Tag Archives: .net

Decompiling Silverlight

A Silverlight application is a .NET application. Most developers will be aware of this; but it is worth noting that whereas ASP.NET code executes on the server and is not normally available for download, Silverlight code is downloaded to the client and can easily be decompiled. It is almost as easy to view as JavaScript code in the browser.

If you want to investigate this, the first thing to do is to find the .xap file which contains the Silverlight application. You will likely find this in your browser cache, or you can download it directly from the web site hosting the application. If you have out-of-browser Silverlight apps, they are usually located at:

C:\Users\[username]\AppData\LocalLow\Microsoft\Silverlight\OutOfBrowser

Copy the .xap file somewhere convenient, and rename it to have a .zip extension. Then extract the files. The result looks something like this:

image

Next, you need a .NET decompiler such as Redgate .NET Reflector. Run Reflector and open a .dll file containing application code. Select a method, and Reflector does its best to show you the code. It does a good job too:

image

The purpose of this post is not to encourage decompiling other people’s code, but rather to make the point that even though Silverlight code is “compiled”, it is trivial to read it – just in case anyone thought it was a bright idea to store passwords or other authentication secrets there.

The solution is to never to put anything security-critical in client-side code. Second, you can use an obsfuscator such as dotfuscator to make the decompiled code harder to read.

Where is phpinfo() for .NET?

I’m moving an ASP.NET project to a different ISP, and rather than grill the ISP about the setup I cast around for a .NET equivalent to phpinfo(), which generates a web page giving comprehensive information about the server configuration.

The closest I’ve found so far is this Codeplex project by Aarron K Jackson. I downloaded the source, compiled (I had to delete the private key included by the author) and ran it on the new server. It did in fact answer most of my questions. Information includes the Windows and .NET version, number of CPU cores, memory available and used, environmental variables, path to the web site, IIS version, trust level, and all the server variables; there is even a test email form.

image

According to Codeplex the project has fewer than 100 downloads so I thought it deserved a plug. One caveat: I suggest you password-protect it or delete after use, since the information could be valuable to hackers.

Ten years of Microsoft .NET – but what about the next ten?

Technology products have many birthdays – do you count from first announcement, or release to manufacturing, or general availability? Still, this week is a significant one for Microsoft .NET and the C# language, which was first unveiled to the world in detail at Tech-Ed Europe on July 7th, 2000. The timing was odd; July 7th was the last day of Tech-Ed, whereas news at such events is normally reserved to the first day or two – but the reason was to preview the announcement at the Professional Developers Conference in Orlando the following week. It was one of the few occasions when Europe got the exclusive, though as I recall most of the journalists had already gone home.

It is interesting to look back, and I wrote a piece for The Register on .NET hits and misses. However you spin it, it’s fair to say that the .NET platform has proved to be one of Microsoft’s better initiatives, and has delivered on at least some of its goals.

It is even more interesting to look forward. Will we still be using .NET in 2020?

There is no sign of Microsoft announcing a replacement for .NET; and little sign of .NET catching on in a big way outside the Microsoft platform, so in part the question is about how the company will fare over the coming decade. Still, it is worth noting that the role of the .NET framework  in that platform still seems to be increasing.

Most predictions are wrong; but the general trend right now is towards the cloud+device computing model. The proposition is that both applications and data belong in the cloud, whether public, private or hybrid. Further, it seems plausible that we will fall out of love with personal computers, with all their complexity and vulnerability to malware, and embrace devices that just work, where the operating system is locked down, data is just a synchronised local cache, and applications are lightweight clients for internet services. Smartphones are already like this, but by the end of this year when Apple’s iPad has been joined by other slates and small computers running Google Android, Google ChromeOS, Intel/Nokia MeeGo and HP WebOS, it may be obvious that traditional laptop and desktop computers will decline.

It turns out that the .NET Framework is well suited to this model, so much so that Microsoft has made it the development platform for Windows Phone 7. Why stop at Windows Phone 7 – what about larger devices that run only .NET applications, sandboxed from the underlying operating system and updated automatically over the Internet? Microsoft cannot do that for Windows as we know it, because we demand compatibility with existing applications, but it could extend the Windows Phone 7 OS and application model to a wider range of devices that take over some of the tasks for which we currently use a laptop.

In theory then, with Azure in the cloud and Silverlight on devices, the next ten years could be good ones for the .NET Framework.

That said, it is also easy to build the case against. Microsoft has it all to do with Windows Phone 7; the market is happily focused on Apple and Google Android devices at the high end. Microsoft’s hardware partners are showing signs of disloyalty, after years of disappointment with Windows Mobile, and HP has acquired Palm. If Windows Phone 7 fails to capture much of the market, as it may well do, then mobile .NET will likely fail with it. Put this together with a decline in traditional Windows machines, and the attraction of .NET as a cloud-to-client framework will diminish.

Although developer platform VP Scott Guthrie, C# architect Anders Hejlsberg and others are doing an excellent job of evolving the .NET framework, it is the success or failure of the wider Microsoft platform that will determine its future.

Big browser and RIA news: Canvas comes to Internet Explorer 9

I’ve just installed the third Internet Explorer Platform Preview (on a virtual machine just in case) and run through a few of the demos. One of the most impressive is Canvas Pad, which demonstrates the HTML 5 Canvas element.

image

Canvas is particularly interesting, since it provides a surface to which you can draw anything you like. Canvas support was not announced at Mix earlier this year, when IE9 was unveiled, and some of us speculated that Microsoft would omit it in order to preserve the value of its Silverlight plugin – though in doing so it would also help Adobe Flash. Well, apparently the IE9 team decided to risk it. Not only is canvas supported; it is also hardware-accelerated:

Like all of the graphics in IE9, canvas is hardware accelerated through Windows and the GPU. Hardware accelerated canvas support in IE9 illustrates the power of native HTML5 in a browser.

Is there still value in Silverlight and Flash? There is, for several reasons. A plug-in presents a predictable runtime, insulating the application from browser variations. A plugin will work on browsers that do not yet support Canvas. Further, Silverlight includes the .NET Framework with its rich library, and supports the .NET languages, whereas for HTML5 you have to use JavaScript – though don’t forget Google Web Toolkit, which compiles Java to JavaScript, and other similar projects.

Even so, once you have hardware-accelerated Canvas there will be few occasions when you absolutely have to use Flash, Silverlight or Java.

Microsoft is doing the right thing. Crippling IE for the sake of Silverlight would only push users to other browsers, so it would not achieve its goal.

A full list of what is new in IE9 is here. It is shaping up to be the most interesting new IE since version 4.0 back in 1997.

Java versus C/C++ performance – which is really faster?

Cliff Click of Azul Systems has an excellent post on Java vs C/C++ performance:

Is Java faster than C/C++?  The short answer is: it depends.

He then presents three categories of cases: the first C/C++ beats Java, the second where Java beats C/C++, and the third and longest, where C/C++ proponents claim Java is slower but in reality it is not.

My quick summary: there are few cases where Java (or C#) is so much slower that it matters, save for one big issue which Click mentions early on – start-up time:

Flash games beat Java games mostly because it took 30+sec to load the JVM from disk… and so now the web-game developer community has settled on Flash as the standard (and it still takes 10+sec to load the JVM).

Start-up time makes a big difference to usability, for reasons which I cannot entirely explain. Just for fun, I’ve been running Microsoft Office 95 in a virtual instance of Windows XP recently, and the fact that Word 95 loads in a blink makes it feel much faster than Word 2010, which takes 5-10 seconds on first load, even though the productivity difference must be negligible.

If I had to theorise about this, I’d say it is to do with the way humans learn from experience. We don’t like waiting, and if an application take a while to start then part of our brain tells us to avoid it in future. We override that instinct when it is an app we need to run, but it contributes to a negative impression.

The opposite is also true. If an application starts instantly – I mean to the point where we can use it, not just a splash screen – it contributes to a positive impression and we are more inclined to use it in future.

Incidentally, Click thinks that Java is generally faster than C#, though he adds that he is “not able to give C# a fair treatment” because he does not track it closely.

QCon London 2010 report: fix your code, adopt simplicity, cool .NET things

I’m just back from QCon London, a software development conference with an agile flavour that I enjoy because it is not vendor-specific. Conferences like this are energising; they make you re-examine what you are doing and may kick you into a better place. Here’s what I noticed this year.

Robert C Martin from Object Mentor gave the opening keynote, on software craftsmanship. His point is that code should not just work; it should be good. He is delightfully opinionated. Certification, he says, provides value only to certification bodies. If you want to know whether someone has the skills you want, talk to them.

Martin also came up with a bunch of tips for how to write good code, things like not having more than two arguments to a function and never a boolean. I’ve written these up elsewhere.

image

Next I looked into the non-relational database track and heard Geir Magnusson explain why he needed Project Voldemort, a distributed key-value storage system, to get his ecommerce site to scale. Non-relational or NOSQL is a big theme these days; database managers like CouchDB and MongoDB are getting a lot of attention. I would like to have spent more time on this track; but there was too much else on; a problem with QCon.

I therefore headed for the functional programming track, where Don Syme from Microsoft Research gave an inspiring talk on F#, Microsoft’s new functional language. He has a series of hilarious slides showing F# code alongside its equivalent in C#. Here is an example:

image

The white panel is the F# code; the rest of the slide is C#.

Seeing a slide that this makes you wonder why we use C# at all, though of course Syme has chosen tasks like asychronous IO and concurrent programming for which F# is well suited. Syme also observed that F# is ideal for working with immutable data, which is common in internet programming. I grabbed a copy of Programming F# for further reading.

Over on the Architecture track, Andres Kütt spoke on Five Years as a Skype Architect. His main theme: most of a software architect’s job is communication, not poring over diagrams and devising code structures. This is a consistent theme at QCon and in the Agile movement; get the communication right and all else follows. I was also interested in the technical side though. Skype started with SOAP but switched to a REST model for web services. Kütt also told us about the languages Skype uses: PHP for the web site, C or C++ for heavy lifting and peer-to-peer networking; Delphi for the Windows interface; PostgreSQL for the database.

Day two of QCon was even better. I’ve written up Martin Fowler’s talk on the ethics of software development in a separate post. Following that, I heard Canonical’s Simon Wardley speak about cloud computing. Canonical is making a big push for Ubuntu’s cloud package, available both for private use or hosted on Amazon’s servers; and attendees at the QCon CloudCamp later on were given a lavish, pointless cardboard box with promotional details. To be fair to Wardley though, he did not talk much about Ubuntu’s cloud solution, though he did make the point that open source makes transitions between providers much cheaper.

Wardley’s most striking point, repeated perhaps too many times, is that we have no choice about whether to adopt cloud computing, since we will be too much disadvantaged if we reject it. He says it is now more a management issue than a technical one.

Dan North from ThoughtWorks gave a funny and excellent session on simplicity in architecture. He used pseudo-biblical language to describe the progress of software architecture for distributed systems, finishing with

On the seventh day God created REST

Very good; but his serious point is that the shortest, simplest route to solving a problem is often the best one, and that we constantly make the mistake of using over-generalised solutions which add a counter-productive burden of complexity.

North talked about techniques for lateral thinking, finding solutions from which we are mentally blocked, by chunking up, which means merging details into bigger ideas, ending up with “what is this thing for anyway”; and chunking down, the reverse process, which breaks a problem down into blocks small enough to comprehend. Another idea is to articulate a problem to a colleague, which exercises different parts of the brain and often stimulates a solution – one of the reasons pair programming can be effective.

A common mistake, he said, is to keep using the same old products or systems or architectures because we always do, or because the organisation is already heavily invested in it, meaning that better alternatives do not get considered. He also talked about simple tools: a whiteboard rather than a CASE tool, for example.

Much of North’s talk was a variant of YAGNI – you ain’t gonna need it – an agile principle of not implementing something until/unless you actually need it.

I’d like to put this together with something from later in the day, a talk on cool things in the .NET platform. One of these was Guerrilla SOA, though it is not really specific to .NET. To get the idea, read this blog post by Jim Webber, another from the ThoughtWorks team (yes, there are a lot of them at QCon). Here’s a couple of quotes:

Prior to our first project starting, that client had already undertaken some analysis of their future architecture (which needs scalability of 1 billion transactions per month) using a blue-chip consultancy. The conclusion from that consultancy was to deploy a bus to patch together the existing systems, and everything else would then come together. The upfront cost of the middleware was around £10 million. Not big money in the grand scheme of things, but this £10 million didn’t provide a working solution, it was just the first step in the process that would some day, perhaps, deliver value back to the business, with little empirical data to back up that assertion.

My (small) team … took the time to understand how to incrementally alter the enterprise architecture to release value early, and we proposed doing this using commodity HTTP servers at £0 cost for middleware. Importantly we backed up our architectural approach with numbers: we measured the throughput and latency characteristics of a representative spike (a piece of code used to answer a question) through our high level design, and showed that both HTTP and our chosen Web server were suitable for the volumes of traffic that the system would have to support … We performance tested the solution every single day to ensure that we would always be able to meet the SLAs imposed on us by the business. We were able to do that because we were not tightly coupled to some overarching middleware, and as a consequence we delivered our first service quickly and had great confidence in its ability to handle large loads. With middleware in the mix, we wouldn’t have been so successful at rapidly validating our service’s performance. Our performance testing would have been hampered by intricate installations, licensing, ops and admin, difficulties in starting from a clean state, to name but a few issues … The last I heard a few weeks back, the system as a whole was dealing with several hundred percent more transactions per second than before we started. But what’s particularly interesting, coming back to the cost of people versus cost of middleware argument, is this: we spent nothing on middleware. Instead we spent around £1 million on people, which compares favourably to the £10 million up front gamble originally proposed.

This strikes me as an example of the kind of approach North advocates.

You may be wondering what other cool .NET things were presented. This session was called the State of the Art .NET, given by Amanda Laucher and Josh Graham. They offer a dozen items which they considered .NET folk should be using or learning about:

  1. F# (again)
  2. M – modelling/DSL language
  3. Boo – static Python for .NET
  4. NUnit – unit testing. Little regard for Microsoft’s test framework in Team System, which is seen as a wasted and inferior effort.
  5. RhinoMocks – mocking library
  6. Moq – another mocking library
  7. NHibernate – object-relational mapping
  8. Windsor – dependency injection, part of Castle project. Controversial; some attendees thought it too complex.
  9. NVelocity – .NET template engine
  10. Guerrilla SOA – see above
  11. Azure – Microsoft’s cloud platform – surprisingly good thanks to David Cutler’s involvement, we were told
  12. MEF – Managed Extensibility Framework as found in Visual Studio 2010, won high praise from those who have tried it

That was my last session (I missed Friday) though I did attend the first part of CloudCamp, an unconference for cloud early adopters. I am not sure there is much point in these now. The cloud is no longer subversive and the next new thing; all the big enterprise vendors are onto it. Look at the CloudCamp sponsor list if you doubt me. There are of course still plenty of issues to talk about, but maybe not like this; I stayed for the first hour but it was dull.

For more on QCon you might also want to read back through my Twitter feed or search the entire #qcon tag for what everyone else thought.

Windows Phone 7 incompatibility may drive developers elsewhere

Microsoft’s Charlie Kindel has blogged about the Windows Phone 7 development platform.

As widely leaked, the new mobile device supports Silverlight and XNA; Kindel also mentions .NET, but since both Silverlight and XNA are .NET platforms, that might not mean anything additional.

The big story is about compatibility:

To deliver what developers expect in the developer platform we’ve had to change how phone apps were written. One result of this is previous Windows mobile applications will not run on Windows Phone 7 Series.

This puts Microsoft in an awkward position. Support for custom business apps has been one of the better aspects of Windows Mobile. What Microsoft should do is to have some way of continuing to run those old apps on the new devices. Instead, Kindel adds:

To be clear, we will continue to work with our partners to deliver new devices based on Windows Mobile 6.5 and will support those products for many years to come, so it’s not as though one line ends as soon as the other begins.

I would not take much account of this. No doubt there will some devices, but demand for Windows Mobile will dive through the floor (if it has not already) once Phone 7 is available, making it an unattractive proposition for hardware partners.

The danger for Microsoft is that after this let-down, those with existing Windows Mobile apps that are now forced to choose a new development platform might choose one from a competitor.

The mitigation is that apps which use the Compact Framework will likely be easier to port to Windows Phone 7, because the language is the same. Native code apps are a different matter. Of course it will be technically possible to write native code apps for Windows Phone 7, but probably locked down and restricted to special cases, such as perhaps the Adobe Flash runtime (I am speculating here).

PS – I see that developer Thomas Amberg has articulated exactly these concerns in a comment to Kindel’s post:

Platform continuity was the single most important feature of Windows Mobile. Being able to run code from 2003 on a current phone is more important to our customers than a fancy UI (which Microsoft seems not able to get right anyway). Further, the ability to access hardware specific APIs through P/Invoke has been vital in many of our projects (e.g. to use Bluetooth in the early days). Those advantages have now gone. You just rendered useless years of development work and many thousands of lines of code.

"we will continue to work with our partners to deliver new devices based on Windows Mobile 6.5 and will support those products for many years to come"

You will, I bet. But which device manufacturer will produce such "dead-end" devices?

Time to switch to another mobile OS.

Microsoft .NET gotchas revealed by Visual Studio team

The Visual Studio Blog makes great reading for .NET developers, and not only because of the product it describes. Visual Studio 2010 is one of the few Microsoft products that has made a transition from native C++ code to .NET managed code – the transition is partial, in that parts of Visual Studio remain in native code, but this is true of the shell and the editor, two of the core components. Visual Studio is also a complex application, and one that is extensible by third parties. Overall the development team stressed the .NET platform, which is good for the rest of us because the developers are in a strong position both to understand problems, and to get them fixed even if it means changes to the .NET Framework.

Two recent posts interested me. One is Marshal.ReleaseComObject Considered Dangerous. I have some familiarity with this obscure-sounding topic, thanks to work on embedding Internet Explorer components. It relates to a fundamental feature of .NET: the ability to interact with the older COM component model, which is still widely used. In fact, Microsoft still uses COM for new Windows 7 APIs; but I digress. A strong feature of .NET from its first release is that it can easily consume COM objects, and also expose .NET objects to COM.

The .NET platform manages memory using garbage collection, where the runtime detects objects that are no longer referenced by active code and deletes them. COM on the other hand uses reference counting, maintaining a count of the number of references to an object and deleting the object when it reaches zero.

Visual Studio 2008 and earlier has lots of COM APIs. Some of these were called from .NET code, and for the same of efficiency called the method mentioned above, Marshal.ReleaseComObject, to reduce the reference count immediately so that the COM object would be deleted.

Now here comes Visual Studio 2010, and some of those COM APIs are re-implemented as .NET code. For compatibility with existing code, the new .NET code is also exposed as a COM API. Some of that existing code is actually .NET code which wraps the COM API as .NET code. Yes, we have .NET to COM to .NET, a double wrapper. Everything still works though, until you call Marshal.ReleaseComObject on the doubly-wrapped object. At this point the .NET runtime throws up its hands and says it cannot decrement the reference count, because it isn’t really a COM object. Oops.

The post goes on to observe that Marshal.ReleaseComObject is dangerous in any cause, because it leaves you with an invalid .NET wrapper. This means you should only call it when the .NET instance is definitely not going to be used again. Obvious, really.

Once you’ve digested that, try this illuminating post on WPF in Visual Studio 2010 – Part 2 : Performance tuning. WPF, or Windows Presentation Foundation, is the .NET API for rich graphical user interfaces on desktop Windows applications. Here is an example of why you should read the post, if you work with WPF. Many of us frequently use Remote Desktop to run applications on remote PCs or PCs that do not have a screen and keyboard attached. This is really a bad scenario for WPF, which is designed to take advantage of local accelerated graphics. Here’s the key statement:

Over a remote desktop connection, all WPF content is rendered as a bitmap. This is in contrast to GDI rendering, where primitives such as rectangles and text are sent over the wire for reconstruction on the client.

It’s a bad scenario, but mitigated if you use graphics that are amenable to compression, like solid colours. There are also some tweaks introduced in WPF 4.0, like the ability to scroll an area on the remote client, which saves having to re-send the entire bitmap if it has moved.

Mono Tools for Visual Studio: code on Windows, run on Linux

I have just com across Mono Tools, a Novell add-in for Visual Studio that lets you test Mono compatibility. It adds a Mono menu which has options to run locally or remotely in Mono, analyze for compatibility issues, and create deployment packages. No sign of Mac support, which is a missed opportunity, but understandable given that Novell owns SUSE Linux.

For those few still unfamiliar with Mono, it is an open source implementation of Microsoft’s .NET Framework, enabling your .NET applications to run on other platforms. One compelling use is to have your ASP.NET web applications run on the free Apache web server, rather than Microsoft’s IIS.

image

Mono Tools works with both Windows Forms and web projects.

image

This is just the sort of thing Mono needs to move it further into the mainstream, though another less welcome sign of business acceptance is that this is a commercial product, currently costing $99.00 for an individual or $249.00 per seat in an organization. There is also an Ultimate edition at $2,499, which comes with a commercial non-LGPL license to redistribute Mono.

The Mono Tools team is now looking for testers for its 1.1 edition, which supports Visual Studio 2010.

Visual Studio 2010 RC arrives with go-live license

Microsoft has made the Release Candidate of Visual Studio 2010 available for download to MSDN subscribers. From tomorrow (10th February) the same release will be available to everyone. There is a go-live license so you can use this in production if you wish, though if the full release comes in April as planned, it hardly seems worth it in most scenarios.

What’s new since the beta? Jason Zander says mainly performance. Note that the Chief Architect of Visual Studio is Rico Mariani, formerly Microsoft’s .NET performance guru, which is encouraging in this respect.

The blow-by-blow account of issues with the RC is here.

Whatever your views on the direction and future of Microsoft’s platform, there’s no doubting the huge scope of this release, though in my view the company has not communicated this particularly well, saying too much about things like SharePoint development, top of its list of walkthroughs but still an ugly business, and not enough about features such as IntelliTrace debugging, or the new ability to float windows out of the IDE and onto a second display, which will have a more immediate impact on developers. Note that the Visual Studio IDE has been re-built using WPF (Windows Presentation Foundation), and that it comes with a the first completely new version of the .NET Framework since 2005.

Silverlight 4.0 is another area of interest, though I understand that it will not be complete in time for this release. Visual Studio 2010 will have Silverlight 3.0 out of the box, with the ability to install the 4.0 preview release and eventually the final release as an add-on. I’ve also heard that Silverlight 4.0 is not yet supported at all in the RC, so be cautious if this is your area of work – you may need to stick with the last beta for the moment.

New is not always better, of course. I’m interested in hearing from developers working with Visual Studio 2010 – whether performance and stability issues have been overcome, and what you think of it overall.