Tag Archives: .net

.net, microsoft, software development, visual studio

What’s new in Visual Studio 2010 – more than you may realise

7 Comments

I’m beginning to think Microsoft has under-sold Visual Studio 2010. Of course it is a huge product, as I observed back in October, especially since it includes a major new release of the .NET Framework as well as updated tools, but I thought I had discovered most of the significant new features. Still, when I sat down recently to write up an extended review, I found a lot that I had missed.

One of my reflections on this is that Microsoft has done of poor job of communicating what is new. I attended the Professional Developer’s Conference in 2008 and 2009. The developer-focused keynote on the second day last November should have hyped the best of what is new; but instead we got Steven Sinofsky on Windows 7 quality control – hardly the most exciting of topics – a sneak preview of IE 9, an unconvincing tour of Sharepoint and Office 2010, and Scott Guthrie on Silverlight 4. Guthrie was fantastic, leading us blow by blow through Silverlight’s new capabilities, but much else was neglected.

It doesn’t help that Microsoft’s home page for Visual Studio 2010 has meaningless headlines. “Set your ideas free”, “Simplicity through integration”, “Quality tools help ensure quality results.” Pure fluff, which saps your will to read further.

Here are a few things that I found interesting – nothing like comprehensive, just features that perhaps have not had the attention they deserve.

Microsoft F# – a new language from Microsoft Research, integrated into Visual Studio with remarkable speed. The people I’ve spoken to who have taken the time to discover what it does are truly enthusiastic. Some of its strengths are parallelism, asynchronous programming, graphics manipulations, and maths. You probably won’t write a complete application in F#, but it will be great for assembling libraries.

Windows Workflow Foundation 4.0 – potentially a new and effective approach to visual programming and long-running state management. Flow charts are often used to teach programming, since they express common concepts like if conditions visually. WF lets you draw a process as a flow chart – or there are other types of chart – using the nice new WPF design tools, and then execute it in the runtime, which is part of the “Dublin” extensions to IIS, now known as Windows Server AppFabric (I have no clue why this confusing name was chosen). To get the idea, I suggest reading David Chappell’s Workflow Way. For applications that fit this kind of model, it is a compelling approach, and integrates well with Windows Communication Foundation for messaging.

Dotfuscator – I know this is a third-party thing, but this is no longer just a tool for obscuring your .NET assemblies in the hope of preventing decompilation. The new Dotfuscator does runtime analytics, and can report back to a portal when your application runs, what features you use, what operating system it is on, whether it crashed, and so on. It also supports application expiry, known as “shelf life”, and can detect if assemblies have been tampered with. Some of this sails close to the spyware wind, but this is a matter of getting informed user consent. These are interesting features for Windows desktop developers, if there are any left, and even the free edition is quite capable.

Test and Lab management – a challenge to set up and configure, but when it works, amazing. Lab Management uses Visual Studio, Hyper-V and System Center Virtual Machine Manager to automate deploying an application over one or more VMs, so you can run tests against it. This hooks into Team System so you can file a bug report with a link that actually shows the bug happening at runtime, with a snapshot of the virtual environment.

Step backwards through code – IntelliTrace is a new feature of the Visual Studio debugger. Configure it to collect IntelliTrace events and call information, and you can then step backwards as well as forwards from a breakpoint, examining variable values as they change.

Team Foundation Server Basic – what this means is that even a solo Visual Studio developer can have TFS running locally or on a networked machine for source code management, issue tracking and so on. It’s worth considering because of the way it integrates with the IDE. I admit, I still like Subversion which I have on a remotely hosted server, since it acts as an effective off-site backup, but I’d much rather use TFS Basic than nothing.

UML – Microsoft has finally done what it should have done years ago, and implemented a wide range of up-to-date UML diagram tools. Nothing revolutionary, just useful.

Not everything is wonderful in the new Visual Studio. Deploying to Azure remains clunky in Beta 2 – when is this going to get better? SharePoint is another one; I appreciate the value of F5 debugging, but you still need SharePoint installed locally, with great potential for mucking up IIS, and the whole thing feels unwieldy.

.net, microsoft, security, windows

The end of Code Access Security in Microsoft .NET

7 Comments

In the early days of .NET I remember being hugely impressed by Code Access Security. It gave administrators total control over what .NET code was permitted to run. It’s true that the configuration tool was a little intimidating, but there were even wizards to adjust .NET security, trust an assembly, or fix an application – great idea, that last one.

image

Well, now the truth is out. Code Access Security was too complex for humans to configure. Buried deep in the documentation for .NET Framework 4.0 you can find Microsoft’s confession, under the heading Security Policy Simplification:

In the .NET Framework 4 Beta 2, the common language runtime (CLR) is moving away from providing security policy for computers. Historically, the .NET Framework has provided code access security (CAS) policy as a mechanism to tightly control and configure the capabilities of managed code. Although CAS policy is powerful, it can be complicated and restrictive. Furthermore, CAS policy does not apply to native applications, so its security guarantees are limited. System administrators should look to operating system-level solutions such as Windows Software Restriction Policies (SRP) as a replacement for CAS policy, because SRP policies provide simple trust mechanisms that apply to both managed and native code. As a security policy solution, SRP is simpler and provides better security guarantees than CAS.

The section below, headed Obsolete Permission Requests, is even more damning of the old system:

Runtime support has been removed for enforcing the Deny, RequestMinimum, RequestOptional, and RequestRefuse permission requests. In general, these requests were not well understood and presented the potential for security vulnerabilities when they were not used properly.

It goes on to explain why they did not work, with explanations like this one for RequestOptional:

RequestOptional was confusing and often used incorrectly with unexpected results. Developers could easily omit permissions from the list without realizing that doing so implicitly refused the omitted permissions.

The new .NET Framework 4.0 no longer enforces these obsolete permissions.

Microsoft is right. As far as I’m aware, few used the .NET Configuration tool, and I cannot even find it in Windows 7, even though Visual Studio and all the versions of the .NET Framework are installed. Developers feared, with justification, that tinkering with the settings would simply cause mysterious exceptions that were hard to resolve.

I recall though that Code Access Security was considered a highly strategic feature when .NET was first released. One of the promises of .NET was that applications would be more secure and malware less prevalent. The fine-grained permissions were a selling point versus Java.

The painful lesson is that simplicity is a feature. Of course some things are inherently complex; but technology succeeds when it simplifies rather than complicates the tasks that we face.

.net, silverlight, software development, web authoring

Silverlight 3 is out

Microsoft has released Silverlight 3, though some pieces of the platform are still not done – it seems there is always something to wait for.

There are links to the tools developers and designers need to install here:

http://silverlight.net/GetStarted/

Note that Expression Blend and Sketchflow are still at Release Candidate stage.

The .NET RIA services, a server-side piece that simplifies authentication and database operations, is available in a new July 2009 preview:

http://www.microsoft.com/DOWNLOADS/details.aspx?FamilyID=76bb3a07-3846-4564-b0c3-27972bcaabce&displaylang=en#filelist

See this excellent post by Nikhil Kothari for more on RIA Services – it’s from March but does a good job of explaining what they are about.

Using Silverlight 3, or plan to? I’d love to hear from you, along with your views on what is best and what is worst about Microsoft’s RIA efforts.