/Dan/.NET - Dan Robey's .NET Dumping Spot : /rants

strange .net special character quirk

dsrobey — Tue, 02 Aug 2005 21:52:00 GMT

Apparently doing String.IndexOf("special character") might not always work as you expect it. The æ character is found in the string "ae" Test yourself by dropping this into a .aspx page:

<% if("ae".IndexOf("æ") == 0) {Response.Write("why?");}%>

I don't really understand why it works that way, but the workaround for this is to use .IndexOf(char) instead:
<% if("ae".IndexOf('æ') == -1) {Response.Write("all is well in the world");}%>

firefox/IE ASP.NET textbox

dsrobey — Mon, 11 Apr 2005 19:41:00 GMT

Just in case anyone else ever has this problem, the asp:textbox in ASP.NET has the two width properties "Width" and "Columns" if you want to set the width of a textbox to a certain size so it will display correctly across browsers, both width and columns must be set. Internet Explorer uses the width field to display on a pixel basis, and firefox uses the "size" attribute which Columns will set when rendered. If you set one and not the other, the textbox width will be the correct size in one but not the other.

Also remember that using the autoindent function in Visual Studio 2003 with inline imperatives will add tabs which IE sometimes sees as extra spaces, screwing up precision page layouts, especially around TD elements.

Exceptions- use them!

dsrobey — Mon, 08 Dec 2003 07:20:00 GMT

I am annoyed. I am extremely annoyed. I have just taken an hour to debug an error which did not exist. I downloaded the source code for the newest taxi server for 1.124. Installed, set permissions, etc. When I hit the server, it froze. ASPNET went to 99% and never came back. Browsed through the code a bit, it all looked reasonable, figured it was my fault. Did windows update, and .NET framework SP2 doesn't seem to be installing, or maybe it is, but it never seems to figure out that it's already there.

After about an hour of reinstallation, etc. I debugged the code a little more. I found that the file wasn't loading. And I had no clue. Why? Because someone had commented out a catch statement which would have thrown the error my way. I have just wasted an hour I could be programming a DFS strategy engine on finding a permissions error. (Yes, even when “Everyone” can read a file, that still doesn't mean ASPNET can). This innocuous little snippet of code went:

catch
{
//throw(ea);
}

why? What is the purpose of a catch statement if not to give some user feedback about why something has gone wrong. I don't write perfect code. You don't write perfect code. Nobody writes perfect code. That's why exceptions should be caught and some feedback given. Always. Please, for the children's sake, catch the exceptions and give feedback.

dealing with long queries

dsrobey — Thu, 04 Dec 2003 19:13:00 GMT

One of the problems with long web queries is user feedback. If a SQL command takes seconds or even minutes to complete, or if some other heavy processing must be done, users must wait idly as the status bar creeps along, blindly guessing at how long the response will take.

This problem is a general notification problem with web queries which stem from the nature of stateless http client/server protocol. A possible solution is to place a layer of indirection on anticipated long queries. Using the web service model, the indirection layer (call it the foyer layer) does the standard query asynchronously, and instead of sending the results, sends a java refresh page, which causes the client to requery the foyer layer every n seconds. The foyer layer can hold data about the current query, including what percent is done. This can be relayed from individual calls, if using SQL can be updated after each SQL statement in the long SQL stored procedure, or previous long calls can be used as an estimation metric. The data can be used to update a true status bar on the page while serving other information to the client - funny quotes, relevant advertising, customer feedback, etc.

The foyer layer can be programmed in any language, and one method which comes to mind would be the recent Shockwave web services, which allow for a stateful client.

sql injection attacks

dsrobey — Thu, 20 Nov 2003 19:02:00 GMT

While your head is still spinning from the last post, don't think that SQL server is the answer either. If an adversary knows your SQL server setup, they can find weaknesses in your database calls and do "sql server injection attacks." Basically, since most SQL programmers assume the strings are nicely encoded already, you can send sql commands as your string, which when using function calls like
"SELECT blah FROM blah WHERE blah=$input"
the attacker can send back inputs like
"' ; INSERT INTO adminusers 'Dan Robey'"
If crafted properly (my strings are just examples and won't work), these inputs will end the current query and instead do the "evil" query. This is one reason why everyone using SQL should disable that convenient little "xp_cmdshell" system call in their SQL server. Otherwise some hacker can just send "' ; xp_cmdshell("format c:")" or something equally nasty.

Hope after reading this you all feel safe and secure with the way your system is setup!

BigInts, C#, Crypto

dsrobey — Tue, 18 Nov 2003 03:29:00 GMT

I take back what I said here about the C# BigInt class. It actually is very well put together. I take issue with the fact that .Equals() does not take an Object, but aside from that it does everything you'd really want a bigint class to do. I'm wondering what the mono guys are using for all the security classes in .NET. Surprisingly (or maybe not), .NET already has a lot of the typical security functions built in. Check out System.Security.Cryptography. if you're interested. A lot of those functions are in there to do code signing, but are generic enough to use for other things. Since .NET has AES (Rijndael) built in, I wonder how they get around the strong crypto export restrictions.

.NET more secure than Linux?

dsrobey — Mon, 06 Oct 2003 17:31:00 GMT

@stake recently published a survey claiming that the .NET framework is more easily secured than Linux. Their methodology includesa list of actions system admins needed to perform to harden the web server. Their criteria mainly hinges on usability and the availability of wizards to guide admins through the tasks. However, while they do not evaluate the actual security provided by the systems, they do bring up a nice point: building a secure web server on linux is a pain. There are too many points in the install and hardening process that a user has to google instructions on how to turn on features, or write the config files that will allow you to do things. I'm sure this will come back to haunt me endlessly when I'm trying to do web services with mono.

blog web service needed

dsrobey — Tue, 30 Sep 2003 18:08:00 GMT

we need a blog web service. Or do we already have one? I want to programmatically author rss.

The only problem would be security, which we could do through WS-SEC I've been looking through lately.

pros and woes of Intellisense

dsrobey — Mon, 29 Sep 2003 16:50:00 GMT

Ever since I started using mono to do my 1.124 problem sets, I've noticed that my honed programmer's edge has been dulled by years of working with Intellisense. If I need to take a sqare root of a number, I no longer can remember where to find the function. While Intellisense speeds up programming tenfold, it also frees the programmer's mind from having to remember exactly what the syntax is. I know that any time I have to do a ToString() anymore, I just type in ".tost" and hit tab. I shave a couple seconds off implementation, keeping the overall design in my mind, but it allows me to get lazy.

While this is a godsend for high-speed implementation, it preys on code correctness. Without the crutch of Intellisense, I take so much more time to try and remember which casing is correct, where the proper functions to call are. If mono gives me an error, usually it turns out to be some unintelligible internal debug line filled with "expected: THIS DEBUG SEMICOLON NEW OPENPAREN", which tells me little about what the real syntax of the line should be.

The real impact of the dependence on Intellisense comes not in your personal coding, but when you want to program for others. Take for example the standard interview. When the interviewer wants you to sit down and write some example code illustrating reversing a string in place, or inserting an item into a linked list, your dependence on Intellisense becomes painfully obvious.

Maybe that's why Don Box programs in Emacs.

more on wearable computing

dsrobey — Thu, 11 Sep 2003 17:58:00 GMT

browsing around for more info:

weblog mentioned on a slashdot about the BBC article with a little more info.
the whitepaper on MIT group's UI. They bring up some vaild points about the display being very small, task management in that environment, etc. I still think it needs a nice skinning.
Apparently last IAP they integrated the Sharp Zaurus into their design for ease of programming. Very nice.

They also describe nicelgy some of the reasons and benefits behind wearable computing, and their hardware construction. This is all good for technical details, but the end user doesn't care about that. They care about being able to check their email by pressing a button, or having voice-over-IP seamlessly. MIThril is far from that.

Oh, and also info about a shoe-based power supply that provides power from walking.

wearable computing

dsrobey — Thu, 11 Sep 2003 17:21:00 GMT

A recent BBC article highlighted the oncoming wave of wearable computing devices. While currently the iPod is the biggest hit, with any luck pervasive computing will grow. Some issues still need to be resolved before this becomes a reality:

A power supply currently can only run a laptop for about 3 hours. While wearable computers will hopefully need much less power than that, a light, rechargable, high power battery solution needs to be found for the always-on wearable devices. Perhaps something that created energy from compression while walking or solar arrays
Interface design. Current software has desktop oriented design, which does not translate to wearable design well at all. The MIT wearable computing center uses a crufty windows manager, which will not translate well to slick applications. Perhaps some form of wsdl for apps needs to be created.
another solution to interface design would be a well-written audio I/O. If a totally verbal "windows manager" could be created, this would solve all interface problems. This presents many hurdles, but the end would be worth it. Microsoft has a S/T interfacewhich might be helpful. Heres's an intriguing sample of ease of use of the SDK.
killer app: something really really cool that appeals to everyone. MP3 players abound. For a price wireless enabled cell phones can be had. Palm pilots are a step in the right direction, but a series of games perhaps, which use the wearable devices. Something like real-world quake arena, where troops can prowl the streets and their "glasses" overlay a halo around enemy team members. Kind of like laser tag, but always on.

bad design practice

dsrobey — Tue, 02 Sep 2003 15:19:00 GMT

Little annoyed today because when I got to work, my windows messenger account would not work. I use trillian normally, so that I can be signed onto several different accounts on different services. Today I got a message that said: “.NET Messenger Service Staff: You are running a version of messenger that requires an immediate security update. Please visit http://messenger.msn.com/Help/Upgrades.aspx to complete the update.“

This is because microsoft has updated their IM protocol and wants you to do the same. However, instead of just sending me this message and leaving it at that, they automatically log users out. This is bad software design. When an interface to a web service changes, one thing developers should do is leave the old interface for “legacy applications“ to use. While the new version of MS IM might have nice “security updates,“ this forces any code base written against this interface to update their code, including trillian, gaim, jabber, and several others.

However, MS is licensing usage of its new interface, forcing these programs to pay. Since gaim and jabber are both open source and free, there is no capital to pay the licensing fee. The typically paranoid reaction from the open source community is that MS is moving to licensing to shut their projects down. I object to it because I a) have to spend 30 minutes updating software, and b) it's bad software design that ignores the web service model microsoft preaches.

google did it!

dsrobey — Tue, 26 Aug 2003 05:57:00 GMT

google beat me to it :(

I run my own little scraper portal called webwalkby, so named because it "walks by" some of the major sites I read frequently every so often and caches their content as rss streams. It grabs me comics, headlines from slashdot, and is of course, running on the xmlportal framework, although not the most recent version.

Back to Google

I had been thinking for some time what would make my site even nicer and my life easier. Since I already have all the headlines of my favorite sites, a scrape which doubles my effectiveness at web browsing, I had to have something that would make my browsing even faster and more efficient.

I came up with the idea of taking my scraped content and filtering it for specific keywords or combinations of keywords and having responses send directly back to me through an IM or email web service. For example, I read bensbargains every day looking for tech deals. I could instead tell my rss robot to alert me whenever a nice flat panel was mentioned on the site. If the system was robust enough, I would hardly have to browse at all except when things interesting me came along. I rewrote my caching system recently to give me a strong base for that kind of flexibility. And now Google beats me to it.

However, there are facets google has overlooked. A quick search (or google) leads to several blogs mentioning that it doesn't support blog filtering yet. This is a serious flaw, especially since blogs can be exported to rss quite easily. I may decide to write my blog trigger system for just that reason. Because all my news feeds are rss feeds (hackish ones for the moment), creating a system similar to google's would be extremely easy.

Longhorn FS & knowledge rep

dsrobey — Wed, 20 Aug 2003 07:49:00 GMT

Everyone's heard by now that Longhorn's shipping with a relational database driven file system. While all kinds of problems and perks come with this decision, this decision runs deeper than the obvious implications. By using a relational database, winFS is effectively saying that humans don't structure things in a strictly branching manner. NTFS, NFS, ext3, etc all structure data in a strictly branching system (excluding symbolic linking). When we set out to catalogue all the species, philosophers developed the species, genus, family, etc system, which placed all things in a neat little tree, which makes nice posters. However, that's not how humans generally think. When we think of milk we think "drink," but we also think of all the possible uses of milk, that it comes from a cow, and many other related facts about milk, all of which break the tree structure, but fit into an appropriately structured relational database quite well.

Not only is this a convenient way to find things that a cow produces easily, or which documents you have related to a project at work, but it also provides a valulable foundation AI desperately needs, that of easily creating links between ideas. WinFS grabs onto the fact that human knowledge is not tree structured and runs with it. Depending on how it's implemented this could be a nice step forward or a disaster. A more technical aspect of this is that it will be necessary to have schemas for the different areas of information. There must be some metadata so that the drivers "directory" knows that it contains drivers, and the drivers will know which device they work for, all data contained previously in windows OS and to some extent in the individual driver files It will be interesting to see how WinFS works or doesn't.

On a side note, any non-tree structure winFS creates could be created with proper symbolic linking techniques within any normal file system. Each file could be in reality a folder, containing symlinks with the names and destinations of the attributes (like filetype, filetype plugin, createdby) and the actual file. Using a relational database just means that all the SQL speed tricks M$ has learned over the years come into play.

blogportal

dsrobey — Mon, 18 Aug 2003 05:49:00 GMT

Thinking about the IESL blogportal: it would be nice to have an upstream RSS of all our blog entries. i.e. a combined listing of all the blogs the entire group did. This shouldn't be that difficult to hack together given the component rss feeds. Might be a good module to write in general, since there are so many rss providers out there and having a generic system that could filter many sources of rss entries into a combined stream could be the next big thing in news providers. See fark.com for a good example of this. Individuals could have their own filter preferences, or sites could filter out relevant info for viewers interested in that site's interests, as in slashdot's tech-oriented crowd. But that's the big picture. For now it would be nice to just see all the IESL blogs in one spot, so we can easily see what everyone's posted recently without visiting all the component blogs.