bloggingonit.com -- IT Blog Feeds Consolidated

Eagerness to fail

Tue, 25 Oct 2011 13:10:39 +0000

If your developers are eagerly taking blame for failures on your project they’re either:

a) buying into the concept of collective code ownership and have a commitment to quality
or
b) are trying to get blamed for everything so that they can be fired and rid of your place of employ.

PostSharp Training

Mon, 03 Oct 2011 20:07:43 +0000

I’ve hooked up with the fine folks over at SharpCrafters to build some training materials for their AOP product PostSharp. Starting in January of 2012 we will be offering training on the use of PostSharp for all your Aspect Oriented Programming needs. I’m currently working on writing the materials and every day I’m finding more interesting little corners of the tool. I’m really looking forward to some of the things that Gael has in store for v3 of it.

If you’re interested in getting some training on PostSharp, shoot me an email at training@igloocoder.com.

Using AutoCompleteTextView and SimpleCursorAdapter

Wed, 07 Sep 2011 03:30:09 +0000

I have a simple little pet project (for Android), and one of the things I wanted to do was to to have a text field that would show me previous values as I typed in the text box (see screenshot below). Of course, this control is already a part of the Android SDK – it’s [...]

Slide deck and code from Prairie Developers Conference 2011

Fri, 17 Jun 2011 02:06:23 +0000

For those wanted the slide-decks and code from my talks at Prairie Developer’s Conference 2011, you can find them up on GitHub. Thanks to all who attended. Maybe we’ll see you again next year.

Professional Neglect and Clear Text Passwords

Wed, 06 Apr 2011 23:07:33 +0000

For that past few years I’ve been the recipient of a monthly reminder from Emug (Edmonton Microsoft User Group). The contents of that email is where the problems lay. Every month that email comes in and it contains 3 pieces of information (plus a lot of boilerplate):

A link to the Emug mailing list admin site
My username
My password in clear text

It doesn’t take much thought to know that storing clear text password is a prime security issue. Sending those passwords in emails doesn’t make it any better. Emails can be intercepted. Systems can be hacked. It’s happened before. Just read about the hack of PlentyOfFish.com. Or the hack of HB Gary. Two things stand out in these attacks. First, PlentyOfFish stores its passwords in clear text which made it easy to compromise the entire user base once access was achieved. HB Gary (an IT security consulting firm no less) had many users who used the same password between different systems which made it easy to hop from system to system gaining different access.

Most web users don’t heed advice to have a different password for every user account they create. First, it seems unreasonable to try to remember them all. Second, most people believe that using their dogs name combined with their birth date is never going to be hackable. As system designers and operators (which the Emug membership is a professional community of) we should know that we can’t do much of anything to prevent users from choosing bad passwords. We can, however take the steps to ensure that those passwords are adequately protected.

So with all of that in mind I decided to call the Emug people on their password practices. I sent an email of concern to them along with a request that they take the time to do the correct professional thing with regards to their members passwords. The response I received back included…

I know what you're saying about the passwords though, the first one you get is randomly generated and if you ever did go on and change it to a common one then it is there within all the options you can also set it to the option of the password reminder. The option "Get password reminder email for this list?" is a user based control option and you can set that to your liking. It's in with all the digest options.

That’s great. So basically the Emug response was “You don’t have to see that we store your password in clear text if you just go uncheck this one box”. Jeez guys, thanks. So you’re suggesting that I should feel that my password is secure just because I’m not seeing it in an email anymore? Security through naiveté?

Most places / sites/ subscriptions now have an automated email reminder method. It does make you ponder its value but I think the focus on that this is a very low level security setting.

Okay…so because you think “most places/sites/subscription now have an automated email reminder” it’s okay for you to follow the same bad practices? Really? What happened to professionalism? Or integrity? Yah I know, that takes effort and you’re just a volunteer running a community group. Except for one little thing: the members of that community entrusted you with their passwords. There was an implied belief that you would protect those passwords in an acceptable manner. Clearly you’re not.

I also ask you to enumerate “most places / sites / subscriptions” please. I don’t get an email from Google Groups, StackOverflow, etc that contains my password in clear text. I know that those are professional companies and you’re not, but remember that professionalism has nothing to do with the size or revenue of your organization.

The piece of the email that really rubbed me the wrong way was this:

The mailman list serve server and application is maintained centrally not by us for the record. It is more of a self-service model and is intentionally designed for little to no maintenance or requirement to assist an end user.

So you don’t administer the system. That’s fine. Yes, the current system may have been designed/implemented to require as little end user support as possible. That’s fine too. Here are my beefs. You have the choice to change what tooling you’re using. I’m pretty sure that you’re able to use Google to find replacement options. It will take some time and effort to see the change through, but don’t you think the integrity of your member’s passwords is worth it?

So to Brett, Colin, Ron and Simon: Please show a modicum of professionalism and take care of this issue. Since you chose not to continue the conversation with me via email, I’ve resorted to blogging. I’m submitting your mailing list email to www.plaintextoffenders.com. I’ll be contacting other community members in the hopes that they can get through to you. I suspect they won’t be able to, but I feel that I have a professional obligation to at least try.

Gifts for Dogs

Wed, 06 Apr 2011 22:48:57 +0000

Casey the Samoyed gets a spring gift – a portable steam cleaner for small parts of your carpet.

Picking Apart PDF with Ruby and Linux

Fri, 18 Mar 2011 00:09:00 +0000

I ran into a curious problem for a side problem of mine where I had some information in PDF files, both text and images. What I want to do is display the information from the PDF’s on a mobile (Android) device. PDF isn’t exactly a mobile friendly format, so I got the idea use HTML. [...]

Purging your Privates (MSMQ with Powershell)

Tue, 01 Mar 2011 15:31:01 +0000

A project I’m currently on makes heavy use of MSMQ and private queues. Every so often, it’s necessary to purge messages from the queue during development. I got tired of always using the MMC snap-in to perform this task, so I whipped up this quick PowerShell script to handle the dirty work for me. Granted, [...]

Dropping my MVP

Wed, 02 Feb 2011 16:06:11 +0000

I have decided to drop out of Microsoft’s Most Valuable Professional Program. I have decided this for many reasons. Mainly I feel the program has no value to me and that MVPs are of no value to MS. Experts MS states how they have these “experts” in the community and that are involved in the [...]

Security Trends

Wed, 29 Dec 2010 22:29:46 +0000

I have been around computers for most of my life and for the past ten years I have been involved in corporate IT on both the network side and the programming side. I was reflecting on some of the changes and trends over the past decade and thought I would share them. We have realized [...]

Fluent Build – Unreleased Features

Fri, 24 Dec 2010 04:45:59 +0000

There are some features not included with the current beta but are available if you download from source. TeamCityPlugin This is a plugin that I wrote that allows TeamCity to work with FluentBuild. TeamCity plugins are written in Java and I am not a Java developer but it seems to work quite well in my [...]

WIND Mobile and my Nexus One

Tue, 21 Dec 2010 03:13:52 +0000

Just recently I switch my mobile carrier from Rogers to WIND Mobile. Their Holiday Miracle plan was just to good to pass up – even paying the penalty to break my Rogers contract I will still save money in the long run. Anyway, once the number got transferred over, I didn’t have a 3G connection, [...]

Fluent Build Beta

Sun, 19 Dec 2010 21:50:32 +0000

swfobject.registerObject("csSWF", "9.0.115", "/images/haveyougotwoods_com/FluentBuildDemo1_0_Beta/expressInstall.swf"); For those of you that follow me on twitter (@gotwoods is my handle) you may have seen that I have been working on a new open source project called FluentBuild which I am happy to announce is in Beta. This project has kept me quite busy lately but the core of the [...]

WCF Security – Part 1: Message & Transport Security

Thu, 16 Dec 2010 22:00:02 +0000

WCF has a huge security component to it (as rightly it should). The technology is massively configurable to support almost any security scenario one can dream up. Unfortunately this also makes it massively hard to learn and implement successfully and many developers tend to work around the security rather than learn how to implement it [...]

TFS 2010, VS2010 Database Projects, and CI

Mon, 29 Nov 2010 21:19:00 +0000

I’m currently working on a project where there are some functional tests that require a SQL Server database. Before in the past I’ve always handled this by using Redgate’s excellent SQL Server tools to create a monolithic script that would deploy the DB Schema, and then another set of scripts to set up the data. [...]

First Impressions: Windows Phone 7 Development

Tue, 16 Nov 2010 04:01:55 +0000

I’ve spent a bit of my spare time in the past week looking at Windows Phone 7 from a developer’s point of view. I’d have started sooner, but honestly, I didn’t see the point until there were actually devices that I could hold and use. I know that in the U.S., some guys got developer [...]

Much Ado About Agile 2010 – Aspect Oriented Programming materials

Wed, 03 Nov 2010 19:14:46 +0000

As promised here is the slide deck and the completed code materials that were covered in my session at Agile Vancouver. I had a great time interacting with the attendees in the session and throughout the rest of the conference. Kudos to the organizers of Agile Vancouver for having created such a fantastic event.

YEG Open Data, the 2010 Edmonton Municipal Election, and Android

Fri, 15 Oct 2010 13:55:00 +0000

(Or, things to do when you have a sick kid) One of the new data catalogues that the City of Edmonton has put up is the 2010 Election Results. This Thanksgiving Long Weekend I was kind of “grounded” at home when my son came down with a nasty inner ear infection. I was hanging out [...]

UI Workflow is business logic

Sun, 26 Sep 2010 23:42:00 +0000

Over my years as a programmer I’ve focussed a lot of attention and energy on business logic. I’m sure you have too. Business logic is, after all, a huge part of what our clients/end users want to see as an output from our development efforts. But what is included in business logic? Usually we think of all the conditionals, looping, data mangle-ment, reporting and other similar things. In my past experiences I’ve poured immense effort into ensuring that this business logic was correct (automated and manual testing), documented (ubiquitous language, automated testing and, yes, comments when appropriate) and centralized (DDD). While I’ve had intense focus on these needs and practices, I’ve usually neglected to recognize the business logic that is buried in the UI workflow within the application.

On my current project I’ve been presented with an opportunity to explore this area a bit more in depth. We don’t have the volume of what I have traditionally considered business logic. Instead the application is very UI intensive. As a result I’ve been spending a lot more time worrying about things like “What happens when the user clicks XYZ?” It became obvious to us very early on that this was the heart of our application’s business logic.

Once I realized this we were able to focus our attention on the correctness, discoverability, centralization and documentation of the UI workflow. How did we accomplish this then? I remember reading somewhere (written by Jeremy Miller I think, although I can’t find a link now) the assertion that “Every application will require the command pattern at some point.” I did some research and found a post by Derick Bailey explaining how he was using an Application Controller to handle both an Event Aggregator and workflow services. To quote him:

Workflow services are the 1,000 foot view of how things get done. They are the direct modeling of a flowchart diagram in code.

I focused on the first part of his assertion and applied it to the flow of user interfaces. Basically it has amounted to each user workflow (or sequence of UI concepts) being defined, and executed, in one location. As an example we have a CreateNewCustomerWorkflowCommand that is executed when the user clicks on the File | Create Customer menu. It might look something like this:

1: public  class  CreateNewCustomerWorkflowCommand  : ICommand <CreateNewCustomerWorkflow >

2: {

3:     private  readonly  ISaveChangesPresenter  _saveChangesPresenter;

4:     private  readonly  ICustomerService  _customerService;

5:     private  readonly  ICreateNewCustomerPresenter  _createNewCustomerPresenter;

6:

7:     public  CreateNewCustomerWorkflowCommand(ISaveChangesPresenter  saveChangesPresenter,

8:                                             ICustomerService  customerService,

9:                                             ICreateNewCustomerPresenter  createNewCustomerPresenter)

10:     {

11:         _saveChangesPresenter = saveChangesPresenter;

12:         _customerService = customerService;

13:         _createNewCustomerPresenter = createNewCustomerPresenter;

14:     }

15:

16:     public  void  Execute(CreateNewCustomerWorkflow  commandParameter)

17:     {

18:         if  (commandParameter.CurrentScreenIsDirty)

19:         {

20:             var  saveChangesResults = _saveChangesPresenter.Run();

21:             if  (saveChangesResults.ResultState == ResultState .Cancelled) return ;

22:             if  (saveChangesResults.ResultState == ResultState .Yes)

23:             {

24:                 _customerService.Save(commandParameter.CurrentScreenCustomerSaveDto);

25:             }

26:         }

27:

28:         var  newCustomerResults = _createNewCustomerPresenter.Run();

29:         if  (newCustomerResults.ResultState == ResultState .Cancelled) return ;

30:         if  (newCustomerResults.ResultState == ResultState .Save)

31:         {

32:             _customerService.Save(newCustomerResults.Data);

33:         }

34:     }

35: }

As you can see the high level design of the user interaction, and service interaction, is clearly defined here. Make no mistake, this is business logic. It answers the question of how does the business expect the creation of a new customer to occur. We’ve clearly defined this situation in one encapsulated piece of code. By doing this we have now laid out a pattern whereby any developer looking for a business action can look through these workflows. They clearly document the expected behaviour during the situation. Since we’re using Dependency Injection in our situation, we can also write clear tests to continuously validate these expected behaviours. Those tests, when done in specific ways, can also enhance the documentation surrounding the system. For example, using BDD style naming and a small utility to retrieve and format the TestFixture and Test names we can generate something like the following:

1: public  class  When_the_current_screen_has_pending_changes

2:  {

3:     public  void  the_user_should_be_prompted_with_the_option_to_save_those_changes(){}

4: }

5:

6: public  class  When_the_user_chooses_to_cancel_when_asked_to_save_pending_changes

7:  {

8:     public  void  the_pending_changes_should_not_be_saved(){}

9:     public  void  the_create_new_customer_dialog_should_not_be_displayed(){}

10: }

11:

12: public  class  When_the_user_chooses_not_to_save_pending_changes

13:  {

14:     public  void  the_pending_changes_should_not_be_saved(){}

15:     public  void  the_create_new_customer_dialog_should_be_displayed(){}

16: }

17:

18: public  class  When_the_user_chooses_to_to_save_pending_changes

19:  {

20:     public  void  the_pending_changes_should_be_saved(){}

21:     public  void  the_create_new_customer_dialog_should_be_displayed(){}

22: }

23:

24: public  class  When_the_user_chooses_to_cancel_from_creating_a_new_customer

25:  {

26:     public  void  the_new_customer_should_not_be_saved(){}

27: }

28:

29: public  class  When_the_user_chooses_to_create_a_new_customer

30:  {

31:     public  void  the_new_customer_should_be_saved(){}

32: }

As you can see, this technique allows us to create a rich set of documentation outlining how the application should interact with the user when they are creating a new customer.

Now that we’ve finished implementing this pattern a few times, have I seen any drawbacks? Not really. If we didn’t use this technique we’d still have to write the code to coordinate the screen sequencing. That sequencing would be spread all over the codebase, most likely in the event handlers for buttons on forms (or their associated Presenter/Controller code). Instead we’ve introduced a couple more classes per workflow and have centralized the sequencing in them. So the trade off was the addition of a couple of classes per workflow for more discoverability, testability and documentation. A no brainer if you ask me.

Is this solution the panacea? Absolutely not. It works very well for the application that we’re building though. In the future will I consider using this pattern? Without doubt. It might morph and change a bit based on the next application’s needs, but I think that the basic idea is strong and has significant benefits.

A big shout out to Derick Bailey for writing a great post on the Application Controller, Event Aggregator and Workflow Services. Derick even has a sample app available for reference. I found it to be great for getting started, but it is a little bit trivial as it only implements one simple workflow. Equally big kudos to Jeremy Miller and his Build Your Own CAB series which touches all around this type of concept. Reading both of these sources helped to cement that there was a better way.

Looking for a Job?

Tue, 21 Sep 2010 15:15:32 +0000

If you happen to be a .NET type, knowledgeable/interested in MVC and Agile, QuestionMark is looking for .NET developers (F/T only, no contractors) here in Edmonton, Alberta. Below is the job description. If you’re interested, send your resume to Kaitlyn Lardin at QuestionMark (kaitlyn AT questionmark DOT com): Senior Software Developer Background Questionmark is [...]

ASP.NET “POET” Vulnerability

Mon, 20 Sep 2010 18:51:48 +0000

There has been lots of good posts so far about the ASP.NET vulnerability that was unveiled late Friday. In summary the attack exposes cryptographic keys used in ASP.net which can lead to all sorts of nastiness. I recommend you read and apply the advice from Scott Guthrie and then come back and read more. Microsoft [...]

DateTime formatting for fr-CA

Thu, 16 Sep 2010 17:33:41 +0000

I just stumbled across a nice little hidden “feature” in the .NET framework. If you’re running on a machine that has the CurrentCulture set to fr-CA the default DateTimeFormatInfo.CurrentInfo.ShortDatePattern is dd-MM-yyyy. On my current project we wanted to allow the end user to override that value with their own format when a date is displayed on the screen. The easy way to do this is to do something like DateTime.Now.ToString(“dd/MM/yyyy”). Unfortunately the result from that will appear as 16-09-2010 still. As far as I can tell (and there is very little backing this up), this is by design. I’m not sure why at all. If the CurrentCulture is set to en-CA both the formats of dd/MM/yyyy and dd-MM-yyyy will cause ToString() to output a value that you would expect, but as soon as you trip over to fr-CA the rules seem to change.

If you’re running into this there is a relatively simple solution. DateTime.Now.ToString(“dd\/MM\/yyyy”) will output 16/06/2010 as you’d expect.

The more localization that I’m doing on this application, the more I’m finding nice hidden gems of inconsistency like this.

Integration – Is It Worth It?

Sat, 28 Aug 2010 14:56:46 +0000

One thing I get asked to do a lot is integrate systems with each other or incorporate other systems into one we are currently building. In a lot of scenarios I have been starting to give some pushback on this. Sure integration is cool and all but should it be done? Expense The first (and [...]

Learn From My Mistakes?

Sat, 21 Aug 2010 01:06:05 +0000

One of my frustrations with Silverlight has been that the async model is rammed down your throat. I understand the reasoning that it is good to have the UI thread responsive while long running calls are happening. But to me that is something that I code and I control. The thing that gets me is [...]

MVVM and Designer Data

Thu, 19 Aug 2010 16:15:12 +0000

Over the last week I have been playing around with Silverlight and the Model View View Model (MVVM) pattern that I have heard such great things about. So far it is a really nice way to separate the UI logic from the UI and make it easily testable. One of the things I loved in [...]