Teucer's Quiver

Switched to blue

2007-02-21T13:36:00-06:00:00

I have recently joined Microsoft US and have moved to US. So no more travelling often between India and Redmond. I haven't yet decided if I am going to move out of GWB. I think I would continue to occasionally post to my blog. ArunBala from our team has also started blogging, other than that few of the other guys on our team who are already on the web are Rupreet, Harshit, ArunPG.

I am not sure we would probably like to setup a team blog or not or whether we would be blogging about the work we do but those are things we would probably think over a period of time.

Btw this blog post comes prepared in OneNote and posted from Word 2007. Hope I don't need to setup font and styles every now and then!

For those who want to know what I work on, it's the same stuff I did earlier. Write Outlook add-ins which talk to CRM platforms :) that's it for now!

Can a web app be offline and work like a smart client? YES it can

2006-11-20T18:11:00-06:00:00

I am a strong supporter of smart clients. They could not have been anything better than smart clients. Smart clients are the big thing for any of us developers who write code for the desktop. But I do keep in touch with some of those things happening in the web world in which I spent a fair amount of time.

Smart clients are basically those client side apps which have these 4 characteristics specified below

1. Intelligent Deployment and update
2. Local resource utilization for UX
3. Connected and operate with one or more systems which serve data and business logic
4. Offline Capabilities which allow the application to behave seamlessly irrespective of whether Item #3 is available or not

And ofcourse I love them because that's my bread & butter :) And I have a fair share of arguments against web apps and my trumpcard used to be Offline capabilities. Apps which run in the browser (hey wait I am not talking about web pages with activex controls or java applets) need the pipe to talk over the network and present more and more of the UI as people keep working on the app. They are bottomline simply nothing but HTML BUT...

Everybody wants to work with their favorite application while they are offline not connected to that site or machine (where there favorite app is available). Is that possible; though I hate to say but YES one can build web apps with Rich UX using Ajax and Atlas with a local data store. Currently there are a few options they can explore.

1. IE (yes IE does provide this behavior) but IMO the size limitations are a bottleneck to anything which can be done sensibly. More...
2. Derby From apache (Sun's otherwise JavaDB) is an option which Zimbra uses which allows for structured storage but you would end up deploying a certificate signed jar file (which means user has to download something to the machine [Tameem's has an evil grin here hehhehe]
3. The Dojo toolkits storage api.

I wish to see something from the Microsoft Atlas folks or the IE folks or the smart client folks if they could probably ship a SQL Server Compact Edition database and relevant Atlas based client libraries and provide a default persistence store for IE so that rich AJAX/Atlas apps could provide the users of these colorful (if not extremely rich) web apps with offline capabilities.

As case studies one could take a look at Scrybe and Zimbra how they provide there web apps with offline capabilities.

Security considerations for smart client applications - I

2006-11-18T19:29:00-06:00:00

Security is one of the areas which I am constantly interested in and as my work revolves around smart clients in the last few years I decided to write down this post. Many of these items described below would apply not only to smart clients but for most applications (irrespective of Web services, Server side apps, alike). I don't consider myself a strong SQL developer hence I am not comfortable right now to post such security considerations for SQL code. May be some day later. Do note that these items are in no order of priority considering that one or more than one of these items could threaten the application's credibility. So lets get started...

Never ship something which you are not using
Most of us have done this before and whether we admit or not there is a security risk involved in shipping something with your app which is not used by your application. Items include sample code for one of those components which your app uses, Debug files, test harness assemblies. The last thing you know your app was safe until someone found a vulnerability with that additional file you shipped and which is going to tarnish the repute of your app and mandate a hotfix. Don't build them or ensure that they are removed after install or during an update if you have already shipped one.

Common sense dictates that the more services available on a server, the greater the opportunities for possible attack. Thus, a minimalist approach can be a positive security action. Remove unneeded files and components from your app.

Turn on integer overflow and underflow checks
Buffer overflows have been a traditional attack vector for almost all types of apps (including web apps). A detailed description of what attack patterns exist have been summarized by Michael Howard in this MSDN article. Visual Studio C# environment can check for integer overflows and underflows and cause a run-time exception instead of continuing execution with incorrect data. However, by default these checks are turned off (I am yet to figure out why). So set the CheckForOverflowUnderflow element to true in the .csproj file or otherwise using the project properties page. "Properties -> Build Tab -> Advanced -> Check for arithmetic overflow/underflow checkbox".

Be aware of luring attacks due to LinkDemands
So you wrote a nice neat library which does lots of good things and makes the developers life easy. It takes care of using CAS but there is a small short coming you are doing LinkDemands instead of regular Demands which makes the CLR to only walk one caller up the call stack. The malicious code may not be the immediate caller on the call stack due to which the CLR is lured into performing an operation without adequate trust from the original caller.

Some practices for LinkDemands are listed below.
1. Don't use them unless absolutely necessary. Be defensive rather than reactive for an exploit to be isolated and reported.
2. If you do not know the list of callers for the trusted assembly then do not use LinkDemands.
3. If you are developing an API which in turn is going to call another method which is marked with a LinkDemand ensure that you enforce adequate checks so that calls of your API can be trusted or do not malicious intent.
4. LinkDemands are attributes applied only to that class method so in case your method marked with a LinkDemand is going to be overridden in a derived class then ensure to decorate that override with a LinkDemand too.
5. Use the right access specifier for your class and method in which you are doing LinkDemands. It would be useless to mark a method with a LinkDemand if the class is internal or the method is private.

Don't store private public key pairs (Strong Name keys) as part of the source repository (better use Delay signing)
Well you strong name your assembly which is one level of security or authenticity of your assembly. Well Done but where and how do you store your strong name keys? From a development perspective if you consider your application assemblies as assets of your application then the strong name keys used to mark the validity of your assembly is a secret which should not be shared with anybody else outside the development team. Some one who could get their hands on the app source code and could potentially build a malicious assembly with the same name and authenticity and ship the binary. Its easy to spot whether an .snk file has both the private public keypair together; the key pair size is 596 bytes and public key alone is 160 bytes. Ok I understand the issue what do we do? Well don't keep the private and public keys together in one .snk file. Or use different keys during "dev & test" & another for the production version. One of the approaches which I had implemented for our app is to keep the public,private key file in a secure share and marked the AssemblyInfo.cs file to locate the file from that file share. The file share is accessible only to people who are part of a security group which is of course only members of our development team. Even if you get hold of the app code you cannot build the app unless you have access to that share.

Shawn Farkas blog contains a lot of posts regarding the subject of strong names and assemblies.

Sign your documents (which contain code)

IMHO Infopath was the most unpopular tool in the Office suite in Office 2003 but with Infopath 2007 it is the killer front end in my opinion. Having worked for the web and been constantly working on smart clients I always wanted a way to present the same UI for both web and desktop apps. Infopath 2007 is probably the only application in my knowledge which can be used by information workers today to build such UI. Infopath docs with the Office Forms Server allow rendering Infopath forms in the native Infopath application or otherwise accessible from the browser on machine which do not have the Infopath application installed. One consistent UI for both the web and the desktop. Super Cool isn't XAML is still not yet there to the masses where a day to day office user could build his/her own data entry form from scratch without much programming knowledge. Now to the issue in hand.

Infopath Templates must be signed, as they contains script code which gets downloaded to the clients machine, which is similar to the excel file with macros.The Infopath file downloaded by the client if replaced by an attacker with another malicious file, there is no way the client would be knowing that he is using the malicious file. If the file is code signed, then the certificate would be prompted to the user to prove the genuinity of the file and that it belongs to the issuer(in this case your app or corpwide certificate). This would make sure that the file is not tampered and it is provided by the legitimate party which can be trusted by the client who is invoking it.

Well I gotta go now and have a huge list of items which I plan to write more in the coming days. I just updated this post title with a "I"... and I anticipate at least 3-4 more parts. Do keep posting your comments in case you are interested to discuss more on these areas.

DebuggerNonUserCode attribute

2006-11-16T19:15:00-06:00:00

Today I was debugging some code and was not able to break into some code of a component; the debugger just failed to recognize it. Turns out the method was decorated with the [DebuggerNonUserCodeAttribute]. Its a neat way to restrict code from being debugged/stepped into. The attribute can be applied to structs, classes, methods, properties and as one may guess not for interfaces. Do note that these attributes are useful only to debugging tools so if you end up writing an implementation for ICorDebug :) you can very well ignore these attributes.

Mike Stall has a relevant post aptly named "How can I debug Just My Code?". One may also want to read about what's new in 2.0 debugging...

And today I am thinking about whether to use Typed Datasets or not to build the data access library for the local storage POC I am involved in... may be more info in a future post...

After the 100th Post... what next?

2006-11-13T15:17:00-06:00:00

Yes the last post was my 100th post. Nitin, a dear friend of mine who also is a blogger (got introduced by Tejas) did ask me some time ago why I stopped blogging. No reasons there of everything should be considered an excuse if I had to state any :(. So my resolution after posting the 100th post to my blog is to keep blogging at a decent frequency and I shall genuinely undertake this exercise .

Next what am I doing these days?

Well... For starters I am in Seattle and contracting at Microsoft. I am still working with Satyam and I am glad about the work I do... My latest work interest require me to evaluate a local database or storage option for our Outlook addin. Ofcourse after going over a few options I am leaning towards opting in for Sql Server Compact Edition (Formally Sql Server Everywhere and even earlier Sql Server Mobile). I also roughly evaluated VistaDB (I did it during my own personal time to evaluate what they call as the world's first 100% managed light weight SQL DB). I strongly recommend anyone evaluating a local database option should read Steve Laskar's whitepaper comparing Sql Express vs. Sql Compact edition. Though you may think it is a bit biased towards Sql Server there is a lot of detail about what really would be the needs and requirements which dev's, designers and architects need to think proactively while deciding a local datastore requirement.

I am hooked to TV and it has again become part of my day to day life. Few of my favorite are "Grey's Anatomy", "Desperate Housewives", "Vanished", "Heroes", "Eureka", "Dexter", "Kyle XY", "Jericho" and the list goes on... I had heard good things about "BattleStar Gallactica" and over the last weekend I managed to see Season1 and I am excited to watch and finish Season 2 over the thanksgiving weekend coming soon.

I used to be a movie buff but haven't really been upto date on movies but I think I will be soon visiting a theater near by to watch "Casino Royale"

Some of you may know my association with MUGH and the core team especially my ties with some; Sudhakar, Arun, Anjana, Thota Umesh to name a few... MUGH is going to conduct one of there largest developer events (DevCon 2006)for the year of 2006 at Hyderabad. Details about the event can be found at their home page.

Overall life is pretty decent and well taken care of... While all this is going on I have some major changes which are to take place in the coming months with me... Hope to keep my friends and fellow bloggers upto date from here...

Do developers really need money or something else?

2006-11-13T14:27:00-06:00:00

Came across a post from Software by Rob blog which has an interesting article about what developers (old school programmers many of them you can say like me...) really need in a programming job.

Many of those points seem to be too true. But in my personal analysis I am opinionated I should say. Partly because I am not doing a day in night out coding job these days... But then for now I shall keep my thoughts to myself :)

MSN Developer Center.

2006-02-22T10:30:00-06:00:00

Just came across the MSN Developer center on MSDN. Pretty neat :)

Delay signing and VS 2005 challenges

2006-02-13T07:58:00-06:00:00

I would like to run sn.exe as a post build instruction. Our key pair is stored in a share whose acess is controlled using ACLs hence its a protected asset. We didnt want to skip assembly verification or use the vs2005 feature for test key signing due to certain reasons notable of which is the fact that there is a dependant system which identifies our code using our strong name for the calling assembly and its a one time registration changing which would impact production or introduce maintenance issues.

So the next question is How do I get the vs.net command environment setup as a post build instruction so that I can call sn.exe? some of the solution projects use web service proxies which are sgen'd during compilation and it requires assemblies to be fully signed before it can generate serialization assemblies. I have not yet investigated the MSBuild properties SignAssembly and AssemblyOriginatorKeyFile as described here so far but not sure if that would be help us in all circumstances or not?

I have so far tried something like expanding the program files variable and hard code the rest of the path to the Microsoft Visual Studio 8\VC\ folder and run the vcvarsall.cmd script and then execute what may be necessary. There are couple of issues which our team has faced so far due to this. Some of the devs have multiple program file folders (essentially they have one partition with the OS and another with the rest of the programs hence multiple program file folders), in some cases they run the compile on machines which do not have vs.net installed and so on... What I am finally thinking is to introduce a custom environment variable with the correct path to the vsvarsall command script which a dev would set system wide before he compiles code using vs.net.

FAQ about Generics in .net

2005-11-27T14:03:00-06:00:00

MSDN has published four FAQs about Generics in .net and they are a must read in my opinion to anyone who is interested in template based programming constructs!

Fundamentals
.Net Framework & Generics
Tool Support for Generics
Best Practices

New Winforms 2.0 Resources page..

2005-11-20T13:32:00-06:00:00

I was looking for some good FAQ's posted on Winforms 2.0 when I hit upon this page at the WindowsForms.net site. The DataGridView faq is probably the most comprehensive I have found so far on the net.

DataGridView FAQ rating
A - Good
B - Very Good
C - Excellent
D - None of the above (Human Error: Could not find a word desribing above excellent)

My Answer: d

Questions on my mind...

2005-11-09T23:40:00-06:00:00

Questions which are on my mind right now. Hope I can fill in results for these questions some time (hopefully soon)!

1. How can the bootstrapper model of deployment be applicable for merge modules (currently you cannot write a bootstrapper setup for a merge module)
2. How do you install your application using setup.exe (the bootstrapper) but launch the final MSI in silent mode? (though the bootstrapper setup help states that any parameters other than -homesite, -url, ... are specified then they are passed as is to the setup MSI - I tried supplying setup.exe /passive thinking that /passive would be passed to the setup MSI but it does not behave that way)
3. How to write an application and ship it (not as an MSI) and also run the bootstrap module to check and install prerequisites (I think this link points to what I am asking for)

WSE 3.0 and VS2005 bootstrap installer

2005-11-07T21:03:00-06:00:00

Mark whose team delivers WSE blogged today about WSE 3.0 RTM. Congratulations J

We require to ship the WSE runtime as a prerequisite for our smart client app hence I had to evaluate whether we can use the bootstrapper installer to install WSE.
WSE 3.0 installs the bootstrapper relevant packages which is sweet but I noticed that it does not support install from the component vendor web site which means you end up hosting the runtime redist as part of your install package.

Listed below is what I did to fix (read hack) and get going with what we needed to do.

1. First thing first you would need to update the Product.xml file which contains information as to what type of install support is available.

<PackageFiles CopyAllPackageFiles="true">
      -- Once we droped, we should define the HomeSite-->
      <PackageFile
            Name="Microsoft WSE 3.0 Runtime.msi"
            HomeSite="WSE3_0Msi" PublicKey="30820..[truncated]"/>
      -- <PackageFile Name="Microsoft WSE 3.0 Runtime.msi"/> -->
PackageFiles>

2. Basically went to the download site and checked the source of this download page to identify the specific url from where the MSI is downloaded.

3. Edited the Package.xml file so that homesite reference is available when the bootstrapper is built with the following change. Add this String element to the Strings list.

<String Name="WSE3_0Msi">
http://download.microsoft.com/download/f/9/a/f9a2e045-11bc-4ad3-b303-4a5bbde7b5e8/Microsoft WSE 3.0 Runtime.msi
String>

NOTE: This url may change; we are not going to prod right now so I guess by then I shall have a “go.microsoft.com” url.

Interesting that though everything works the VS build reports a warning that the public key token is not matching between what is defined in the Product.xml and what is actually in the bootstrapper folder’s MSI.

Back to maintaining a blog..

2005-11-07T19:58:00-06:00:00

Its been a long long time since I blogged. I guess its time....

Yahoo's Developer Poral

2005-03-02T21:46:00-06:00:00

Yahoo opened up its developer portal (in beta as of now) . They are offering web services for Yahoo search and Overture (Yahoo's Ad subsidiary) to start with. First it was Google now Yahoo.

People are sure catching up. MSN are you listening!

CLR related reading..

2005-02-28T23:51:00-06:00:00

If you are looking for blogs by folks who work on the CLR team then this compilation is a must have in your subscription list.

Via KGK - Blogging around the CLR on Shawn Farkas blog.

Providing Context Sensitive help for .net applications.

2004-12-31T18:57:00-06:00:00

I have been spending time working on this Smart Client application and we are running a successfull pilot implementation of the same. Smart Client applications being client side winform application hence its more or less mandated that the usability and UX guidelines set by Microsoft be adhered. After all “Standards” are a good thing :). And frankly after Asp.net became popular (I still love that technology) lots of people left writing or looking seriously at writing windows applications (please dont get me wrong)

I recommend reading “The Windows Interface Guidelines for Software Design” from Microsoft Press for understanding the details about user interface guidelines.

One of those UX guidelines is that a good windows application would be providing help / documentation which will aid the user to work with the application at ease. I until date didnt know that .net has such support for help and documentation (please note I am not referring to source code documentation).

To cut a long story short about how happy I am to know the support for doing these things in .net. Please follow the following URLs.

System.Windows.Forms.Help Class
System.Windows.Forms.HelpProvider Class

[Update] - Check this HOWTO article at Support.microsoft.com - Provide Context-Sensitive Help or Online Help in a Windows Application by Using Visual Basic .NET

For smart phone enthusiasts.

2004-12-29T22:45:00-06:00:00

Here’s a cool Ringtone splicer program that’ll cut your WMA files into short clips for use on your smartphone. Built on .NET using Windows Media Encoder components by an MVP in Malaysia. (http://www.marauderzstuff.com)/. Simple and easy to use.

It's time to start thinking about how we might grant legal rights to computers

2004-12-29T22:40:00-06:00:00

How to use WinDBG to track leaks in the managed heap

2004-12-28T18:37:00-06:00:00

Rico Mariani, the performance architect at MS has written an excellent post about using windbg to track memory leaks in the managed heap.

An excellent post and a must read in my opinion.

Is this the end of Apache Avalon...

2004-12-27T17:38:00-06:00:00

Was checking up Apache avalon and found that around november this year the Apache Avalon project was finally closed. It now stands forked into various projects namely Excalibur, Loom, Castle and Metro.

During my java days this concept was pretty new and getting popular atleast in my circle of people who were crazy about all this work including me.

The whole concept of Avalon revolved around IoC (Inversion of Control). IoC is a design pattern (fairly advanced in my opinion to people who limit themselves to simplicity and try sticking to the GoF patterns) which relates to how well components are to be built which put plain do only what they are intended to do (say business functionality) and leave the rest of the hard work to the container which happens to host them.

A good description of IoC is presented here.

Now in the J world this is a big thing with the application servers as you end up writing business functionality in EJB's and things like that and leave it to the app server which hosts your business components (here EJB's) to take care of deployment, transaction management, component lookups, logging and yada yada yada stuff. Hence my interests loomed around this area for some time and I left it out for quite some time.

I am right now thinking of how much is there a need / relativity for IoC in .net ?
> I think Mr fowler has an answer to that too :)
> I also read the following other blog posts which go in detail to discuss IoC (aka Dependency Injection) to a good extent wrt .net.
Daniel Cazzulino explains how .net has IoC built into the framework itself.
Sami Jaber from DotnetGuru.org talks about lightweight containers.
Alex Hoffman talks about the service locator pattern available in the .net Fx here.