigned software. Would ThreatFire find any malware?

It did not take long:

The application is my own custom blog reader, a simple .NET app which calls the common feed list API and renders blog posts in the WebBrowser control.

Looks like a false positive to me. Still, I poked around in the dialog. The risk level is supposedly high. The Technical Details link does not tell you any more about what the app did that was suspicious, but identifies the files I can choose to quarantine. The link that says “Learn more about this threat” does a Google search on the file name.

By the way, doing a random web search on what is potentially malware strikes me as poor practice. Here’s what online help says:

Click the Learn more about this threat link to launch a quick web search on the threat.  In most cases the result of this search provides a clear indication of how to proceed.

Ever tried searching for the name of an executable or process? The bad guys and the scammers know we do this; and you will be offered all manner of “security” products some of which are likely spyware or malware themselves. A foolish thing to encourage. Further, how will a random web search provide “a clear indication of how to proceed”? It’s the wild web, no more, no less.

My blog reader is not very famous, so in this case Google found nothing. I’m puzzled that ThreatFire doesn’t tell you more about the supposedly malicious activity, like what data was sent and where, so that the user would have more chance of judging whether this is really a dangerous app.

I guess the “threat” is now in the PC Tools database, and my machine marked as Vista with malware. I’ll be interested to see what else it finds.

Technorati tags: , ,
apple, microsoft, software development

Visual Basic returning to Mac Office

Microsoft will restore VBA to Mac Office:

The Mac BU [Business Unit] announced it is bringing VBA-language support back to the next version of Office for Mac. Sharing information with customers as early as possible continues to be a priority for the Mac BU to allow customers to plan for their software needs. Although the Mac BU increased support in Office 2008 with alternate scripting tools such as Automator and AppleScript — and also worked with MacTech Magazine to create a reference guide, available at http://www.mactech.com/vba-transition-guide — the team recognizes that VBA-language support is important to a select group of customers who rely on sharing macros across platforms. The Mac BU is always working to meet customers’ needs and already is hard at work on the next version of Office for Mac.

There’s a couple of ways to take announcements like this. The positive: the company is listening. The negative: what was it thinking when it cut the feature?

By the time Mac Office vNext is out of the door, I imagine many potential VBA users will have found other solutions.

The other point of interest: while Microsoft’s Mac BU is benefiting from Apple’s strength, I doubt that is enough to compensate for the lost Windows sales which are also implied.

borland, codegear, delphi, software development

Codegear sold to Embarcadero

2 Comments

CodeGear, Borland’s developer tools business, is to be acquired by Embarcadero; though to be more precise, CodeGear is being acquired by the owner of Embarcedero, a private equity company called Thoma Cressey Bravo.

Embarcadero has a range of database and data modeling products, including ER/Studio, EA/Studio, RapidSQL, PowerSQL and DBArtisan.

This is the end of a long road – CodeGear was put up for sale in 2006.

Good news? Insofar as it ends a long period of uncertainty, yes. On the other hand, I sense that many of CodeGear’s customers have valued its renewed focus on software development, as opposed to application lifecycle management, modeling, change management and all those other enterprisey things. Embarcadero just might take it back in that direction. From the press release:

Customers and partners will benefit from Embarcadero’s ability to help fully integrate their application development lifecycle, automate error-prone tasks and dramatically increase their productivity.

Talk of “dramatically increased productivity” is bound to strike fear into the hearts of those who like their dev tools mean and lean.

The problem from a business perspective is that enterprise sales are where the money is, and plain old IDEs and compilers are thoroughly commodotized. Eclipse, NetBeans, Visual Studio Express…

That said, CodeGear still has some interesting products, and increased resources for things like quality control and documentation would do them no harm at all.

 

gaming, silverlight, software, software development, web authoring

Popfly Game Creator – programming online with Silverlight

This looks great: Popfly Game Creator.

Interesting on several counts.

First, casual gaming will help get Silverlight runtimes deployed.

Second, it’s Microsoft doing one of the things it does well: opening up programming to a new group. Another example: Microsoft promotes its XNA gaming framework to universities, where it helps them to entice new students into computer science.

Third, it’s from Adam Nathan, author of the definitive work on .NET interop, .NET and COM. Popfly gaming must be welcome light relief (though I don’t mean to imply that this stuff is easy to do).

Fourth, is online programming – I mean, programming that you actually do online – coming of age?

Technorati tags: , , , ,
java, open source, software development

Sun’s bad quarter

I was interested to see Sun’s financial results after visiting the company earlier this year.

Not too good:

Revenues for the third quarter of fiscal 2008 were $3.266 billion, a decrease of 0.5 percent as compared with $3.283 billion for the third quarter of fiscal 2007 … Net loss for the third quarter of fiscal 2008 on a GAAP basis was $34 million, or ($0.04) per share, as compared with net income of $67 million, or $0.07 per share, for the third quarter of fiscal 2007.

When I visited we were told that rising income from developing nations would compensate for weakness in the USA, but apparently this is not the case. Although income from the likes of India and Brazil is rising, it is not enough to make up the difference. Another question: why is Sun under-performing relative to other companies such as IBM and Intel, both of which reported strong first quarters last month?

Sun is also set to cut 1,500 to 2,000 jobs, which suggests that the company does not expect demand to pick up soon.

The issue to me is whether Sun can make sense of its commitment to open source, or whether the proprietary guys are showing where the money really is. The MySQL purchase was great PR, but doubtful business sense.

Technorati tags: , , , ,
.net, google, microsoft, silverlight, software development, web authoring, windows

Live Mesh: Hailstorm take 2?

2 Comments

So says Spolsky, in a rant about both unwanted mega-architectures, and the way big companies snaffle up all the best coders.

Is he right? Well, I attended the Hailstorm PDC in 2001 and I still have the book that we were given: .NET My Services specification. There are definitely parallels, not least in the marketing pitch (from page 3):

.NET My Services will enable the end user to gain access to key information and receive alerts about important events anywhere, on any device, at any time. This technology will put users in total control of their data and make them more productive.

Swap “.NET My Services” for “Live Mesh” and you wouldn’t know the difference.

But is it really the same? Spolsky deliberately intermingles several points in his piece. He says it is the same stuff reheated. One implication is that because Hailstorm failed, Live Mesh will fail. Another point is that Live Mesh is based on synchronization, which he says is not a killer feature. A third point is that the thing is too large and overbearing; it is not based on what anyone wants.

Before going further, I think we should ask ourselves why Hailstorm failed. Let’s look at what some of the people involved think. We should look at this post by Mark Lucovsky, chief software architect for Hailstorm and now at Google, who says:

I believe that there are systems out there today that are based in large part on a similar set of core concepts. My feeling is that the various RSS/Atom based systems share these core concepts and are therefore very similar, and more importantly, that a vibrant, open and accessible, developer friendly eco-system is forming around these systems.

Joshua Allen, an engineer still at Microsoft, disagrees:

All of these technologies predate Hailstorm by a long shot.  There is a reason they succeeded where Hailstorm failed.  It’s because Hailstorm failed to adopt their essence; not because they adopted Hailstorm’s essence …. the “principles” Mark’s blog post cites are actually principles of the technologies Hailstorm aimed to replace.

but as Allen shows in the latter part of his post, the technology was incidental to the main reasons Hailstorm failed:

  1. Hailstorm intended to be a complete, comprehensive set of APIs and services ala Win32.  Everything — state management, identity, payments, provisioning, transactions — was to be handled by Hailstorm.
  2. Hailstorm was to be based on proprietary, patented schemas developed by a single entity (Microsoft).
  3. All your data belonged to Microsoft.  ISVs could build on top of the platform (after jumping through all sorts of licensing hoops), but we controlled all the access.  If we want to charge for alerts, we charge for alerts.  If we want to charge a fee for payment clearing, we charge a fee.  Once an ISV wrote on top of Hailstorm, they were locked in to our platform.  Unless we licensed a third party to implement the platform as well, kind of like if we licensed Apple to implement Win32.

Hailstorm’s technology was SOAP plus Passport authentication. There were some technical issues. I recall that Passport in those days was suspect. Some smart people worked out that it was not as secure as it should be, and there was a general feeling that it was OK for logging into Hotmail but not something you would want to use for online banking. As for SOAP, it gets a bad rap these days but it can work. That said, these problems were merely incidental compared to the political aspect. Hailstorm failed for lack of industry partners and public trust.

Right, so is Live Mesh any different? It could be. Let me quickly lay out a few differences.

  1. Live Mesh is built on XML feeds, not SOAP messaging. I think that is a better place to start.
  2. Synchronization is a big feature of Mesh, that wasn’t in Hailstorm. I don’t agree with Spolsky; I think this is a killer feature, if it works right.
  3. Live Mesh is an application platform, whereas Hailstorm was not. Mesh plus Silverlight strikes me as appealing.

Still, even if the technology is better, what about the trust aspect? Will Mesh fail for the same reasons?

It is too soon to say. We do not yet know the whole story. In principle, it could be different. Mesh is currently Passport (now Live ID) only. Will it be easy to use alternative authentication providers? If the company listens to its own Kim Cameron, you would think so.

Currently Mesh cloud data resides only on Microsoft’s servers, though it can also apparently do peer-to-peer synch. Will we be able to run Mesh entirely from our own servers? That is not yet known. What about one user having multiple meshs, say one for work, one personal, and one for some other role? Again, I’m not sure if this is possible. If there is only One True Mesh and it lives on Live.com, then some Hailstorm spectres will rise again.

Finally, the world has changed in the last 7 years. Google is feared today in the way that Microsoft was feared in 2001: the entity that wants to have all our information. But Google has softened us up to be more accepting of something like Live Mesh or even Hailstorm. Google already has our search history, perhaps our email, perhaps our online documents, perhaps an index of our local documents. Google already runs on many desktops; Google Checkout has our credit card details. What boundary can Live Mesh cross, that Google has not already crossed?

Hailstorm revisited is an easy jibe, but I’m keeping an open mind.

microsoft, software development, windows

What is Microsoft’s new language?

From Douglas Purdy’s blog:

It is not very often that you get to be part of a team that is developing a programming language that aspires to be used by every developer on the Microsoft platform.

In addition, it is not very often that you can be part of a team that aspires to radically change the dynamics of building a new language, to the extent that a developer can write their own model-driven language in a straightforward way while getting all the language services (Intellisense, colorization, etc.) for “free”.

I am lucky enough to be on such a team – and if you are interested you could be as well.

Something to do with Oslo I guess. And Live Mesh?

All will be revealed at PDC.

Technorati tags: , , , ,