Category Archives: software development

internet, software, software development, web authoring

Escaping the Adobe AIR sandbox

2 Comments

Adobe’s Mike Chambers has an article and sample code for calling native operating system APIs from AIR applications, which use the Flash runtime outside the browser.

I took a look at the native side of the code, which is written in C# and compiled smoothly in Visual Studio 2008. The concept is simple. Instead of launching an AIR application directly, you start the “Command Proxy” application. The Command Proxy launches the AIR application, passing a port number and optionally an authorization string. Next, the Command Proxy creates a TCP socket which listens on the specified port. The AIR application can then use its socket API to send commands to the Command Proxy, which is outside the AIR sandbox.

It’s a neat idea though Microsoft’s Scott Barnes gave the design a C- on security grounds. He clarified his point thus:

The communication channel between the command proxy and AIR application looks like a potential vulnerability. One of the things application developers should worry about with security is insecure cross-process communication mechanisms hanging around on someone’s machine. For example if a process listens on a named pipe, and that named pipe has no ACLs and no validation of inbound communication, the process is vulnerable to all kinds of attacks when garbage is sent down the pipe. In the example on using the command proxy how do you secure it so that it doesn’t turn into a general purpose process launcher?

Barnes has an obvious incentive to cast doubt on AIR solutions (he’s a Microsoft RIA Silverlight evangelist), but nevertheless this is a good debate to have. How difficult is it to do this in a secure manner? It is also interesting to note the opening remarks in Chambers’ post:

Two of the most requested features for Adobe AIR have been the ability to launch native executables from an AIR application, and the ability to integrate native libraries into an AIR application. Unfortunately, neither feature will be included in Adobe AIR 1.0.

This is really one feature: access to native code. I remain somewhat perplexed by AIR in this respect. Is the inability to call native code a security feature, or a way of promoting cross-platform purity, or simply a feature on the to-do list? I don’t think it is really a security feature, since AIR applications have the same access to the file system as the user. This means they can execute native code, just not immediately. For example, an AIR app could download an executable and pop it into the user’s startup folder on Windows. That being the case, why not follow Java’s lead and provide a clean mechanism for calling native code? Adobe could add the usual obligatory warnings about how this breaks cross-platform compatibility and so on.

internet, microsoft, software, software development, web authoring

Sun gets a database manager, but Oracle owns its InnoDB engine

3 Comments

Sun now has a database manager. It’s been a long time coming. Oracle has … Oracle, IBM has DB2, Microsoft has SQL Server; it’s been obvious for years that Sun had a gap to fill. Now Sun has MySQL.

This is interesting to me as I was a relatively early user of the product. I didn’t much like it. It was missing important features like transactions, stored procedures and triggers. I still used it though because of a few appealing characteristics:

  • It was free
  • It was very fast
  • It was lightweight
  • It was the M in LAMP

I should expand slightly on the last of these. The great thing about MySQL was that you did not need to think about installation, PHP drivers, or anything like that. It all came pretty much by default. If you decided that you could not bear MySQL’s limitations, you could use Postgres instead, but it was more effort and less quick.

The ascent of MySQL is a sort of software development parable. Like PHP, MySQL came about from one person’s desire to fix a problem. That person was Michael “Monty” Widenius. He wanted something a little better than mSQL, a popular small database engine at the time:

We once started off with the intention to use mSQL to connect to our own fast low level (ISAM) tables. However, after some testing we came to the conclusion that mSQL was not fast or flexible enough for our needs. This resulted in a new SQL interface to our database but with almost the same API interface as mSQL. This API was chosen to ease porting of third-party code.

Why did MySQL take off when there were better database engines already out there? It was partly to do with the nature of many LAMP applications in the early days. They were often not mission-critical (mine certainly were not), and they were typically weighted towards reading rather than writing data. If you are building a web site, you want pages served as quickly as possible. MySQL did that, and without consuming too many resources. Many database engines were better, but not many were faster.

MySQL today has grown up in many ways, though transactions are still an issue. To use them you need to use an alternate back-end storage engine, either InnoDB or BDB. BDB is deprecated, and InnoDB is included by default in current releases of MySQL. InnoDB is owned by Oracle, which could prove interesting given how this deal changes the dynamics of Sun’s relationship with Oracle, though both MySQL and InnoDB are open source and published under the GPL. Will Sun try to find an alternative to InnoDB?

While I agree with most commentators that this is a good move for Sun, it’s worth noting that MySQL was not originally designed to meet Enterprise needs, which is where most of the money is.

Update: as Barry Carr comments below, there is a planned replacement for InnoDB called Falcon.

microsoft, open source, software development

How to debug into .NET Framework source code

Shawn Burke has posted the steps needed to step through the .NET Framework source when debugging your application.

Good news for a couple of reasons. The first is the most obvious: if you are getting surprising or perplexing behaviour, you now have a better chance of working out why.

Second, and perhaps more important, this makes it easier to submit bug reports or feature requests to Microsoft along the lines of “why does your code do this when it could or should do that“?

All going well, this should improve quality. For example, the .NET Framework library code is huge, and I’ve heard it muttered that there is considerable duplication within it. Separate teams working on different parts of the library may solve the same problem with different code, causing bloat and possibly inconsistency. Opening up the library to public scrutiny makes it more likely that issues like this will get fixed.

Daniel Moth has a screencast.

microsoft, software, software development, windows

SharePoint’s secret sauce

3 Comments

Just before Christmas I spoke to Daz Wilkin, Microsoft Developer Platform Evangelist, about Office development and Sharepoint. I’ve wanted to catch up on Sharepoint for some time, since it is achieving significant usage. Here’s a recent study which claims that:

the number of SharePoint applications in place today will quadruple over the next 12 months

Wilkin says that:

SharePoint is approaching becoming a billion dollar business for Microsoft. It’s vastly exceeded all of our estimates.

I suspect that journalists, myself included, have given Sharepoint insufficient attention. One reason is that it is a slippery product to describe and seems to straddle several categories, such as portal server, smart file store, and workflow platform. “I don’t think Microsoft has done a bang-up job in being able to articulate it. It is many things to many people,” says Wilkin.

Another problem is the confusion over SharePoint Portal Server (paid for) and SharePoint Services (free add-on for Windows server). You can find a point-by-point comparison here. The free SharePoint Services, on which Portal Server is built, are surprisingly rich. Once you have them installed, which can be a little painful, you get instant wikis and blogs, shared documents with versioning, permissions, and the ability to open and save directly from Office applications, shared calendars and tasks, and online forums. Here’s the settings panel for a shared document store:

Site options including content approval,versioning,permissions and check out 

It’s a shame that document versioning is off by default, but there is plenty of value in these features. Note we are mainly talking intranet rather than internet, though hosting SharePoint is a growing industry and it is also core to Microsoft’s own hosted service efforts.

Why is installation painful? Well, you need Windows Server, and if you want to use ASP.NET for something other than SharePoint on the same box, it needs a bit of tweaking. For example, if you run Exchange and install SharePoint Services, it breaks Outlook Web Access. On my server I got round this by adding a second host name in local DNS, pointing to the same machine, and using this for the SharePoint site using IIS host headers. Real-world businesses either install SharePoint on a separate server, or have Small Business Server which builds it in, so this is mainly an issue for journalists and the like. Perhaps this is a small factor in why SharePoint gets less coverage than it should; it is not something we can just pick up and use like Office itself.

So why is SharePoint taking off? According to Wilkin, it is about “group productivity”. He talks about how SharePoint deals with the classic document review process. Emailing documents around a company and getting numerous edited versions back is a hassle. Apparently Microsoft itself is now using SharePoint more intensively, and users just check-out a document, make changes, and check it back in. He adds,

…If you then combine that with the ease with which you can check that document into a workflow, and then have it automatically routed around the organization, and then very naturally combine that with data going in and out of backend systems whatever they are, that to me is the magic. Customers tend to get the value more quickly than some of the ISVs.

Visual Studio 2008 has support for SharePoint projects and this is something I plan to write about soon. If anyone has been doing SharePoint and/or Workflow Foundation development, I’d be interested to know how you found it.

software, software development

When good software goes bad

Verity Stob looks at feature bloat and a few other things in her piece on apps that have gotten worse over the years.

Confession: I use Paint Shop Pro too, although I have Photoshop installed as part of Adobe’s Web Premium CS3. In my case it is PSP version 5.0. PSP starts in a blink and has dead easy tools. Photoshop takes several seconds to start up and displays messages like “Initializing palettes” while it is getting going. There is nothing wrong with Photoshop, but equally if I just need to crop a screenshot quickly, I find myself using PSP and saving a few seconds.

Stob’s piece is light-hearted and unfair (I like C#) but a fun read.

I remember meeting a programmer back in the days of DOS and strict memory limits. He told me that every time he added a new feature, he had to find some other code he could remove in order to fit it in. A nightmare of course; but it prevented bloat.

It’s one of the reasons I like the Asus Eee PC. It is underpowered by many standards, but small, light, starts from cold in less than 30 seconds, and works fine for most everyday tasks.

Just another take on less is more.

microsoft, software development

Visual Studio 2008 review, and the WPF business apps debate

12 Comments

Review just posted on RegDeveloper.

In it I quote Peter Lindsey of component vendor Infragistics, who says that:

Microsoft, in trying to capture credibility within the media market, has poorly represented the value of WPF to business application developers.

The problem is that Microsoft decided to tell its customers not to use WPF (Windows Presentation Foundation) for line-of-business applications, which is a strange way to launch your next-generation GUI API, and tough on vendors such as Infragistics who have been busy providing business-oriented components like xamDataGrid.

Not everyone agrees that WPF is a no-hoper for business apps. See this post from software architect Ivan Towlson:

For me, the killer application of WPF is not bouncing buttons with dancing elves trapped inside them.  The killer application is information visualisation, the kind of things you get from Tufte and the periodic table.  And that’s something that even forms-style, line-of-business applications will find worthwhile.

When Microsoft introduced .NET it made great efforts to get VB 6 developers to upgrade and migrate their projects, even though there were sound technical reasons for caution. Why is it that with WPF those reasons for caution, valid though they are, have been allowed to dominate the messaging to the extent that most developers probably have the impression that WPF is irrelevant?

Curious.

amazon, internet, software development, web authoring

Amazon SimpleDB: a database server for the internet

1 Comment

Amazon has announced SimpleDB, the latest addition to what is becoming an extensive suite of web services aimed at developers. It is now in beta.

Why bother with SimpleDB, when seemingly every web server on the planet already has access to a free instance of MySQL? Perhaps the main reason is scalability. If demand spikes, Amazon handles the load. Second, SimpleDB is universally accessible, whereas your MySQL may well be configured for local access on the web server only. If you want an online database to use from a desktop application, this could be suitable. It should work well with Adobe AIR once someone figures out an ActionScript library. That said, MySQL and the like work fine for most web applications, this blog being one example. SimpleDB meets different needs.

This is utility computing, and prices look relatively modest to me, though you pay for three separate things:

Machine Utilization – $0.14 per Amazon SimpleDB Machine Hour consumed.

Data Transfer – $0.10 per GB – all data transfer in. From $0.18 per GB – data transfer out.

Structured Data Storage – $1.50 per GB-month.

In other words, a processing time fee, a data transfer fee, and a data storage fee. That’s reasonable, since each of these incurs a cost. The great thing about Amazon’s services is that there are no minimum costs or standing fees. I get billed pennies for my own usage of Amazon S3, which is for online backup.

There are both REST and SOAP APIs and there are example libraries for Java, Perl, PHP, C#, VB.NET (what, no Javascript or Python?).

Not relational

Unlike MySQL, Oracle, DB2 or SQL Server, SimpleDB is not a relational database server. It is based on the concept of items and attributes. Two things distinguish it from most relational database managers:

1. Attributes can have more than one value.

2. Each item can have different attributes.

While this may sound disorganized, it actually maps well to the real world. One of the use cases Amazon seems to have in mind is stock for an online store. Maybe every item has a price and a quantity. Garments have a Size attribute, but CDs do not. The Category attribute could have multiple values, for example Clothing and Gifts.

You can do such things relationally, but it requires multiple tables. Some relational database managers do support multiple values for a field (FileMaker for example), but it is not SQL-friendly.

This kind of semi-structured database is user-friendly for developers. You don’t have to plan a schema in advance. Just start adding items.

A disadvantage is that it is inherently undisciplined. There is nothing to stop you having an attribute called Color, another called Hue, and another called Shade, but it will probably complicate your queries later if you do.

All SimpleDB attribute values are strings. That highlights another disadvantage of SimpleDB – no server-side validation. If a glitch in your system gives an item a Price of “Red”, SimpleDB will happily store the value.

Not transactional or consistent

SimpleDB has a feature called “Eventual Consistency”. It is described thus:

Amazon SimpleDB keeps multiple copies of each domain. When data is written or updated (using PutAttributes, DeleteAttributes, CreateDomain or DeleteDomain) and Success is returned, all copies of the data updated. However, it takes time for the update to propogate to all storage locations. The data will eventually be consistent, but an immediate read might not show the change.

Right, so if you have one item in stock you might sell it twice to two different customers (though the docs say consistency is usually achieved in seconds). There is also no concept of transactions as far as I can see. This is where you want a sequence of actions to succeed or fail as a block. Well, it is called SimpleDB.

This doesn’t make SimpleDB useless. It does limit the number of applications for which it is suitable. In most web applications, read operations are more common than write operations. SimpleDB is fine for reading. Just don’t expect your online bank to be adopting SimpleDB any time soon.

internet, microsoft, software development

Microsoft Volta: magic, but is it useful magic?

2 Comments

Microsoft has released an experimental preview of Volta, a new development product with some unusual characteristics:

1. You write your application for a single machine, then split it into multiple tiers with a few declarations:

Volta automatically creates communication, serialization, and remoting code. Developers simply write custom attributes on classes or methods to tell Volta the tier on which to run them.

2. Volta seamlessly translates .NET byte code (MSIL) to Javascript, on an as-needed basis, to achieve cross-platform capability:

When no version of the CLR is available on the client, Volta may translate MSIL into semantically-equivalent Javascript code that can be executed in the browser. In effect, Volta offers a best-effort experience in the browser without any changes to the application.

The reasoning behind this is that single-machine applications are easier to write. Therefore, if the compiler can handle the tough job of distributing an application over multiple tiers, it makes the developer’s job easier. Further, if you can move processing between tiers with just a few declarations, then you can easily explore different scenarios.

Since the input to Volta is MSIL, you can work in Visual Studio using any .NET language.

Visionary breakthrough, or madness? Personally I’m sceptical, though I have had a head start, since this sounds very like what I discussed with Eric Meijer earlier this year, when it was called LINQ 2.0:

Meijer’s idea is programmers should be able to code for the easiest case, which is an application running directly on the client, and be able to transmute it into a cross-platform, multi-tier application with very little change to the code.

What are my reservations? It seems hit-and-miss, not knowing whether your app will be executed by the CLR or as Javascript; while leaving it to a compiler to decide how to make an application multi-tier, bearing in mind issues like state management and optimising data flow, sounds like a recipe for inefficiency and strange bugs.

It seems Microsoft is not sure about it either:

Volta is an experiment that enables Microsoft to explore new ways of developing distributed applications and to continue to innovate in this new generation of software+services. It is not currently a goal to fit Volta into a larger product roadmap. Instead, we want feedback from the community of partners and customers to influence other Live Labs technologies and concepts.

borland, codegear, software development

CodeRage sessions available for download

1 Comment

You can now download the content from last week’s CodeRage, the virtual developer conference laid on by CodeGear. The downloads use Camtasia and Flash and work well.

A few that I recommend are Ravi Kumar’s session on JBuilder Application Factories from Day 5, and Joe McGlynn on 3rd Rail, an IDE for Ruby on Rails, from Day 3. For Delphi futures (64-bit, generics, concurrent programming, hints about cross-compilation to other operating systems) check out Nick Hodges’ session on Day 1. I’ve not viewed everything, so there are no doubt other excellent sessions.

Nevertheless, I have mixed feelings about this CodeRage. The keynotes were weak, with too much high level waffle about how CodeGear is committed to developers etc etc. The conferencing software was no more than adequate, did not work properly for me on Vista, and did not support Mac or Linux. That may explain why attendee numbers in some sessions were embarrassingly small.

I am struggling to make sense of this. CodeGear claims to have 7.5 million registered users; yet only 2100 registered to attend the free CodeRage, and some of those no doubt never turned up. If that is representative of the level of interest in new CodeGear products, as opposed to legacy users, then that is a worrying sign.