Steve Syfuhs.net

Bad User Interfaces are Insecure

Fri, 05 Mar 2010 16:30:24 GMT

The Best of Intentions

So you’ve built this application. It’s a brilliant application. It’s design is spectacular, the architecture is flawless, the coding is clean and coherent, and you even followed the SDL best practices and created a secure application.

There is one minor problem though. The interface is terrible. It’s not intuitive, and settings are poorly described in the options window. A lot of people wouldn’t necessarily see this as a security issue, but more of an interaction bug -- blame the UX people and get on with your day.

Consider this (highly hyperbolic) options window though:

How intuitive is it? Notsomuch, eh? You have to really think about what it’s asking. Worst of all, there is so much extraneous information there that is supposed to help you decide.

At first glance I’m going to check it. I see “security” and “enable” in the text, and naturally assume it’s asking me if I want to make it run securely (lets say for the sake of argument it speaks the truth), because god knows I’m not going to read it all the way through the first time.

By the second round through I’ve already assumed I know what it’s asking, read it fully, get confused, and struggle with what it has to say.

A normal end user will not even get to this point. They’ll check it, and click save without thinking, because of just that – they don’t want to have to think about it.

Now, consider this:

Isn’t this more intuitive? Isn’t it easier to look at? But wait, does it do the same thing? Absolutely. It asks the user if they want to run a secure application.

The Path to Security Hell

When I first considered what I wanted to say on this topic, I asked myself “how can this really be classified as a security bug?” After all, it’s the user’s fault for checking it right?

Well, no. It’s our fault. We developed it securely, we told them they needed it to be run securely, and we gave them the option to turn off security (again, hyperbole, but you get the point). It’s okay to let them choose if they want to run an insecure application, but if we confuse them, if we make it difficult to understand what the heck is going on, they aren’t actually doing what they want and we therefore failed at making the application they wanted secure, secure.

It is our problem.

So what?

Most developers I know at the very least will make an attempt to write a secure application. They check for buffer overflows, SQL Injection, Cross Site Scripting, blah blah blah. Unfortunately some, myself included, tend to forget that the end users don’t necessarily know about security, nor care about it. We do like most developers do. We tell them what we know: “There has been a fatal exception at 0x123FF567!!one! The index was outside the bounds of the array. We need to destroy the application threads and process.”

That sounds fairly familiar to most error messages we display to our end users. Frankly, they don’t care about it. They are just pissed the work they were doing was just lost.

The funny thing is, we really don’t notice this. When I was building the first settings window above, I kept reading the text and thinking to myself, it makes perfect sense. The reason for this is by virtue of the fact that what I wrote is my logic. I wrote the logic, I wrote the text, I inherently understand what I wrote. We do this all the time. I do this all the time, and then I get a phone call from some user saying “wtf does this mean?”, aaaaaaand then I change it to something a little more friendly. By the 4th or so iteration of this I usually get it right (or maybe they just get tired of calling?).

So what does this say about us? Well, I’m not sure. I think it’s saying we need to work on our user interface skills, and as an extension of that, we need to work on our soft skills – our interpersonal skills. Maybe. Just a thought.

A Stab at a New Resume

Sat, 20 Feb 2010 16:50:06 GMT

While I am definitely not looking for a new job, I was bored and thought I would take a stab at a stylized resume to see if I could hone some of my (lack of) graphics skills. It didn’t turn out too badly, but I am certainly no graphics designer.

What do you think?

The Known Universe

Wed, 10 Feb 2010 19:59:34 GMT

Holy crap this is cool:

Putting the I Back into Infrastructure

Mon, 08 Feb 2010 23:38:32 GMT

Tonight at the IT Pro Toronto we did a pre-launch of the Infrastructure 2010 project. Have you ever been in a position where you just don’t have a clear grasp of a concept or design? It’s not fun. As a result, CIPS Toronto, IT Pro Toronto, and TorontoSQL banded together to create a massive event to help make things a little more clear. To give you a clearer understanding of how corporate networks work. Perhaps to explain why some decisions are made, and why in retrospect, some are bad decisions.

Infrastructure 2010 is about teaching you everything there is to know about a state-of-the-art, best practices compliant, corporate intranet. We will build, from the ground up, an entire infrastructure. We will teach you how to build, from the ground up, an entire infrastructure.

Sessions are minimum 300 level, and content-rich. Therefore:

Well, maybe. (P.S. if you work for Microsoft, pretend you didn’t see that picture)

My First CodePlex Project!

Thu, 04 Feb 2010 20:07:29 GMT

A few minutes ago I just finalized my first CodePlex project. While working on the ever-mysterious Infrastructure 2010 project, I needed to integrate the Live Meeting API into an application we are using. So I decided to stick it into it’s own assembly for reuse.

I also figured that since it’s a relatively simple project, and because for the life of me I couldn’t find a similar wrapper, I would open source it. Maybe there is someone out there who can benefit from it.

The code is ugly, but it works. I suspect I will continue development, and clean it up a little. With that being said:

It needs documentation (obviously).
All the StringBuilder stuff should really be converted to XML objects
It need's cleaner exception handling
It needs API versioning support
It needs to implement more API functions

Otherwise it works like a charm. Check it out!

Interesting Email Attack Method… Cannot Send Shipment

Tue, 26 Jan 2010 19:05:34 GMT

I’ve gotten two emails like this in the last week or so. One was from DHL Shipping, and this one was from UPS. Attached to the email was a zip, with what I presume to be a Trojan of some sort.

The content of the email was:

Dear customer!
We were not able to deliver the postal package which was sent on the 28th of December in time
because the recipient’s address is incorrect.
Please print out the invoice copy attached and collect the package at our department.
United Parcel Service of America.

For a moment I thought the initial email was legit, until I saw it had an attachment. After reading it, I called phooey on it and deleted it. Then I saw the UPS email. I’ll have to dig through the application that came in the zip, and see what’s going on.

I wonder how this type of attack will pan out?

Visual Studio Output Window Auto-Scrolling

Tue, 12 Jan 2010 12:38:06 GMT

Just a quick one here.

Have you ever been using the output window in Visual Studio, scrolled up, and then lost the auto-scroll functionality? It’s really annoying when you have a thousand things coming out through the likes of Debug.Write, or even if it’s just a massive build.

To re-enable autoscrolling, while in the output window just hit CTRL+END.

Kinda wished I knew that a year ago…

A Trip to the Microsoft Store

Mon, 04 Jan 2010 23:03:24 GMT

While I was in California last week I decided to visit the new Microsoft Store in Mission Viejo. While there, the managers graciously allowed me to take pictures of the store. Frankly, they probably thought it was a little creepy. But nevertheless, they said go for it, and I did.

Now, Microsoft did one hell of a job making it known that the store existed while I was at the mall. While I was grabbing coffee in the food court, these stickers were on each table:

Following that, as you head towards the store you see two large LCD screens in the centre of the walkway. On one side you have a Rock Band - Beatles installation running XBox 360 over HD.

On the other side was a promotional video.

Microsoft designed their store quite well. Large floor to ceiling windows for the storefront, with an inviting light wood flooring to create a very warm atmosphere. While there were hundreds of people in the store, it was very welcoming.

Along the three walls (because the 4th is glass) is a breathtaking video panorama. I’m not quite sure how to really describe it. It’s as if the entire wall was a single display, running in full HD.

In the center of the store is a collection of laptops and assorted electronics like the Zune’s. There’s probably a logical layout, perhaps by price, or performance. I wasn’t paying too much attention to that unfortunately.

At the center-back of the store is Microsoft’s Answers desk. Much like the Apple Genius Bar, except not so arrogant. Yes, I said it. Ironically, the display for customer names looked very iPod-ish here, and in the Apple Store, the equivalent display looked like XP Media Center. Go figure.

One of the things I couldn’t quite believe was the XBox 360 being displayed overlay the video panorama video. The video engine for that must have been extremely powerful. That had to be a 1080P display for the XBox. As a developer, I was astonished (and wondered where I could get that app!) A few of the employee’s mentioned that it was driven by Windows 7. Pretty freakin’ sweet.

Also in the store were a couple Surfaces! This was the first time I actually had the opportunity to play with one. They are pretty cool.

And that in a few pictures was my trip to the Microsoft store. There was also a couple pamphlets in store describing training sessions and schedules for quick how-to’s in Windows 7 that I walked away with.

Microsoft did well.

A Thought on Windows Mobile 7

Mon, 04 Jan 2010 20:06:58 GMT

The other day while I was sitting in the airport in Washington, D.C., I had a random thought. When the ZuneHD first hit the shelves people were talking about how Mobile 7 might borrow the look and feel. It’s sleek, easy to use/easy to understand, and is very simple. So I started thinking about what such an interface might look like. This is something I did quickly. Nothing was provided by Microsoft. Nobody has said anything about Mobile 7 design (at least, not at that point, but nobody cared anyway). This is simply something I thought the interface might look like.

Some things to notice are the list-like menu’s, and the bing search at the bottom. Blah-blah-blah anti-trust, the point is search is easily accessible, not necessarily just to Microsoft’s own search engine. It could be Google’s search too. Also, there is the location-specific information at the top showing the current weather. Also mimicking the Windows 7 interface is the idea of pinning things to the home screen such as the Internet Explorer application.

There are some things that should probably change. It feels a little cluttered at the bottom showing current messages and the appointments color is iffy. There may not be any need for the middle separation either.

Just a thought…

Six Simple Development Rules (for Writing Secure Code)

Wed, 16 Dec 2009 21:42:46 GMT

I wish I could say that I came up with this list, but alas I did not. I came across it on the Assessment, Consulting & Engineering Team blog from Microsoft, this morning. They are a core part of the Microsoft internal IT Security Group, and are around to provide resources for internal and external software developers. These 6 rules are key to developing secure applications, and they should be followed at all times.

Personally, I try to follow the rules closely, and am working hard at creating an SDL for our department. Aside from Rule 1, you could consider each step a sort of checklist for when you sign off, or preferably design, the application for production.

Rule #1: Implement a Secure Development Lifecycle in your organization.

This includes the following activities:

Train your developers, and testers in secure development and secure testing respectively
Establish a team of security experts to be the ‘go to’ group when people want advice on security
Implement Threat Modeling in your development process. If you do nothing else, do this!
Implement Automatic and Manual Code Reviews for your in-house written applications
Ensure you have ‘Right to Inspect’ clauses in your contracts with vendors and third parties that are producing software for you
Have your testers include basic security testing in their standard testing practices
Do deployment reviews and hardening exercises for your systems
Have an emergency response process in place and keep it updated

If you want some good information on doing this, email me and check out this link:
http://www.microsoft.com/sdl

Rule #2: Implement a centralized input validation system (CIVS) in your organization.

These CIVS systems are designed to perform common input validation on commonly accepted input values. Let’s face it, as much as we’d all like to believe that we are the only ones doing things like, registering users, or recording data from visitors it’s actually all the same thing.

When you receive data it will very likely be an integer, decimal, phone number, date, URI, email address, post code, or string. The values and formats of the first 7 of those are very predictable. The string’s are a bit harder to deal with but they can all be validated against known good values. Always remember to check for the three F’s; Form, Fit and Function.

Form: Is the data the right type of data that you expect? If you are expecting a quantity, is the data an integer? Always cast data to a strong type as soon as possible to help determine this.
Fit: Is the data the right length/size? Will the data fit in the buffer you allocated (including any trailing nulls if applicable). If you are expecting and Int32, or a Short, make sure you didn’t get an Int64 value. Did you get a positive integer for a quantity rather than a negative integer?
Function: Can the data you received be used for the purpose it was intended? If you receive a date, is the date value in the right range? If you received an integer to be used as an index, is it in the right range? If you received an int as a value for an Enum, does it match a legitimate Enum value?

In a vast majority of the cases, string data being sent to an application will be 0-9, a-z, A-Z. In some cases such as names or currencies you may want to allow –, $, % and ‘. You will almost never need , <> {} or [] unless you have a special use case such as http://www.regexlib.com in which case see Rule #3.

You want to build this as a centralized library so that all of the applications in your organization can use it. This means if you have to fix your phone number validator, everyone gets the fix. By the same token, you have to inspect and scrutinize the crap out of these CIVS to ensure that they are not prone to errors and vulnerabilities because everyone will be relying on it. But, applying heavy scrutiny to a centralized library is far better than having to apply that same scrutiny to every single input value of every single application. You can be fairly confident that as long as they are using the CIVS, that they are doing the right thing.

Fortunately implementing a CIVS is easy if you start with the Enterprise Library Validation Application Block which is a free download from Microsoft that you can use in all of your applications.

Rule #3: Implement input/output encoding for all externally supplied values.

Due to the prevalence of cross site scripting vulnerabilities, you need to encode any values that came from an outside source that you may display back to the browser. (even embedded browsers in thick client applications). The encoding essentially takes potentially dangerous characters like < or > and converts them into their HTML, HTTP, or URL equivalents.

For example, if you were to HTTP encode <script>alert(‘XSS Bug’)</script> it would look like: <script>alert('XSS Bug')</script> A lot of this functionality is build into the .NET system. For example, the code to do the above looks like:

Server.HtmlEncode("<script>alert('XSS Bug')</script>");

However it is important to know that the Server.HTMLEncode only encodes about 4 of the nasty characters you might encounter. It’s better to use a more ‘industrial strength’ library like the Anti Cross Site Scripting library. Another free download from Microsoft. This library does a lot more encoding and will do HTTP and URI encoding based on a white list. The above encoding would look like this in AntiXSS

using Microsoft.Security.Application;
AntiXss.HtmlEncode("<script>alert('XSS Bug')</script>");

You can also run a neat test system that a friend of mine developed to test your application for XSS vulnerabilities in its outputs. It is aptly named XSS Attack Tool.

Rule #4: Abandon Dynamic SQL

There is no reason you should be using dynamic SQL in your applications anymore. If your database does not support parameterized stored procedures in one form or another, get a new database.

Dynamic SQL is when developers try to build a SQL query in code then submit it to the DB to be executed as a string rather than calling a stored procedures and feeding it the values. It usually looks something like this:

(for you VB fans)

dim sql
sql = "Select ArticleTitle, ArticleBody FROM Articles WHERE ArticleID = "
sql = sql & request.querystring("ArticleID")
set results = objConn.execute(sql)

In fact, this article from 2001 is chock full of what NOT to do. Including dynamic SQL in a stored procedure.

Here is an example of a stored procedure that is vulnerable to SQL Injection:

Create Procedure GenericTableSelect @TableName VarChar(100)
AS
Declare @SQL VarChar(1000)
SELECT @SQL = 'SELECT * FROM '
SELECT @SQL = @SQL + @TableName
Exec ( @SQL) GO

See this article for a look at using Parameterized Stored Procedures.

Rule #5: Properly architect your applications for scalability and failover

Applications can be brought down by a simple crash. Or a not so simple one. Architecting your applications so that they can scale easily, vertically or horizontally, and so that they are fault tolerant will give you a lot of breathing room.

Keep in mind that fault tolerant is not just a way to say that they restart when they crash. It means that you have a proper exception handling hierarchy built into the application. It also means that the application needs to be able to handle situations that result in server failover. This is usually where session management comes in.

The best fault tolerant session management solution is to store session state in SQL Server. This also helps avoid the server affinity issues some applications have.

You will also want a good load balancer up front. This will help distribute load evenly so that you won’t run into the failover scenario often hopefully.

And by all means do NOT do what they did on the site in the beginning of this article. Set up your routers and switches to properly shunt bad traffic or DOS traffic. Then let your applications handle the input filtering.

Rule #6: Always check the configuration of your production servers

Configuration mistakes are all too popular. When you consider that proper server hardening and standard out of the box deployments are probably a good secure default, there are a lot of people out there changing stuff that shouldn’t be. You may have remembered when Bing went down for about 45 minutes. That was due to configuration issues.

To help address this, we have released the Web Application Configuration Auditor (WACA). This is a free download that you can use on your servers to see if they are configured according to best practice. You can download it at this link.

You should establish a standard SOE for your web servers that is hardened and properly configured. Any variations to that SOE should be scrutinised and go through a very thorough change control process. Test them first before turning them loose on the production environment…please.

So with all that being said, you will be well on your way to stopping the majority of attacks you are likely to encounter on your web applications. Most of the attacks that occur are SQL Injection, XSS, and improper configuration issues. The above rules will knock out most of them. In fact, Input Validation is your best friend. Regardless of inspecting firewalls and things, the applications is the only link in the chain that can make an intelligent and informed decision on if the incoming data is actually legit or not. So put your effort where it will do you the most good.

Insider Threat Statistics

Tue, 24 Nov 2009 17:41:54 GMT

Steve Riley just posted an intriguing article on Insider Threat statistics, which was originally found in another article:

Survey participants in London and New York: 600

Departing workers who took sensitive information with them: 40%
Portion who would provide this information if it would help to find another job: 1/3
Percentage of employees who are aware of the illegality of stealing information: 85%
Portion of this population who do it any way: 1/2
Percentage who believe it will be useful it some point in the future: >50%
Percentage who find it easier to pilfer information this year: 57%
Percentage last year: 29%
Percentage who claimed they would take company info if fired tomorrow: 48%
Percentage who would download company/competitive information if their jobs are at risk: 39%
Portion of workers who have lost loyalty to their employers because of the recession: 1/4
Percentage of those who take information “just in case”: 64%
Percentage who would use the information in future job negotiations: 27%
Percentage who would use the information as tools in their new jobs: 20%
Those who would take customer and contact details: 29%

Stuff Stolen:

Plans and proposals: 18%
Passwords and access codes: 13%
Product information: 11%

Those would go out of their way:

Percentage of workers who would strive to find the redundancy list: 32%
Percentage of those who would bribe a co-worker in the human resources department: 43%
Who would use their own IT-granted access rights: 37%
Who would use personal contacts of those in the IT department: 30%

It begs the question, *why* would people be willing to do such a thing? Is it out of spite, or lack of morality, or just plain greediness?

It’s kind of sad, actually.

Deleting Temporary Internet Files from the Command Line

Mon, 23 Nov 2009 13:28:49 GMT

A quicky but a goody. Sometimes you just need a quick way to delete temp files from IE. In most cases for me its when I’m writing a webapp, so I’ve stuck this in the build properties:

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 16
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 32
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 4351

It doesn’t require elevated permissions, and has been tested on Vista and Windows 7. Each command deletes the different types of data: temp files, stored form info, cookies etc. Enjoy.

Security, Security, Security is about Policy, Policy, Policy

Fri, 20 Nov 2009 18:35:47 GMT

The other day I had the opportunity to take part in an interesting meeting with Microsoft. The discussion was security, and the meeting members were 20 or so IT Pro’s, developers, and managers from various Fortune 500 companies in the GTA. It was not a sales call.

Throughout the day, Microsofties Rob Labbe and Mohammad Akif went into significant detail about the current threat landscape facing all technology vendors and departments. There was one point that was paramount. Security is not all about technology.

Security is about the policies implemented at the human level. Blinky-lighted devices look cool, but in the end, they will not likely add value to protecting your network. Here in lies the problem. Not too many people realize this -- hence the purpose of the meeting.

Towards the end of the meeting, as we were all letting the presentations sink in, I asked a relatively simple question:

What resources are out there for new/young people entering the security field?

The response was pretty much exactly what I was (unfortunately) expecting: notta.

Security it seems is mostly a self-taught topic. Yes there are some programs at schools out there, but they tend to be academic – naturally. By this I mean that there is no fluidity in discussion. It’s as if you are studying a snapshot of the IT landscape that was taken 18 months ago. Most security experts will tell you the landscape changes daily, if not multiple times a day. Therefore we need to keep up on the changes in security, and any teacher will tell you, it’s impossible in an academic situation.

Keeping up to date with security is a manual process. You follow blogs, you subscribe to newsgroups and mailing lists, your company gets hacked by a new form of attack, etc., and in the end you have a reasonable idea of what is out there yesterday. And you know what? This is just the attack vectors! You need to follow a whole new set of blogs and mailing lists to understand how to mitigate such attacks. That sucks.

Another issue is the ramp up to being able to follow daily updates. Security is tough when starting out. It involves so many different processes at so many different levels of the application interactions that eyes glaze over at the thought of learning the ins and outs of security.

So here we have two core problems with security:

Security changes daily – it’s hard to keep up
It’s scary when you are new at this

Let’s start by addressing the second issue. Security is a scary topic, but let’s breaks it down into its core components.

Security is about keeping data away from those who shouldn’t see it
Security is about keeping data available for those who need to see it

At its core, security is simple. It starts getting tricky when you jump into the semantics of how to implement the core. So let’s address this too.

A properly working system will do what you intended it to do at a systematic level: calculate numbers, view customer information, launch a missile, etc. This is a fundamental tenant of application development. Security is about understanding the unintended consequences of what a user can do with that system.

These consequences are of the like:

SQL Injection
Cross Site Scripting attacks
Cross Site Forgery attacks
Buffer overflow attacks
Breaking encryption schemes
Session hijacking
etc.

Once you understand that these types of attacks can exist, everything is just semantics from this point on. These semantics are along the line of figuring out best practices for system designs, and that’s really just a matter of studying.

Security is about understanding that anything is possible. Once you understand attacks can happen, you learn how they can happen. Then you learn how to prevent them from happening. To use a phrase I really hate using, security is about thinking outside the box.

Most developers do the least amount of work possible to build an application. I am terribly guilty of this. In doing so however, there is a very high likelihood that I didn’t consider what else can be done with the same code. Making this consideration is (again, lame phrase) thinking outside the box.

It is in following this consideration that I can develop a secure system.

So… policies?

At the end of the day however, I am a lazy developer. I will still do as little work as possible to get the system working, and frankly, this is not conducive to creating a secure system.

The only way to really make this work is to implement security policies that force certain considerations to be made. Each system is different, and each organization is different. There is no single policy that will cover the scope of all systems for all organizations, but a policy is simple.

A policy is a rule that must be followed, and in this case, we are talking about a development rule. This can include requiring certain types of tests while developing, or following a specific development model like the Security Development Lifecycle. It is with these policies that we can govern the creation of secure systems.

Policies create an organization-level standard. Standards are the backbone of security.

These standards fall under the category of semantics, mentioned earlier. Given that, I propose an idea for learning security.

Understand the core ideology of security – mentioned above
Understand that policies drive security
Jump head first into the semantics starting with security models

The downside is that you will never understand everything there is to know about security. No one will.

Perhaps its not that flawed of an idea.

Free e-book: Windows 7 troubleshooting tips

Tue, 27 Oct 2009 22:42:52 GMT

Originally found on the Microsoft Press blog…

Free e-book: Windows 7 troubleshooting tips

Mitch Tulloch, a Microsoft Most Valuable Professional and lead author of the just-published (and hot-selling) Windows 7 Resource Kit (Microsoft Press, 2010; ISBN: 9780735627000; 1760 pages), has created a short e-book called “What You Can Do Before You Call Tech Support.” Here are the opening paragraphs:

Your sound card has stopped working, your computer seems sluggish, the network is down, your hard drive is clicking, you can’t view a website, your monitor is hard to read, your new webcam isn’t working, your favorite program won’t run, and a funny burning smell is coming from your computer. What can you do on your own to try to troubleshoot the issue before you pick up the phone to call tech support?

If you’re running Windows 7, quite a lot. Microsoft has included a lot of self-support tools in Windows 7 that you can try using before you seek the help of others, and we’ll examine these in a moment. Then there are the tools you were born with—your five senses (see, hear, smell, taste, touch) and most importantly your brain. And by brain I’m including your memory, experience, and capacity for logical reasoning. Finally, there is ancient and sacred lore passed on in secret from Master to Disciple over the millennia. We’ll see shortly how your brain, your senses, and the secrets of the Wise Ones can be very helpful for troubleshooting computer problems. But first let’s look at what troubleshooting tools are built into Windows 7.

You can download the e-book in XPS format here and in PDF format here. Enjoy!

How UAC Actually Works

Wed, 21 Oct 2009 21:34:08 GMT

This post has had a few false starts. It’s a tough topic to cover, as it’s a very controversial subject for most people still. Hopefully we can enlighten some people along the way.

From a high level perspective, the UAC was developed to protect the user without necessarily removing administrative privileges. Any change to the system required a second validation. On older versions of Windows, an application running with administrative credentials could change any setting on the box. Viruses and malware became rampant because of this openness, given that the average user had administrative credentials. Most average users balked at the idea of having a limited user account, so Microsoft came up with an alternative for the new OS, Vista – a second form of validation. You told the computer you wanted to make a change, it asked “are you sure?”

Logically it makes sense. Consider an instance where a devious application wanted to change some setting, and because Windows wanted to verify it’s ok to make this change it asked “are you sure?” If you responded no, the change didn’t happen. Simple enough. However, here we start running into issues. There are three perspectives to look at.

First, the end user. Simple changes to basic settings required validation. This annoyed most of them, if not all of them. They didn’t care why it was asking, they just wanted to delete shortcuts from their start menu. Their reaction: turn off UAC. Bad idea, but security loses when it comes to usability in the case of the end user.

Second, the irate IT Pro/Developer. Most people working in IT make changes to system settings constantly. Given that, the UAC would be seen many times in a day and it would, for lack of a better word, piss that person off. They didn’t care what security it provided, it was a “stupid-useless-design” that shouldn’t have been created. Their reaction: turn off UAC. Once again security loses when it comes to usability.

Third, the knowledgeable IT Pro/Developer. Not a lot of people fell into this category. However, these tended to be the same type of people who fit into the Lazy Admin category as well. When managed properly UAC wasn’t all that annoying because it wasn’t seen all that often. Set-it-and-forget-it and you don’t ever see the prompt. If you created the system image properly, you don’t have to constantly keep changing settings. It’s a simple enough idea.

But…

Application compatibility is a pain. Most applications didn’t understand the UAC, so they weren’t running with a validation and generally broke when they tried to do things they really shouldn’t be doing in the first place. These are things like manipulating registry keys that don’t belong to them, writing to system folders, reading data from low-level system API’s etc. This was reason #1 for disabling UAC.

And now…

With the general availability of Windows 7 in about 2.5 hours from now, it seems like a good time to discuss certain changes to UAC in the latest version of Windows. The biggest of course being when Windows decides to check for validation.

Windows 7 introduces two new levels of the UAC. In Vista there was Validate Everything or Off. Windows 7 added “Do Not Notify Me When I Make Changes to Windows Settings”. This comes into effect when the user makes a change to a Windows setting like display resolution. Windows is smart enough to realize it’s the user making the change, and allows it. It’s second additional level is the same as the first, except it doesn’t hide the desktop.

Now we get into some fun questions.

How does Window’s know to not show the prompt? It’s fairly straightforward. All Window’s executables that were released as part of the OS are signed with a certificate. All executables signed with this certificate are allowed to run if user started. This is only true for Window’s settings though. You cannot implement this with 3rd party applications. There is no auto-allow list.
How does Window’s know it’s a user starting the application? Lots of applications can mimic mouse movements or keyboard commands, but they occur at a higher application level than an actual mouse move. Input devices like mice and keyboards have an extremely low level driver, and only commands coming from these drivers are interpreted as user input. You cannot spoof these commands.
Can you spoof mouse/keyboard input to accept the UAC request? No. The UAC prompt is created in a separate Windows desktop. Other well known desktops include the Locked screen, login screen, and the Cardspace admin application. No application can cross these desktops, so an application running in your personal desktop cannot push commands into the UAC desktop.

Mark Russinovich has an excellent article in TechNet Magazine that goes into more detail about changes to the UAC. Hopefully this post at least covered all sides of the UAC debate.

Ultimate Windows 7 Keyboard Shortcuts List

Wed, 21 Oct 2009 10:43:11 GMT

Got this list in an email earlier today. Not sure the original source, as it was a copy/paste job, but holy crap what a list. If someone can point out where it originated I will attribute it as necessary.

Ease of Access keyboard shortcuts

Right Shift for eight seconds: Turn Filter Keys on and off
Left Alt + Left Shift + PrtScn (or PrtScn): Turn High Contrast on or off
Left Alt + Left Shift + Num Lock: Turn Mouse Keys on or off
Shift five times: Turn Sticky Keys on or off
Num Lock for five seconds: Turn Toggle Keys on or off
Windows logo key + U: Open the Ease of Access Center

General keyboard shortcuts

F1: Display Help
Ctrl + C (or Ctrl + Insert): Copy the selected item
Ctrl + X: Cut the selected item
Ctrl + V (or Shift + Insert): Paste the selected item
Ctrl + Z: Undo an action
Ctrl + Y: Redo an action
Delete (or Ctrl + D): Delete the selected item and move it to the Recycle Bin
Shift + Delete: Delete the selected item without moving it to the Recycle Bin first
F2: Rename the selected item
Ctrl + Right Arrow: Move the cursor to the beginning of the next word
Ctrl + Left Arrow: Move the cursor to the beginning of the previous word
Ctrl + Down Arrow: Move the cursor to the beginning of the next paragraph
Ctrl + Up Arrow: Move the cursor to the beginning of the previous paragraph
Ctrl + Shift with an arrow key: Select a block of text
Shift + any arrow key: Select more than one item in a window or on the desktop, or select text within a document
Ctrl + any arrow key + Spacebar: Select multiple individual items in a window or on the desktop
Ctrl + A: Select all items in a document or window
F3: Search for a file or folder
Alt + Enter: Display properties for the selected item
Alt + F4: Close the active item, or exit the active program
Alt + Spacebar: Open the shortcut menu for the active window
Ctrl + F4: Close the active document (in programs that allow you to have multiple documents open simultaneously)
Alt + Tab: Switch between open items
Ctrl + Alt + Tab: Use the arrow keys to switch between open items
Ctrl + Mouse scroll wheel: Change the size of icons on the desktop
Windows logo key + Tab: Cycle through programs on the taskbar by using Aero Flip 3-D
Ctrl+ Windows logo key + Tab: Use the arrow keys to cycle through programs on the taskbar by using Aero Flip 3-D
Alt + Esc: Cycle through items in the order in which they were opened
F6: Cycle through screen elements in a window or on the desktop
F4: Display the address bar list in Windows Explorer
Shift + F10: Display the shortcut menu for the selected item
Ctrl + Esc: Open the Start menu
Alt + underlined letter: Display the corresponding menu
Alt + underlined letter: Perform the menu command (or other underlined command)
F10: Activate the menu bar in the active program
Right Arrow: Open the next menu to the right, or open a submenu
Left Arrow: Open the next menu to the left, or close a submenu
F5 (or Ctrl + R): Refresh the active window
Alt + Up Arrow: View the folder one level up in Windows Explorer
Esc: Cancel the current task
Ctrl + Shift + Esc: Open Task Manager
Shift when you insert a CD: Prevent the CD from automatically playing
Left Alt + Shift: Switch the input language when multiple input languages are enabled
Ctrl + ShiftL: Switch the keyboard layout when multiple keyboard layouts are enabled
Right or Left Ctrl + Shift: Change the reading direction of text in right-to-left reading languages

Dialog box keyboard shortcuts

Ctrl + Tab: Move forward through tabs
Ctrl + Shift + Tab: Move back through tabs
Tab: Move forward through options
Shift + Tab: Move back through options
Alt + underlined letter: Perform the command (or select the option) that goes with that letter
Enter: Replaces clicking the mouse for many selected commands
Spacebar: Select or clear the check box if the active option is a check box
Arrow keys: Select a button if the active option is a group of option buttons
F1: Display Help
F4: Display the items in the active list
Backspace: Open a folder one level up if a folder is selected in the Save As or Open dialog box

Windows logo key keyboard shortcuts

Windows logo key: Open or close the Start menu.
Windows logo key + Pause: Display the System Properties dialog box.
Windows logo key + D: Display the desktop.
Windows logo key + M: Minimize all windows.
Windows logo key + Shift + M: Restore minimized windows to the desktop.
Windows logo key + E: Open Computer.
Windows logo key + F: Search for a file or folder.
Ctrl + Windows logo key + F: Search for computers (if you’re on a network).
Windows logo key + L: Lock your computer or switch users.
Windows logo key + R: Open the Run dialog box.
Windows logo key + T: Cycle through programs on the taskbar.
Windows logo key + number: Start the program pinned to the taskbar in the position indicated by the number. If the program is already running, switch to that program.
Shift + Windows logo key + number: Start a new instance of the program pinned to the taskbar in the position indicated by the number.
Ctrl + Windows logo key + number: Switch to the last active window of the program pinned to the taskbar in the position indicated by the number.
Alt + Windows logo key + number: Open the Jump List for the program pinned to the taskbar in the position indicated by the number.
Windows logo key + Tab: Cycle through programs on the taskbar by using Aero Flip 3-D.
Ctrl+Windows logo key + Tab: Use the arrow keys to cycle through programs on the taskbar by using Aero Flip 3-D.
Ctrl+Windows logo key + B: Switch to the program that displayed a message in the notification area.
Windows logo key + Spacebar: Preview the desktop.
Windows logo key + Up Arrow: Maximize the window.
Windows logo key + Left Arrow: Maximize the window to the left side of the screen.
Windows logo key + Right Arrow: Maximize the window to the right side of the screen.
Windows logo key + Down Arrow: Minimize the window.
Windows logo key + Home: Minimize all but the active window.
Windows logo key + Shift + Up Arrow: Stretch the window to the top and bottom of the screen.
Windows logo key + Shift+ Left Arrow or Right Arrow: Move a window from one monitor to another.
Windows logo key + P: Choose a presentation display mode.
Windows logo key + G: Cycle through gadgets.
Windows logo key + U: Open Ease of Access Center.
Windows logo key + X: Open Windows Mobility Center.

Windows Explorer keyboard shortcuts

Ctrl + N: Open a new window
Ctrl + W: Close the current window
Ctrl + Shift + N: Create a new folder
End: Display the bottom of the active window
Home: Display the top of the active window
F11: Maximize or minimize the active window
Ctrl + Period (.): Rotate a picture clockwise
Ctrl + Comma (,): Rotate a picture counter-clockwise
Num Lock + Asterisk (*) on numeric keypad: Display all subfolders under the selected folder
Num Lock + Plus Sign (+) on numeric keypad: Display the contents of the selected folder
Num Lock + Minus Sign (-) on numeric keypad: Collapse the selected folder
Left Arrow: Collapse the current selection (if it’s expanded), or select the parent folder
Alt + Enter: Open the Properties dialog box for the selected item
Alt + P: Display the preview pane
Alt + Left Arrow: View the previous folder
Backspace: View the previous folder
Right Arrow: Display the current selection (if it’s collapsed), or select the first subfolder
Alt + Right Arrow: View the next folder
Alt + Up Arrow: View the parent folder
Ctrl + Shift + E: Display all folders above the selected folder
Ctrl + Mouse scroll wheel: Change the size and appearance of file and folder icons
Alt + D: Select the address bar
Ctrl + E: Select the search box
Ctrl + F: Select the search box

Taskbar keyboard shortcuts

Shift + Click on a taskbar button: Open a program or quickly open another instance of a program
Ctrl + Shift + Click on a taskbar button: Open a program as an administrator
Shift + Right-click on a taskbar button: Show the window menu for the program
Shift + Right-click on a grouped taskbar button: Show the window menu for the group
Ctrl + Click on a grouped taskbar button: Cycle through the windows of the group

Magnifier keyboard shortcuts

Windows logo key + Plus Sign or Minus Sign: Zoom in or out
Ctrl + Alt + Spacebar: Preview the desktop in full-screen mode
Ctrl + Alt + F: Switch to full-screen mode
Ctrl + Alt + L: Switch to lens mode
Ctrl + Alt + D: Switch to docked mode
Ctrl + Alt + I: Invert colors
Ctrl + Alt + arrow keys: Pan in the direction of the arrow keys
Ctrl + Alt + R: Resize the lens
Windows logo key + Esc: Exit Magnifier

Remote Desktop Connection keyboard shortcuts

Alt + Page Up: Move between programs from left to right.
Alt + Page Down: Move between programs from right to left.
Alt + Insert: Cycle through programs in the order that they were started in.
Alt + Home: Display the Start menu.
Ctrl + Alt + Break: Switch between a window and full screen.
Ctrl + Alt + End: Display the Windows Security dialog box.
Alt + Delete: Display the system menu.
Ctrl + Alt + Minus Sign (-) on the numeric keypad: Place a copy of the active window, within the client, on the Terminal server clipboard (provides the same functionality as pressing Alt + PrtScn on a local computer).
Ctrl + Alt + Plus Sign (+) on the numeric keypad: Place a copy of the entire client window area on the Terminal server clipboard (provides the same functionality as pressing PrtScn on a local computer).
Ctrl + Alt + Right Arrow: Tab out of the Remote Desktop controls to a control in the host program (for example, a button or a text box). Useful when the Remote Desktop controls are embedded in another (host) program.
Ctrl + Alt + Left Arrow: Tab out of the Remote Desktop controls to a control in the host program (for example, a button or a text box). Useful when the Remote Desktop controls are embedded in another (host) program.

Paint keyboard shortcuts

Ctrl + N: Create a new picture
Ctrl + O: Open an existing picture
Ctrl + S: Save changes to a picture
F12: Save the picture as a new file
Ctrl + P: Print a picture
Alt + F4: Close a picture and its Paint window
Ctrl + Z: Undo a change
Ctrl + Y: Redo a change
Ctrl + A: Select the entire picture
Ctrl + X: Cut a selection
Ctrl + C: Copy a selection to the Clipboard
Ctrl + V: Paste a selection from the Clipboard
Right Arrow: Move the selection or active shape right by one pixel
Left Arrow: Move the selection or active shape left by one pixel
Down Arrow: Move the selection or active shape down by one pixel
Up Arrow: Move the selection or active shape up by one pixel
Esc: Cancel a selection
Delete: Delete a selection
Ctrl + B: Bold selected text
Ctrl + +: Increase the width of a brush, line, or shape outline by one pixel
Ctrl + -: Decrease the width of a brush, line, or shape outline by one pixel
Ctrl + I: Italicize selected text
Ctrl + U: Underline selected text
Ctrl + E: Open the Properties dialog box
Ctrl + W: Open the Resize and Skew dialog box
Ctrl + Page Up: Zoom in
Ctrl + Page Down: Zoom out
F11: View a picture in full-screen mode
Ctrl + R: Show or hide the ruler
Ctrl + G: Show or hide gridlines
F10 or Alt: Display keytips
Shift + F10: Show the current shortcut menu
F1: Open Paint Help

WordPad keyboard shortcuts

Ctrl + N: Create a new document
Ctrl + O: Open an existing document
Ctrl + S: Save changes to a document
F12: Save the document as a new file
Ctrl + P: Print a document
Alt + F4: Close WordPad
Ctrl + Z: Undo a change
Ctrl + Y: Redo a change
Ctrl + A: Select the entire document
Ctrl + X: Cut a selection
Ctrl + C: Copy a selection to the Clipboard
Ctrl + V: Paste a selection from the Clipboard
Ctrl + B: Make selected text bold
Ctrl + I: Italicize selected text
Ctrl + U: Underline selected text
Ctrl + =: Make selected text subscript
Ctrl + Shift + =: Make selected text superscript
Ctrl + L: Align text left
Ctrl + E Align text center
Ctrl + R:: Align text right
Ctrl + J: Justify text
Ctrl + 1: Set single line spacing
Ctrl + 2: Set double line spacing
Ctrl + 5: Set line spacing to 1.5
Ctrl + Shift + >: Increase the font size
Ctrl + Shift + <: Decrease the font size
Ctrl + Shift + A: Change characters to all capitals
Ctrl + Shift + L: Change the bullet style
Ctrl + D: Insert a Microsoft Paint drawing
Ctrl + F: Find text in a document
F3: Find the next instance of the text in the Find dialog box
Ctrl + H: Replace text in a document
Ctrl + Left Arrow: Move the cursor one word to the left
Ctrl + Right Arrow: Move the cursor one word to the right
Ctrl + Up Arrow: Move the cursor to the line above
Ctrl + Down Arrow: Move the cursor to the line below
Ctrl + Home: Move to the beginning of the document
Ctrl + End: Move to the end of the document
Ctrl + Page Up: Move up one page
Ctrl + Page Down: Move down one page
Ctrl + Delete: Delete the next word
F10: Display keytips
Shift + F10: Show the current shortcut menu
F1: Open WordPad Help

Calculator keyboard shortcuts

Alt + 1: Switch to Standard mode
Alt + 2: Switch to Scientific mode
Alt + 3: Switch to Programmer mode
Alt + 4: Switch to Statistics mode
Ctrl + E: Open date calculations
Ctrl + H: Turn calculation history on or off
Ctrl + U: Open unit conversion
Alt + C: Calculate or solve date calculations and worksheets
F1: Open Calculator Help
Ctrl + Q: Press the M- button
Ctrl + P: Press the M+ button
Ctrl + M: Press the MS button
Ctrl + R: Press the MR button
Ctrl + L: Press the MC button
%: Press the % button
F9: Press the +/’“ button
/: Press the / button
*: Press the * button
+: Press the + button
-: Press the ‘“ button
R: Press the 1/x— button
@: Press the square root button
0-9: Press the number buttons (0-9)
=: Press the = button
.: Press the . (decimal point) button
Backspace: Press the backspace button
Esc: Press the C button
Del: Press the CE button
Ctrl + Shift + D: Clear the calculation history
F2: Edit the calculation history
Up Arrow key: Navigate up in the calculation history
Down Arrow key: Navigate down in the calculation history
Esc: Cancel editing the calculation history
Enter: Recalculate the calculation history after editing
F3: Select Degrees in Scientific mode
F4: Select Radians in Scientific mode
F5: Select Grads in Scientific mode
I: Press the Inv button in Scientific mode
D: Press the Mod button in Scientific mode
Ctrl + S: Press the sinh button in Scientific mode
Ctrl + O: Press the cosh button in Scientific mode
Ctrl + T: Press the tanh button in Scientific mode
(: Press the ( button in Scientific mode
): Press the ) button in Scientific mode
N: Press the ln button in Scientific mode
;: Press the Int button in Scientific mode
S: Press the sin button in Scientific mode
O: Press the cos button in Scientific mode
T: Press the tan button in Scientific mode
M: Press the dms button in Scientific mode
P: Press the pi button in Scientific mode
V: Press the F-E button in Scientific mode
X: Press the Exp button in Scientific mode
Q: Press the x^2 button in Scientific mode
Y: Press the x^y button in Scientific mode
#: Press the x^3 button in Scientific mode
L: Press the log button in Scientific mode
!: Press the n! button in Scientific mode
Ctrl + Y: Press the yâˆšx button in Scientific mode
Ctrl + B: Press the 3âˆšx button in Scientific mode
Ctrl + G: Press the 10x button in Scientific mode
F5: Select Hex in Programmer mode
F6: Select Dec in Programmer mode
F7: Select Oct in Programmer mode
F8: Select Bin in Programmer mode
F12: Select Qword in Programmer mode
F2: Select Dword in Programmer mode
F3: Select Word in Programmer mode
F4: Select Byte in Programmer mode
K: Press the RoR button in Programmer mode
J: Press the RoL button in Programmer mode
<: Press the Lsh button in Programmer mode
>: Press the Rsh button in Programmer mode
%: Press the Mod button in Programmer mode
(: Press the ( button in Programmer mode
): Press the ) button in Programmer mode
|: Press the Or button in Programmer mode
^: Press the Xor button in Programmer mode
~: Press the Not button in Programmer mode
&: Press the And button in Programmer mode
A-F: Press the A-F buttons in Programmer mode
Spacebar: Toggles the bit value in Programmer mode
A: Press the Average button in Statistics mode
Ctrl + A: Press the Average Sq button in Statistics mode
S: Press the Sum button in Statistics mode
Ctrl + S: Press the Sum Sq button in Statistics mode
T: Press the S.D. button in Statistics mode
Ctrl + T: Press the Inv S.D. button in Statistics mode
D: Press the CAD button in Statistics mode

Windows Journal keyboard shortcuts

Ctrl + N: Start a new note
Ctrl + O: Open a recently used note
Ctrl + S: Save changes to a note
Ctrl + Shift + V: Move a note to a specific folder
Ctrl + P: Print a note
Alt + F4: Close a note and its Journal window
Ctrl + Z: Undo a change
Ctrl + Y: Redo a change
Ctrl + A: Select all items on a page
Ctrl + X: Cut a selection
Ctrl + C: Copy a selection to the Clipboard
Ctrl + V: Paste a selection from the Clipboard
Esc: Cancel a selection
Delete: Delete a selection
Ctrl + F: Start a basic find
Ctrl + G: Go to a page
F5: Refresh find results
F5: Refresh the note list
F6: Toggle between a note list and a note
Ctrl + Shift + C: Display a shortcut menu for column headings in a note list
F11: View a note in full-screen mode
F1: Open Journal Help

Windows Help viewer keyboard shortcuts

Alt + C: Display the Table of Contents
Alt + N: Display the Connection Settings menu
F10: Display the Options menu
Alt + Left Arrow: Move back to the previously viewed topic
Alt + Right Arrow: Move forward to the next (previously viewed) topic
Alt + A: Display the customer support page
Alt + Home: Display the Help and Support home page
Home: Move to the beginning of a topic
End: Move to the end of a topic
Ctrl + F: Search the current topic
Ctrl + P: Print a topic
F3: Move the cursor to the search box

Creating a new Forest and Domain on Server Core

Thu, 15 Oct 2009 15:40:42 GMT

Over the weekend, good friend, Mitch Garvis decided it was necessary to rebuild his home network. Now, most home networks don’t have a $25,000 Server at the core. This one did. Given that, we decided to do it right. The network architecture called for Virtualization, so we decided to use Hyper-V. The network called for management, so we decided to install SCCM and Ops Manager. The network called for simplicity so we used Active Directory.

However, we decided to up the ante and install this all on Server Core. Now, the tricky part is that we needed to install Active Directory. The reason this became tricky was because there is no documented procedure out there on how to install a new Forest on Core. There are lots of very smart people on the internet that described how to install new domains part of existing forests, but not new forests. So we got to work.

After running dcpromo a few times we realized we couldn’t create the Forest by throwing commands at it. It occurred to one of us that we should try creating an unattend.txt install file. After a few tries, we figured out the proper structure of the file, and after 10 minutes of watching the CLI spit out random sentences, we had a new domain.

The structure of the file is fairly simple, but you need the correct variable data. We used the following unattend.txt file to create the new domain:

[DCInstall]
InstallDNS=yes
NewDomain=forest
NewDomainDNSName=swmi.ca
DomainNetBiosName=SWMI
SiteName=Default-First-Site-Name
ReplicaOrNewDomain=domain
ForestLevel=3
DomainLevel=3
DatabasePath="%systemroot%\ntds"
LogPath="%systemroot%\ntds"
RebootOnCompletion=yes
SYSVOLPath="%systemroot%\sysvol"
SafeModeAdminPassword=Pa$$w0rd

Now: Once the file was created we put it in the root of C: on the server core machine, and typed the following command:

dcpromo /unattend:c:\unattend.txt

Surprisingly it worked. After checking with Microsoft, this is a supported option, and it’s not a hack in any way. It’s just undocumented.

Until now.

Reference: Mitch Garvis, SWMI, http://garvis.ca/blogs/mitch/archive/2009/10/12/creating-a-new-domain-forest-on-server-core.aspx

October 15th Evening SQL Server DBA Event: Disaster Recovery – Edwin Sarmiento, MVP for SQL Server

Wed, 14 Oct 2009 13:27:20 GMT

October 15^th Evening SQL Server DBA Event: Disaster Recovery – Edwin Sarmiento, MVP for SQL Server

Speaker: Edwin M. Sarmiento, MVP for SQL Server

Date: Thursday, October 15^th, 2009

Time: 6:00 PM to 8:30 PM

Venue: Microsoft Ottawa Office

RSVP: http://www.clicktoattend.com/?id=142063

Session 1 (6:00 PM to 7:10 PM): Understanding and communicating business-orientated disaster recovery concepts and objectives

So you have a database maintenance plan that does a backup of your databases and you’re pretty sure that it works fine. But is that really enough? Are you sure that you will be able to meet your service level agreements if and when disaster strikes? This session will explain the need for understanding and communicating business-orientated disaster recovery concepts and objectives to the business stakeholders. This will include defining your RPO and RTO and how it affects your disaster recovery plan.

Session 2 (7:20 to 8:30 PM): Disaster Recovery for the Paranoid DBA

In the first session, much have been said about disaster recovery in general. In this session, we will look at bringing the concepts down to SQL Server. This session will focus on dealing with a recovery situation for a SQL Server 2005/2008 database, an instance or an entire server. Topics covered will be backup schemes, partial backups and piecemeal restores, page-level recovery and a thorough understanding of how to troubleshoot a "Suspect" database.

Speaker Bio:

Edwin M. Sarmiento (MVP for SQL Server) works as a Senior SQL Server DBA/Systems Engineer for The Pythian Group in Ottawa, Canada. He is very passionate about technology but has interests in music, professional and organizational development, leadership and management matters when not working with databases. He lives up to his primary mission statement – "To help people grow and develop their full potential as God has planned for them.".

Refreshments:

Pizza and pop will be provided.

Note: No one will be admitted by building security after 5:55 PM, and the event will start promptly at 6:00 PM.

OttawaSQL.net is a community group of Ottawa area developers and IT professionals. We share an interest in Microsoft’s data technologies especially: SQL Server, SharePoint, PerformancePoint, Workflow Foundations, LINQ, ADO.NET and Entity Framework.

Pictures from Techdays and FailCamp in Toronto

Tue, 13 Oct 2009 13:28:03 GMT

After getting my camera back from Mitch Garvis after Techdays and FailCamp in Toronto, I decided to upload photos from the events, and to my surprise there were some pretty good shots. Here is what I came back with:

ASP.NET WebForms are NOT Being Overthrown by MVC

Tue, 06 Oct 2009 19:28:05 GMT

It’s always a fun day when the man himself, ScottGu responds to my email. Basically it all started last week at Techdays in Toronto (pictures to follow, I promise).

Quite a few people asked me about MVC, and whether or not it will replace Web Forms. My response was that it wouldn’t, but I didn’t have any tangible proof. I discussed new features in .NET 4.0, and how the development is still going strong for future releases. Some didn’t buy it.

So, earlier today I emailed Scott and asked him for proof. This was his response:

Hi Steve,

Web Forms is definitely not going away – we are making substantial improvements to it with ASP.NET 4.0 (I’m doing a blog series on some of the improvements now). ASP.NET MVC provides another option people can use for their UI layer – but it is simply an option, not a replacement.

In terms of the dev team size, the number of people on the ASP.NET team working on WebForms and MVC is actually about equal. All of the core infrastructure investments (security, caching, config, deployment, etc) also apply equally to both.

Now, MVC is new. MVC is powerful. MVC is pretty freakin cool in what it can do. But it won’t replace WebForms. Frankly, I like WebForms. MVC does have it’s place though. I can see a lot benefits to using it. It alleviates a lot of boilerplate code in certain development architectures, and that is never a bad thing.

Long Live WebForms!

The RACI Model

Thu, 17 Sep 2009 18:40:23 GMT

Definition: a model used to help define who is responsible / accountable; The RACI model is built around a simple 2-dimensional matrix which shows the 'involvement' of Functional Roles in a set of Activities. 'Involvement' can be of different kinds: Responsibility, Accountability, Consultancy or Informational (hence the RACI acronym). The model is used during analysis and documentation efforts in all types of Service Management, Quality Management, Process- or Project Management. A resulting RACI chart is a simple and powerful vehicle for communication. Defining and documenting responsibility is one of the fundamental principles in all types of Governance (Corporate-, IT-Governance).

What does that mean? All projects require management. Simple enough. This model is designed to define each level of management and required interaction on a project or application. The four core levels of involvement attempt to define who should know what about the project/application/system. Each level has more direct interaction than the previous level.

The levels are defined as:

Responsible

Those who do the work to achieve the task. There is typically one role with a participation type of Responsible, although others can be delegated to assist in the work required (see also RASCI below for separately identifying those who participate in a supporting role).

Accountable (also Approver or final Approving authority)

Those who are ultimately accountable for the correct and thorough completion of the deliverable or task, and the one to whom Responsible is accountable. In other words, an Accountable must sign off (Approve) on work that Responsible provides. There must be only one Accountable specified for each task or deliverable.

Consulted

Those whose opinions are sought; and with whom there is two-way communication.

Informed

Those who are kept up-to-date on progress, often only on completion of the task or deliverable; and with whom there is just one-way communication.

Very often the role that is Accountable for a task or deliverable may also be Responsible for completing it (indicated on the matrix by the task or deliverable having a role Accountable for it, but no role Responsible for its completion, i.e. it is implied). Outside of this exception, it is generally recommended that each role in the project or process for each task receive, at most, just one of the participation types. Where more than one participation type is shown, this generally implies that participation has not yet been fully resolved, which can impede the value of this technique in clarifying the participation of each role on each task.

Note: I stole most of that from Wikipedia.

Roles and Responsibilities for Managing an Enterprise Web Site

Thu, 17 Sep 2009 18:26:47 GMT

The intent of this post is to create a summary definition of roles required to adequately manage an enterprise website. It is designed to be used in tandem with a RACI (Responsibility, Accountability, Consultable, and Informed) document to provide a unified management model for the web Infrastructure developed.

Each role is neither inclusive nor exclusive in that any one person can qualify for more than one role, and more than one person can qualify for the same role, as long as each role has been fulfilled adequately.

In a future post I will discuss the creation of a RACI document.

Roles

Database Administrator

Database administrators are charged with controlling website data resources, and use repeatable practices to ensure data availability, integrity and security, recover corrupted data and eliminate data redundancy, as well as leverages tools to improve database performance and efficiency.

Application Administrator

Application Administrators are charged with installing, supporting, and maintaining applications, and planning for and responding to service outages and other problems including, but not limited to, troubleshooting end-user issues at the application level.

Server/Operating System Administrator

Server Administrators are charged with installing, supporting, and maintaining servers and other systems, as well planning for and responding to server outages and other problems including, but not limited to, troubleshooting Application Administration issues at the Operating System level.

User Account/Permissions Administrator

Account Administrators are charged with managing user accounts as well as permissions for users within the system. This includes, but is not limited to, locking and unlocking user accounts, as well as resetting passwords.

Hardware Administrator

Hardware Administrators are charged with managing server hardware and resources. This includes, but is not limited to, deployment of servers as well as troubleshooting issues such as faulty hardware.

Network Administrator

Network Administrators are charged with managing physical network resources such as routers and switches and logical network resources such as firewall rules and IP settings. This includes, but is not limited to, managing routing rules as well as troubleshooting connectivity issues.

These roles were created in an attempt to define job responsibilities at an executive level. A RACI document is then suggested as the next step to define what each role entails at the management level.

ASP.NET Application Deployment Best Practices – Part 2

Thu, 17 Sep 2009 18:12:25 GMT

In my previous post I started a list of best practices that should be followed for deploying applications to production systems. This is continuation of that post.

Create new Virtual Application in IIS

Right-click [website app will live in] > Create Application

Creating a new application provides each ASP.NET application its own sandbox environment. The benefit to this is that site resources do not get shared between applications. It is a requirement for all new web applications written in ASP.NET.

Create a new application pool for Virtual App
- Right click on Application Pools and select Add Application Pool
- Define name: “apAppName” - ‘ap’ followed by the Application Name
- Set Framework version to 2.0
- Set the Managed Pipeline mode: Most applications should use the default setting

An application pool is a distinct process running on the web server. It segregates processes and system resources in an attempt to prevent errant web applications from allocating all system resources. It also prevents any nasty application crashes from taking the entire website down. It is also necessary for creating distinct security contexts for applications. Setting this up is essential for high availability.

Set the memory limit for application pool

There is a finite amount of available resources on the web servers. We do not want any one application to allocate them all. Setting a reasonable max per application lets the core website run comfortably and allows for many applications to run at any given time. If it is a small lightweight application, the max limit could be set lower.

Create and appropriately use an app_Offline.htm file

Friendlier than an ASP.NET exception screen (aka the Yellow Screen of Death)

If this file exists it will automatically stop all traffic into a web application. Aptly named, it is best used when server updates occur that might take the application down for an extended period of time. It should be stylized to conform to the application style. Best practice is to keep the file in the root directory of the application renamed to app_Online.htm, that way it can easily be found if an emergency update were to occur.

Don’t use the Default Website instance
- This should be disabled by default
- Either create a new website instance or create a Virtual Application under existing website instance

Numerous vulnerabilities in the wild make certain assumptions that the default website instance is used, which creates reasonably predictable attack vectors given that default properties exist. If we disable this instance and create new instances it will mitigate a number of attacks immediately.

Create two Build Profiles
- One for development/testing
- One for production

Using two build profiles is very handy for managing configuration settings such as connection strings and application keys. It lessens the manageability issues associated with developing web applications remotely. This is not a necessity, though it does make development easier.

Don’t use the wwwroot folder to host web apps

Define a root folder for all web applications other than wwwroot

As with the previous comment, there are vulnerabilities that use the default wwwroot folder as an attack vector. A simple mitigation to this is to move the root folders for websites to another location, preferably on a different disk than the Operating System.

These two lists sum up what I believe to be a substantial set of best practices for application deployments. The intent was not to create a list of best development best practices, or which development model to follow, but as an aid in strictly deployment. It should be left to you or your department to define development models.

ASP.NET Application Deployment Best Practices – Part 1

Thu, 17 Sep 2009 18:01:09 GMT

Over the last few months I have been collecting best practices for deploying ASP.NET applications to production. The intent was to create a document that described the necessary steps needed to deploy consistent, reliable, secure applications that are easily maintainable for administrators. The result was an 11 page document. I would like to take a couple excerpts from it and essentially list what I believe to be key requirements for production applications.

The key is consistency.

Generate new encryption keys

The benefit to doing this is that internal hashing and encrypting schemes use different keys between applications. If an application is compromised, the private keys that can get recovered will have no effect on other applications. This is most important in applications that use Forms Authentication such as the member’s section. This Key Generator app is using built-in .NET key generation code in the RNGCryptoServiceProvider.

Version and give Assemblies Strong Names

Use AssemblyInfo.cs file:

[assembly: AssemblyTitle("NameSpace.Based.AssemblyTitle")]
[assembly: AssemblyDescription("This is My Awesome Assembly…")]
[assembly: AssemblyConfiguration("")]
[assembly: AssemblyCompany("My Awesome Company")]
[assembly: AssemblyProduct("ApplicationName")]
[assembly: AssemblyCopyright("Copyright © 2009")]
[assembly: AssemblyTrademark("TM Application Name")]
[assembly: AssemblyCulture("en-CA")]

Strong names and versioning is the backbone of .NET assemblies. It helps distinguish between different versions of assemblies, and provides copyright attributes to code we have written internally. This is especially helpful if we decide to sell any of our applications.

Deploy Shared Assemblies to the GAC

Assemblies such as common controls
gacutil.exe -I "g:\dev\published\myApp\bin\myAssembly.dll"

If any assemblies are created that get used across multiple applications they should be deployed to the GAC (Global Assembly Cache). Examples of this could be Data Access Layers, or common controls such as the Telerik controls. The benefit to doing this is that we will not have multiple copies of the same DLL in different applications. A requirement of doing this is that the assembly must be signed and use a multipart name.

Pre-Compile Site: [In Visual Studio] Build > Publish Web Site

Any application that is in production should be running in a compiled state. What this means is that any application should not have any code-behind files or App_Code class files on the servers. This will limit damage if our servers are compromised, as the attacker will not be able to modify the source.

Encrypt SQL Connections and Connection Strings

Encrypt SQL Connection Strings

Aspnet_regiis.exe -pe connectionStrings -site myWebSite -app /myWebApp

Encrypt SQL Connections

Add ‘Encrypt=True’ to all connection strings before encrypting

Force encryption on SQL Server protocol configurations: http://www.syfuhs.net/article/38.aspx

SQL Connections contain sensitive data such as username/password combinations for access to database servers. These connection strings are stored in web.config files which are stored in plain-text on the server. If malicious users access these files they will have credentials to access the servers. Encrypting the strings will prevent the ability to read the config section.

However, encrypting the connection string is only half of the issue. SQL transactions are transmitted across the network in plain-text. Sensitive data could be acquired if a network sniffer was running on a compromised web server. SQL Connections should also be encrypted using SSL Certificates.

Use key file generated by Strong Name Tool:

C:\Program Files\Microsoft SDKs\Windows\v7.0A\bin\sn.exe

“sn.exe -k g:\dev\path\to\app\myAppKey.snk”

Signing an assembly provides validation that the code is ours. It will also allow for GAC deployment by giving the assembly a signature. The key file should be unique to each application, and should be kept in a secure location.

Set retail=”true” in machine.config

<configuration>

<system.web>

<deployment retail="true"/>

</system.web>

</configuration>

In a production environment applications do not want to show exception errors or trace messages. Setting the retail property to true is simple way to turn off debugging, tracing, and force the application to use friendly error pages.

In part 2 I continue my post on more best practices for deployment to a production environment.

Naming Conventions can be Your Enemy

Fri, 28 Aug 2009 21:45:05 GMT

Or your ally in the fight against technology management. Earlier this week I was given the task of doing some naming for new servers, which is pretty much SOP. Problem is, we don’t have a naming standard. As such, I may choose a name that annoys someone, or they choose a name that annoys me. This becomes very political. We don’t want to name things in such a way that they annoy people. It’s a bad idea. And, much to my dismay, I said something this morning that was pretty much just insulting to one of my team members.

I could have given loads of excuses, but it wouldn’t have mattered. I was being petty. Man, that’s a bad idea in an office. It divides teams, and man, that’s *really* bad in an office. The reason it came about was because a few people were talking about moving into “fun” server names, as apposed to functional server names. Examples of this would be Cygnus or Badger, as apposed to GR-SQLCluster1.

The reasons behind it being:

It’s more secure if the attacker doesn’t know what the server does, based on it’s name
Server roles change over time, so GR-SQLCluster1 might become relegated to an apps server
Sections of functional names become redundant
Organize names by type; i.e. birds, galaxies, different words for snow, etc

At first glance, they make great sense. However, after a little time to digest the reasons, a few things become clear.

If an attacker is able to get to the server, to the point that they can know the name, you are already screwed
A good practice is to rebuild the server if it changes roles, and with that change the name
People don’t want to connect to the Badger Server
You need a reference list to figure out what the Cygnus server does/where the Cygnus server physically is
If you want to create DNS entries to provide functional names to it, that’s another level of complexity to manage
What happens when you run out of server names?

Given this list, it now becomes an interesting debate. But I have one question for you:

As a developer, would you name a variable ‘badger’ if it was holding a shopping cart? Not a chance. You would only do that if it were badger related, and even then you are better off with ‘meanLittleWoodlandCreature’ in case you change something.

In my response I called the security reason laughable. Again – petty and a really, really, really bad idea when in a team discussion. Obviously I was in a pissy mood for some reason, or maybe a greater than thou mood thinking I knew more about the topic. I tend to do that.

I think what really made me do it was that we are developers, not administrators. It’s not our job to name servers. So why were we? I didn’t want to piss anyone off, I just wanted to name the server so we could move on to the next stage of the deployment. This situation could have easily been averted.

If we had a naming convention for our servers, regardless of fun vs functional, I could have followed the convention and washed my hands of the problem. So I guess the question is, why don’t we have one? Lot’s of companies don’t have them. And I think it’s because of stagnant server growth.

If you are only setting up a couple servers every so often, you aren’t bogged down with these types of questions. You have time to discuss. The problem we are having, I think, is because we have increased our server growth dramatically in the last little while, which hasn’t given us enough time to discuss names as a group. I was rushing to get the server into production because the administrators were busy working on other tasks that were filed under the category “Do Now Or ELSE!”

So I think we need a naming convention. A functional naming convention. It will prevent a world of hurt down the road. Now to get buy in, and ask for forgiveness. I still have lots to learn.

The Boston Tea Party has gone Batty

Wed, 26 Aug 2009 19:40:40 GMT

This morning I saw an interesting post on Twitter. Which in-and-of-itself is kinda amazing, but that’s not the point. The post was on something called the Windows 7 Sins site. It is a campaign created by the Free Software Foundation to highlight everything that is wrong philosophically with Windows 7. Now, I’m all for philosophical debates, but this is just plain batty. So what did I do? I acted! I emailed the FSF people at campaigns@fsf.org the following email:

Ya know, if you sold software, you wouldn’t need to keep asking people for money. Basic principle of economics. Just sayin.

Also, a widget provides functionality and interaction. An image doesn’t. See the Windows 7 Sins “widget”.

Now, what I don’t get is this whole Boston Common thing. Is this an attempt at recreating the Boston Tea Party, except with (what I hope is) more regard for the environment and not tea, but software, as the “widget” proposes? If this were the case, in order to get a hold of said software, legally, you would need to buy it. Sounds counterintuitive.

Unless you are proposing people illegally obtain, as per license agreements define, the software and do what they will with it. Which is pretty much just plain ol’ illegal. “So was the Boston Tea Party” is an excellent counter argument. However, the Tea Party was about rebellion from a Government, not a company. The government makes laws, a company does not. The rebellion was against unfair taxation, something the Government controls. Unless of course you are rebelling against the government too. Which I guess is ok, except the government has already ruled against Microsoft in many cases regarding such topics as anti-trust, anti-competitive nature, etc. They don’t like ‘em either. Well, the justice department doesn’t anyway.

I just don’t get it.

Regards,

Steve Syfuhs
Software Developer and/or Architect Guy

I wonder how many people I annoyed with it. We shall see.

Move Their Cheese! (and Change the Design)

Tue, 18 Aug 2009 21:20:33 GMT

I tend to complain a lot. Which frankly, doesn't do much for what I'm complaining about. In most cases, it comes down to "okay, here is a problem, now someone else go and fix it." There is a direct correlation to how many people I annoy too. The number of people I annoy increases as the magnitude of my complaining-ness (hey, a new word) increases:

If I wanted to change something, obviously I’m going about it the wrong way. However, there is a direct correlation between how often I do something wrong and the likelihood I will get it right. See previous image. What that means is if I keep screwing something up, eventually I am bound to get it right. However, what is not necessarily apparent in the chart is that if I do nothing, I won’t improve upon my actions. Maybe it is apparent, I don’t know – I’m still working on it.

The reason I bring this up is because I keep hearing people bash/complain/hate the Office Ribbon and application Ribbons through Windows 7:

The major complaint has been that people couldn’t find what they are looking for anymore. There aren’t any menus, so they can’t figure out how to set [insert obscure property]. It doesn’t make sense to them. They now have to change the way they think about the application. What is unfortunate about this is that menus are a horrible interface. You shouldn’t have to dig through 6 layers of menus to change a single property, and that’s what Office 2003 became. The Ribbon has it’s own problems, but it also increases user productivity greatly when the user knows how to use the Ribbon effectively. Which in lies a major problem.

Most end-users don’t like when you move their cheese.

Well now we have a problem because people also want improved systems. Improve the system, but don’t change it. This paradox is why fundamentally different – game changing – designs aren’t seen all that often. We stick with what we already know because if we deviate people will complain. It’s a very tough way to create a better interface.

So how do you create a better interface? You keep changing it. Guaranteed the first couple of designs are going to annoy people: i.e. the Ribbon.

This is good.

If you keep failing at designs, that means eventually you are bound to figure out what kind of interface works best. You will never figure it out if you never change. Without MicroBating MasterSoft’s (hey look, two new words) ego, I must say that Microsoft is doing well in this area. They keep making lousy design decisions. See Expression Blend UI, and listen to most non-technical office workers using Office 2007. I’m sure there are quite a few instances in other applications as well. However, and I must make this clear, Microsoft is doing the right thing. They are actively trying to create better interfaces. Yes, it will piss people off (it’s pissed me off quite a few times), but at least they are making the effort. And that’s what counts.

EDIT: P.S. I do like the Ribbon.

Stop Complaining About Software Expenses

Mon, 20 Jul 2009 19:26:00 GMT

It’s been a long week, and it’s only Monday. It all started with an off-the-cuff comment. It was of the petty nature, and it certainly wasn’t accurate. It seems that is usually the case with petty comments.

I was berated for suggesting SharePoint Services as a replacement for our ageing intranet, and the commenter responded with a quick “SharePoint? Microsoft makes that, it’ll cost too much. Our current java site works just fine, and it’s free.” Or something of that nature.

How do you respond to a petty comment? It’s pretty damn hard:

While Microsoft Office SharePoint Server 2007 does cost money for licensing, Windows SharePoint Services 3.0 (which MOSS is built on) is free. Not free as in speech, but free as in beer. Always has been.
Java is a terrible language for websites. It’s slow, and none of the developers in the company know Java. We all program with .NET languages.
The current intranet is running on an AS/400.
The bulk of the stuff we do on our current intranet could very easily be done in SharePoint, without any development. And, we can also increase productivity with the added features of team workspaces and free templates for other departments.
The only cost will be in man-hours setting the server up, and migrating content.

Those have been my main arguments since I started working here. We are a Microsoft shop, but very often choose non-Microsoft products. Hmm…

The main reason we don’t use Microsoft products is cost. Plain and simple. Ironically, that is also the same reason WHY we use Microsoft products.

We use SQL Server, Windows Server 2008, Active Directory (finally!), IIS, MOSS (soon), and program in C#. We don’t use office 2007, only Office 2003, some computers are still on Windows 2000 and XP. Only one computer is running Vista, and two are running Windows 7. But then again, we are a Not-For-Profit company. Budgets are tight.

This post is NOT a comment on our current state of technology, because like I said in a previous post, we do a pretty good job of staying on the cutting edge in a few cases.

This post IS a comment on the people out there who think cost is the only thing to look at when evaluating a product. For the love of god, STOP bitching about price. START bitching about quality.

I can’t stand bad software. People don’t pay for good software, but then complain about its quality. Come on! There is a formula out there that calculates the cost of a piece of software over time. It takes into account initial cost, and the cost of the updates that follow. It’s a simple y = mx+b formula.

Now, when you have a higher initial cost, you tend to assume it’s of higher quality. Put this into the equation, and the number of updates, and the cost to implement these updates goes down. Over the life of the product, it’s cheaper to go with the software that is initially more expensive. This is basic business.

What this basic business formula doesn’t show you is the added headaches you get with crappy software. You tend to end up with silos of systems, and silos of data. You don’t get integration. This is where the cost sky rockets. Or more accurately, this is where productivity decreases.

Ironically…

SharePoint Services 3.0 is free. It doesn’t cost anything to use. It’s easy to use, and integrates with most of our internal systems. I just ruined my entire argument. Sorta. SharePoint is a quality piece of software, and over time, it will cost less to use and maintain than any of the other intranet/middleware applications out there. Most people don’t realize this.

I’ll probably get flack for this one: Most people don’t complain about software expenses. They complain about Microsoft expenses.

“We give Microsoft too much money, and don’t get enough in return.”
“There must be better software vendors out there than Microsoft that are cheaper.”
“Why bother upgrading; XP Works fine.”

Have you seen the cost of a friggen Oracle license? What about IBM’s iSeries? Novell’s Groupwise? My jaw dropped when I saw the cost of these things. I can’t say a single nice thing about Groupwise. It’s a terrible product. IBM’s iSeries is pretty good, but it’s limited what you can do with it. Oracle knows databases, but has a higher license cost than a good chunk of a department’s salary.

Microsoft gets most of our money because it has quality products, at a good price. Look at a few competing vendors products and compare cost and quality as well as the ability to integrate across platforms. Revelation is a wonderful thing. You might think twice before settling on cost.

Presenting at Techdays 2009!

Thu, 16 Jul 2009 18:28:12 GMT

Still working out session details, but it looks like I will be presenting in Ottawa and Montreal for Techdays 2009. I will be loitering around at the Toronto event soaking up all the techie-goodness, so come find me at any of the three events. We can talk shop, shoot the breeze, or just mill about having a good time.

I promise I won’t embarrass anyone. Except maybe myself. But that’s a warning for all occasions.

Here are the dates of the events across Canada. Buy your tickets before the early-bird deal runs out!

City	Date	Venue
VANCOUVER	SEPTEMBER 14-15	Vancouver Convention Centre
TORONTO	SEPTEMBER 29-30	Metro Toronto Convention Centre
HALIFAX	NOVEMBER 2-3	World Trade & Convention Centre
CALGARY	NOVEMBER 17-18	Calgary Stampede
MONTREAL	DECEMBER 2-3	Mont-Royal Centre
OTTAWA	DECEMBER 9-10	Hampton Inn & Convention Centre
WINNIPEG	DECEMBER 15-16	Winnipeg Convention Centre

The Early Bird price is $299. The regular Price is $599.

I will post more on the sessions I will be presenting at a later date when I get the full details.

See you there!

Apple Lowered Their Prices

Wed, 15 Jul 2009 19:37:34 GMT

I was listening to Kevin Turner give his keynote at the World Partner Conference earlier and I overheard this:

And so we've been running these PC value ads. Just giving people saying, hey, what are you looking to spend? “Oh, I'm looking to spend less than $1,000.” Well we'll give you $1,000. Go in and look and see what you can buy. And they come out and they just show them. Those are completely unscripted commercials.

And you know why I know they're working? Because two weeks ago we got a call from the Apple legal department saying, hey -- this is a true story -- saying, "Hey, you need to stop running those ads, we lowered our prices." They took like $100 off or something. It was the greatest single phone call in the history that I've ever taken in business. (Applause.)

Seriously?

I hope this is more than just executive hyperbole. Not because it’s so hard to believe, but because it’s just damn funny.

Poor Quebec, This is Terrible

Wed, 15 Jul 2009 19:08:01 GMT

Microsoft certainly isn’t to blame here, it’s a law in Quebec that prevents contests from happening. Better chance for me to win it though!

Windows Virtual PC

Tue, 14 Jul 2009 18:58:23 GMT

Windows 7 is delivering a new form of Virtualization renamed Windows Virtual PC. It’s nice to see it better integrated with Windows. However there is one thing that I thought was odd about the integration:

You’ll notice on the Size attribute it shows the physical size of the config file, not the actual VM. Everything else is very useful, but it just seems a bit pointless and misleading. Perhaps it’s a bug. I hope it is anyway.

And now back to the regularly scheduled broadcast.

Silverlight 3.0 and Why Flash Still (unfortunately) Won

Mon, 13 Jul 2009 22:41:51 GMT

Last week Silverlight 3.0 was released. In Toronto, ObjectSharp put on a very cool launch event, with lots of great demos and compelling reasons to start using Silverlight immediately. I was impressed, but I’m a Microsoft fan-boy (fan-boi?), so that doesn’t count. It was certainly fitting that ObjectSharp propose using Silverlight for some parts of our new website www.woodbineentertainment.com, seeing as they won the bid to build the new site. I saw the potential; as did a few others on the team. However, some executives did not see the benefit. I respect their opinion, somewhat because I have to – they can fire me after all, and mostly because they have business sense on their side.

The company is very much on the cutting edge of technology in a few respects, but very conservative in the way we choose technology. For instance, our new site will be built on Microsoft Office SharePoint Server 2007. I’d wager there are less than a hundred publically facing websites on the internet that use MOSS (probably due to complexity and cost), yet we chose to use it because of the potential in further developing it in future iterations.

Silverlight on the other hand is a different story. Recent reports peg Silverlight penetration at around 25-30% of all browsers. Whether or not this is accurate, who knows. It’s the only data available. Flash penetration is at 96%. Now, in my opinion 25% growth in 2 years on Silverlight’s part is impressive. Flash has been around for nearly 2 decades. There is definitely a correlation to be made in there somewhere.

At this point, I was sold on using Silverlight. The exec’s still weren’t. Seeing as Silverlight is a browser plug-in, it must be installed in some way, shape, or form. At 25%, that means our customer demographic would have around 10% penetration. That is terrible. Getting them to install a plug-in to view site content is a tough sell. The executives didn’t want to scare away customers by making them install the plug-in. SharePoint doesn’t need a browser plug-in.

And here in lies the Catch-22

To expand our marketed audience, we build on Silverlight to give them more content that is better authored to their needs. In doing so, we lose customers because they need to install the plug-in. There is no metric at this point in time to help us extrapolate the difference. There is a reasonable risk involved with using such cutting-edge technology. We will use it when browser penetration is high enough, yet browser penetration won’t grow if sites like ours don’t use Silverlight.

Ah Well

I’m a technology risk taker. I live on the bleeding edge. I run Exchange 2010 beta, on Server 2008 virtualized on Hyper-V, with IIS7 running this site, browsed by IE8 on Windows 7 RC, and authored in Office 2007 (2010 if Microsoft would give me the flippin bits!). The company, not so much. Risk is good – as long as you can mitigate it properly. I can manage my risk, as it’s not the end of the world is something here crashes. I don’t lose an audience. If the company can’t market to it’s customers because the tools in use are too new, it will lose audience. Period. And that means lost revenue.

Maybe we can convince the exec’s in Phase II.

User Interface Failure, Succeeding

Wed, 08 Jul 2009 18:34:30 GMT

It’s not everyday an application interface is designed to purposefully confuse people. It mostly just kinda happens. There isn’t any malicious intent involved. However, I’ve had it with Adobe and Google.

First off, let me say that I am very disappointed in Adobe for keeping Shockwave alive. Merge it with Flash. Keep it down to one browser plug-in, jeez.

Second, shame on both companies for purposefully designing a confusing interface. I visited a site recently that had a Shockwave applet. I wanted to see it, so I installed the plug-in. Boom, up pops this window:

I read it as this: “Hey, you just started the installation of a plug-in. Click next to continue.” Whereas it actually said “installing plug-in. To install another plug-in you didn’t ask for, click next.” The insidiousness is in the form of a little checkbox that asks if you want the toolbar. The problem is that the checkbox looks like its part of the feature list, so naturally you just click next to continue installing the original plug-in.

It’s a nicely designed form. It conveys information perfectly. Except the information tricks you. It’s very malware-y. I would expect such a thing from Adobe; they are starting to really annoy me. But Google has always had the mantra of “do no evil”. I called phooey on that long ago, and this is a perfect example of their hypocrisy. I realize they play a very minor role in this situation, but they really should have rules about how people agree to install their software.

I spent a good chunk of my morning yesterday listening to someone complain about how Microsoft installs the .NET remote app installer plug-in into Firefox, and how inappropriate that is. In my opinion, this is way worse. Microsoft just did it. This is explicitly malicious. They go out of their way to confuse you so they can say “hey, you agreed to install it.” Phooey, indeed.

</rant>

Make it Right: Revisited

Thu, 02 Jul 2009 23:00:16 GMT

In the previous post Make it Right I asked the question

Why aren’t more people making it right?

I was curious why people don’t take the time to write software properly. There are lots of jokes about bad software development:

If houses were built the same way programmers build programs, we’d all be living on the street.

Unfortunately it’s a fair statement. Most programs out there suck*. I used to come back with the argument that people have been building houses for thousands of years, but software for only a few decades. There are bound to be issues. But then it occurred to me.

Mike Holmes is all about making it right, as I said in the previous post. His TV show was about fixing the problems that professionals made. Professionals who have been building the same thing people have built for thousands of years. Wait a minute. I just flawed my own argument.

Houses are built the same way programmers build programs.

Why?

I see three very apparent reasons.

Cheapness – People want software built quickly, as cheap as possible.
Laziness – Why strain your mental processing or follow best practices when you can just do whatever first comes to mind?
Uneducated – Sometimes (a lot of times) the person doing the building/development just doesn’t know what they are doing.

There are numerous other reasons why, but these three are by far the biggest across all aspects of building stuff. I think they answer the basic question asked earlier, but now I have another question.

Why do we let people who are lazy or uneducated build applications for us, just so we can save a few bucks? We will end up paying loads more in support after the fact…

*I said programs, not programmers.

Resources for Students who Hate School

Mon, 29 Jun 2009 18:50:18 GMT

I hated school. Technically, I’m still enrolled in college. Bachelors of Business Management. Blech. I figured at least with business, I would learn something useful later in life. I chose against Comp. Sci. for a few reasons. One being that I know a couple PhD’s that know nothing about building applications in the real world.

In Comp. Sci., you learn how to build data structures, and how to make Mandelbrot Set’s process faster. In business, you learn why people buy stuff. Or more appropriately, you learn how to get people to buy your stuff.

Seeing as I learned (taught myself?) about things like linked-lists and pointers while in grade 10-ish, and wrote/re-wrote/re-re-wrote Mandelbrot Set builders as a final project in grade 11, I think I can safely say I would be bored as all hell in University. Not to mention all the theory. Comp. Sci. is all about theory. Maybe 10% is actually coding. F-that.

Business is inherently hands-on.

I like hands-on. It’s tangible.

The only problem I had was finding resources. My programming teachers were pretty cool, and were always willing to help me on algorithms that confused me, as well as extra-curricular programs when something just wasn’t jiving. But I had cool teachers. Not everyone is as lucky as I was. And with the teachers, they weren’t thinking in C# or ASP.NET everyday like I tended to do. Trying to ask them why something trivial like

<asp:TextBox ID="txtUsername">

didn’t compile was kinda painful. I usually got a response along the lines of “what’s the colon for?”. I always felt funny trying to explain the quasi-xml structure of ASP.NET to teachers. This left me in a lame position of needing to find help. Forums are great, but separating the wheat from the chaff is a waste of time. Enter stackoverflow.com (4 years late, mind you) and you get answers quickly. I like it. I use it all the time. I’d like to think that those who are willing to look for resources will find the site fairly easily. However, there is another site out there that not too many people know about. It’s the Microsoft Student Experience site. Yeah yeah, brain wash them early. I drank the kool-aid early.

Part of the website is dedicated to the DreamSpark program. Free, fully-licensed Microsoft products. Nuff said.

The other half of the site is dedicated to students. Good thing, given the name. Not just students studying software development either. All students. It provides tangible resources for students. Stories, tutorials, and templates look to be the main content. It’s all surprisingly good stuff too. It ranges from school studies to general life, to post-school life.

These resources may help those students who are struggling with school – at any level. There are students out there with lots of potential. Let’s not see it go to waste.

Make it Right

Fri, 26 Jun 2009 20:54:53 GMT

For the last couple months I’ve had a strange fascination with the TV show Holmes on Homes. By no means am I construction-literate. When I want something built with wood, I buy it. The fascination is not about the construction, or even his manly good looks (FYI: I meant it in the friendly-way, not the friendly-way), but the premise of the show.

Mike Holmes is about doing a job right. It doesn’t matter what the job is; it HAS to be done right. Period. No if’s, and’s, or but’s. We need more people like him.

This applies to Information Technology as well. Take the Security Development Lifecycle for example:

Do it right first: securing new code helps keep down compatibility and roll-out costs.

Why aren’t more people making it right?

Reminder! Windows 7 Beta Expiration

Thu, 25 Jun 2009 14:13:54 GMT

Reposted without* permission from the Canadian IT Pro blog.

I just wanted to post a reminder that the Windows 7 Beta is set to expire on July 1st, 2009. What does that mean? Well it isn’t going to explode, eat your data or lock you out. What is going to happen is that the PC will force you to reboot every two hours. But have no fear there is a way to fix this, simply install the Windows 7 Release Candidate which you can still download.

While an upgrade isn’t supported, and I strongly recommend a clean install, you can find a workaround that will allow you to do an in place upgrade.

Grab the Release Candidate here!

* I never asked. I doubt they will care. Correct me if I am wrong, Rodney!

Techdays 2009 – VIP Pricing

Tue, 23 Jun 2009 18:12:49 GMT

As budgets get tighter, Tech·Days is the perfect way to get the Tech·Ed experience without the travel expense, with two days of skill-strengthening education to help you position yourself for success by:

Learning the technology—with a customizable agenda from over forty sessions across five technical tracks on both current technologies and new products, like Windows® 7 and Microsoft® Exchange 2010;
Connecting with Experts and Peers—with Birds-of-a-Feather lunches and the new Windows 7 Zone, you'll have lots of opportunities to share your ideas with those who know the products best; and
Apply what you learn—with a Learning Kit packed with products and resources so you can continue to grow your skills long after the event has finished.

Technologies discussed: Windows 7 Operating System, Windows Server® 2008 R2 operating system, Visual Studio® 2008 development system, Silverlight™ browser plug-in, Exchange 2010, Security/Management, and more.

If you want the VIP Discount use the promo code TD09Partner.

City	Date	Venue
VANCOUVER TD09Partner	SEPTEMBER 14-15	Vancouver Convention Centre
TORONTO TD09Partner	SEPTEMBER 29-30	Metro Toronto Convention Centre
HALIFAX TD09Partner	NOVEMBER 2-3	World Trade & Convention Centre
CALGARY TD09Partner	NOVEMBER 17-18	Calgary Stampede
MONTREAL TD09Partner	DECEMBER 2-3	Mont-Royal Centre
OTTAWA TD09Partner	DECEMBER 9-10	Hampton Inn & Convention Centre
WINNIPEG TD09Partner	DECEMBER 15-16	Winnipeg Convention Centre

Early Bird: $299, Regular Price: $599

There is a good chance I will be presenting at one (or more) of these locations, so keep an eye out. In the event that I don’t, I will definitely be enjoying the Toronto stop of the tour. In either case, I will be there ready to learn, with a pocket-full of business cards.

Oh, and I’ll be leaving with a box/bag/shopping cart* of swag.

*Metaphorical shopping cart. They are going to give away lots of awesome stuff.

Bing Search Provider

Sun, 21 Jun 2009 16:52:44 GMT

Seems it automatically updates itself in IE.

Cool.

Security, Architecture, and Common Sense

Sun, 14 Jun 2009 20:27:05 GMT

Good enough is sometimes not good enough. I’ve been doing a lot of thinking lately (well, I’m always thinking), and security has been an issue that has come up a lot. Frankly, I’m a two-bit software developer. I know my code isn’t the best, nor the most secure. I use strong passwords, encrypt my sensitive data, and try to limit access to the applications for those who need to use it.

In theory this works. Problem is, it’s a lame theory. There are so many unknown factors that have to be taken into account. Often times they aren’t.

When I go to build an application I spend time designing it and architecting it. This is usually the case for most developers. What I’ve noticed though, is that I don’t spend time securing it. I can’t.

Imagine building a house. You put locks on the doors, bars on the windows, and someone breaks in. Why? Because someone left the key in the door. You can’t build against that. You just can’t.

You can follow the Security Development Lifecycle, which I recommend to each every single developer I meet. There are tons of resources available. But it can only go so far. It’s designed more for being part of the iterative processes, not the architecture. Or at least, that’s how most people interpret it.

So?

My last post talked about Single Sign-On (SSO). It’s a great sellable feature for any product. What most people don’t realize though is the inherent security benefit to it. With it, that means one less password to remember, one less password that could get intercepted, one less password to change every month. This is a fundamental architectural issue. But at the same time, it’s common sense.

What is sometimes the simplest idea, is usually the correct solution

What the hell does that mean? It means keep it simple. Security is simple. Keep data from prying eyes, and keep it from getting lost. This is common sense.

Security is not difficult to comprehend. It becomes difficult when academics get involved. Spouting theories and methodologies scares people into thinking security is extremely difficult to implement. It’s not!

Follow the Data

Understanding the flow of data is crucial in properly architecting an application. It’s crucial in properly securing an application as well. SSO is a perfect example of this.

The SSO feature in Office SharePoint Server 2007 maps user credentials to back-end data systems. Using SSO, you can access data from server computers and services that are external to Office SharePoint Server 2007. From within Office SharePoint Server 2007 Web Parts, you can view, create, and change this data. The SSO feature ensures that:

User credentials are managed securely.

User permission levels that are configured on the external data source are enforced.

It makes perfect sense. It’s simple when you think about, and it affects every subsystem of SharePoint. Make security a feature.

Single Sign-On

Sun, 14 Jun 2009 16:53:37 GMT

Is it just me, or is Microsoft the only vendor out there that gives you SSO in all their products, free? Novell requires you buy their add-on product. Oracle has nothing relevant. Never gonna happen on any Linux distro out of the box. Too many variables.

The integration alone is reason enough to use Microsoft products. Is it just me, or do people choose to go anti-Microsoft out of spite?

Just a thought.

Technet Plus Subscriptions

Tue, 09 Jun 2009 19:52:44 GMT

You know, I don’t ever get the chance to tell people how useful these subscriptions are. They are extremely handy. I used mine at least once a week, but two or three times a week wasn’t out of the ordinary. The subscriptions give you direct access to Microsoft software for testing and creating proof of concepts. They also give you access to beta software, i.e. Windows 7 and Exchange 2010, before everyone else has a chance to get it.

You can also use them to manage support tickets, and even get professional help free. But here is my absolute favourite benefit of a Technet Plus Subscription: Free E-Learning. It gives you access to 3 Microsoft E-Learning Courses and Workshops, free. Stolen from the site, here’s the current offer:

With TechNet Plus, you receive ninety (90) days of access to Microsoft E-Learning with hands-on learning to help you build the skills you need to do your job. The following courses are available to TechNet Plus subscribers through June 30, 2009:

Course 4330: Working with Subqueries Using Microsoft SQL Server 2008 - In this 2 hour course, students are introduced to subqueries. Using common table expressions in queries to generate hierarchical result sets is also explored.
Course 7250: Managing Applications in a Windows Server 2008 Environment - This 2-hour course describes enhancements to the Application Server, Web Server, and Terminal Services roles in Windows Server 2008. It also provides guidelines for deploying applications on your servers. This knowledge helps you use the server roles to manage an organization’s application infrastructure.
Course 6321: Configuring a Virtual Environment - This two-hour online course provides IT professionals with knowledge about the tools used for configuring a virtual environment. These tools include virtual network, virtual hard disks, and virtual machines. This knowledge helps you gain the skills necessary for setting up a virtual environment.

Go get one now. Right now. $349 US.

Resources from the SQL 2008 Spatial Data Presentation

Fri, 05 Jun 2009 17:45:08 GMT

Here is the presentation. Click the screen shot to download a ZIP of the demo and slide deck.

Exchange 2010 Beta

Sat, 30 May 2009 20:11:09 GMT

A couple days ago Daniel Shapiro offered 10 people Virtual Servers hosted by Rack Force. I jumped on the offer, as I’ve been wanting to migrate this website to it’s own privately hosted server. It really came down to never having the time to test out hosts, so this was a perfect opportunity. Shortly thereafter I found out Exchange 2010 hit beta, and I wanted to run it through it’s paces.

After installing Active Directory, I installed the beta, which went really smooth. Given that it went smooth, I decided to update the DNS MX records for syfuhs.net to point to this server.

One thing I didn’t realize is you have to set up Receive Connectors and Send Connectors. The wording is kinda misleading, so I ended up setting my first Send Connector to only route mail going to syfuhs.net from syfuhs.net. Not so useful. The Receive connector was the same way. However, this is all similar to Exchange 2007.

Now some pictures:

Outlook Web Access

Exchange Management Console

IIS Manager Hosting Outlook Web Access

Always a Good Sign on a Friday…

Fri, 22 May 2009 19:37:41 GMT

There is something to be said for having an empty inbox on a Friday evening. Mind you, it is after 7:00PM though…

Presentation on Geospatial Data(types) in SQL 2008 – June 4th

Fri, 08 May 2009 15:41:36 GMT

I will be giving a presentation on Geospatial data in SQL 2008 for the Toronto SQL User Group on June 4th. It’s a full session of everything geodetic. There is no registration, so just show up. Doors open around 6:15 PM. The address is: Nexient 2 Bloor St. West at Yonge, downtown Toronto – 12th floor, Room 5.

The Fine Line Between Insanity and Clarity

Thu, 07 May 2009 02:12:49 GMT

The BBSM (Building Broadband Service Manager) is a Windows 2000 box that acts as a gateway to the internet for customer access. It handles that login page when you connect to the open WiFi network. It is the most convoluted piece of [insert noun here]. The guy who signs my paycheck had asked me a few weeks back to redesign said login page in keeping with corporate designs. It was also requested that it be mobile browser friendly. Classic ASP, running JScript (yes, JScript), in IIS 5 on Windows 2000 behind ISA Server 2000. The new layout was done in about an hour, and it looks pretty good. It has been 3 weeks and I still can't get the freakin mobile code working.

In a moment of insanity (clarity?) I got the bright idea to install .NET on the box and rewrite all the pages from scratch. Rewriting took a couple hours, and the mobile support works. Go to set it up on the box (which must be done via USB key, via Ops guy, via physically walking to box in DataCentre {which I don't have access to}) and come to find permission errors for the ASPNET account doing COM stuff. Needless to say I hate COM Interop with a passion. I even sunk to the level of giving the ASPNET account full admin privileges. Turns out Windows 2000 does not like COM Interop either.

"It looks nice if you use a laptop" was my statement to the boss. His response was "everyone is using PDA's and their iPhones. Maybe 10 customers use laptops."

Moral of the story: If the original code was written in the same year you turned 11, run. Quickly.

FTW: PHP on IIS

Sun, 19 Apr 2009 15:58:11 GMT

In my previous post I had said I saw some pretty interesting stuff on the Canadian Evangelist’s blogs. While I’m not a big fan of PHP for technical reasons (i.e. NOT philosophical), it is pretty cool that you can run PHP on IIS. So with that being said, we have a contest:

Wait a Minute…Microsoft and PHP?

You probably wouldn’t be surprised that Microsoft is holding a development contest that pits professional developers against student developers. You might be surprised that Microsoft is holding a development contest where the challenge is to build a PHP application.

You read that right: PHP. Microsoft’s web server, IIS (Internet Information Services) can run PHP as well as ASP.NET; in fact, it can even run both on the same site at the same time, so you can have apps like Wordpress along with your ASP.NET-based apps.

Even more unexpected is that the beta for the 2.0 version of the Microsoft Web Platform Installer doesn’t do a “couple-of-clicks” installation of the expected stuff like IIS and SQL Server 2008 Express, it also provides a “couple-of-clicks” installation of PHP and Wordpress.

The FTW! Throwdown

That’s “FTW!” as in “For the Win” or “For the Web”, by the way.

The contest is pretty simple: the idea is to show the best application written in PHP and deployed on Windows. The app can be either:

A new application developed by you in PHP and running on IIS in Windows
An existing application or framework written in PHP and ported by you to run on IIS in Windows

That’s right: if you’re pressed for ideas or time to make a new application, it’s all right – you can take a PHP application that already exists, make the necessary changes so that it’ll run on IIS (and hey, for bonus points, make it tie into SQL Server instead of MySQL), and submit that as your contest entry!

Students vs. Professionals

Another twist to the FTW! Throwdown is that we’re getting student developers and professional developers to challenge each other. The pros have experience and resources on their side; students have youthful energy and fewer distractions going for them. Not since “Pirates vs. Ninjas” has there been a challenge like this!

One application developed or ported by students and one application developed or ported by professionals will be chosen from the submissions for the Ultimate Challenge, which will be a final bout at Microsoft’s Make Web, Not War conference. In that last match, it “Two apps enter! One app leaves!”. Simply put, one of the apps – either the student one or the professional one – will be declared the Ultimate Champion.

As they said in Highlander: “There can be…only one!”

The Booty

We want to reward the best contestants for their efforts in the FTW! Throwdown, and we plan to do so with some pretty nice prizes, which include:

The grand prize: $5000 for the winning entrant.
The runner-up prize: $3000 for the runner-up.
The SQL Server prize: $3000 for the finalist whose app showcases the best use of PHP with a Microsoft SQL Server database.
The PHP/.NET Mash-Up prize: $2000 for the finalist whose app showcases the best of PHP with .NET-based code working together in a single application.
The student finalist prize: The student developer who makes it to the last match will also get an interview and resume critique from Microsoft and a $200 Petro-Canada gas card.
The professional finalist prize: The professional developer who makes it to the last match will also get a chance for a published case study, enrollment in the MAPS or EMPOWER program and a $200 Petro-Canada gas card.

Ignite Your Career Webcast Series for IT Architects

Sun, 19 Apr 2009 15:52:11 GMT

I’m not usually one to repost from other blogs, but the last few I’ve seen from the Canadian Evangelist’s from Microsoft have been pretty exciting. The first is the Ignite Your Career Webcast series for IT Architects. There was a string of IYC Webcasts put on by Rick Claus over March for the IT Pro’s about lots of interesting topics. This Series is all about the developers. That is such a nice statement to hear: “…all about the developers”. Enjoy!

The IT Architect team here in the Canadian Developer & Platform Group are getting really excited... and this webcast series is why!

Starting on the 5th of May we're going to be joined by IT Architects from around the country to talk about career issues in challenging times. We're going to discuss industry trends and insights, skills development, entrepreneurship and organizational competitive advantage through careful use of IT - all in the context of furthering our careers as IT Architects.

The webcasts will be one hour long starting at 12 noon Eastern and will consist of a panel discussion with our invited guests. Every week we will tackle a new topic with a goal of taking as many questions as we can get from you the audience. This is your opportunity to learn about best practices and ways of honing our careers from individuals around Canada who have excelled in the IT industry. Be sure to visit the Ignite Your Career MSDN website to register for each of the sessions that interest you.

This is interesting…

Sun, 29 Mar 2009 00:00:00 GMT

I’m fairly certain there’s a good reason for this, but I just thought it was interesting because these are not hashes. They are actual encrypted passwords. Statistically improbable to get something like this in production systems. Completely understandable in development. Just thought it was interesting to see.

Consultation to Salary – Theoretical Head Banging Meets the Real World

Sat, 14 Mar 2009 19:57:35 GMT

A few weeks ago, six or so, I was offered a position as a Software Developer for the Woodbine Entertainment Group. The position looked appealing so I accepted the job offer. I am in a probationary period for the next four months and a bit. Anything I say can be grounds for firing me. Never liked that part about non-contract jobs. Ah well.

Woodbine is an interesting company. I knew very little about it until I got word of the job. Seems I was the only one in Canada who didn’t know the company. My grandmother, who moved to California 50 years ago, knew about the company. Even used to bet there – well, the Woodbine Race Track, before it moved. It has an interesting history.

It is migrating to be a Microsoft shop, from a more Novell focused infrastructure. We are working towards standardizing on .NET for our custom applications.

The one thing that caught my eye with Woodbine is that the company is the technology leader for Horse Racing. Not just in Canada, but throughout the world. Our services can let you place a bet live, on a track in Australia, and see results immediately. Can you imagine the infrastructure required for such a feat? It’s sweet! The business-people behind this are really keen on letting technology do it’s thing, so we can make money. Lots of money. See our Annual Reports on that. Check back for latest numbers.

Now, some of you may have noticed that our Corporate Portal is written in what looks to be Classic ASP. For all intensive purposes, it is. Archive.org shows the portal went live in 2001, and had a major rebuild in 2003. Since then incremental changes have taken place, most of which have been built using ASP.NET. We are working on the new portal. All I can say at the moment is: it’s going to be awesome. So awesome that a new word will need to created to contain all of its awesomeness. HorsePlayer Interactive is pretty amazing, but I’d like to think this new site will be just that much more awesomer. Yes, I said awesomer.

As for the nature of this site, it won’t change. I’ll still post my thoughts and experiences. I might need to change stories a little to protect the innocent, but it’s all in good fun. I may be forced to post details of how horse racing actually works, because I’m still not sure I get all the facets of it. In time.

More to follow.

For the love of god, stop saving my Internet Explorer session!

Tue, 10 Feb 2009 00:13:41 GMT

There is a relatively new feature in IE that reloads your session if IE gets unstable. A godsend for poorly built pages and badly written ActiveX controls, but when I want to close the window, let me close the fricken window.

Notice the three iexplore.exe processes running? I have one window open, and 1 tab open. For each tab I open a new process is spawned. For each tab I close, nothing. For each spawned process I manually try to kill, a new process is automatically started, via this lovely new feature. If I close the parent iexplore.exe process, they all go away as they should. But when I try to kill one of these spawned little bastards, IE thinks it got unstable, so it tries to save the session by restarting the downed process. Lovely.

Solutions? Stop bitching because I’m running IE 8 beta, on Windows 7 beta, on a laptop that is slowly becoming more unstable each and every waking day.

I’m thinking I’ll buy a nice E6500 from Dell. Or maybe an X200 Tablet from IBM…err, Lenovo. I’ll have to make a decision within the next couple days. I can’t stand when hardware makes the system unstable. Just makes me want to throw the freakin thing off the roof. Hey…that’s a pretty good idea. Pictures to come, guaranteed!

Balanced Audio Connections

Sun, 01 Feb 2009 18:41:21 GMT

Someone once told me that a balanced audio connection works because of polarity. I wish I had a rolled up newspaper so I could swat him with it on the nose. Balanced systems are used to keep noise and interference out of systems. It is a common myth that balancing a system involves polarity. It does not. Polarity plays a part in keeping interference out, but the real reason balanced systems work has to do with impedance.

This type of connection is known as an unbalanced system. There is only one connection leaving the Op-Amp in device A. The second connection is ground. In device B the signal is brought in on one leg of the Op-Amp and the the second leg is a replica signal sourced to ground (or reference). In other words the signal is the same except opposite (polarity). There is absolutely nothing preventing noise and interference from entering this system.

This is a balanced input. Notice how the input connector has 3 connections instead of 2.

This a balanced output. Notice the 2 Op-Amps and 3 connections. The balanced system has both connections equally referenced to ground. How this prevents interference is an idea called Common-Mode Rejection (CMR). Because interference hits all three wires in a cable at once, they will all have an equal level of extra noise. It is voltage essentially. When the signal enters the Op-Amp at the input it looks at the ground line and sees what’s on it. It then compares what it sees on the two signal lines. It kicks out what all three have in common. Hence Common-Mode Rejection.

This is theory though. Not all inputs are perfect, and because all cables have something called cable capacitance, voltages differ minutely on each wire within the cable and the rejection doesn’t work as well as the theory states it should. But it still works pretty darn well. There is a whole science devoted to developing a standard for getting better CMR. One of my favorite resources is Jensen Transformers’ Bill Whitlock. He is a freakin genius. Here is his seminar handbook on balanced and unbalanced connections. This is where it all started making sense to me.

Enjoy!

Proper Podcasting Equipment

Sun, 25 Jan 2009 17:30:30 GMT

I am not a podcaster. I do not think I have the voice for continued listening. However, I am a sound guy, and I am anal about it. I did a search online to find out what equipment is necessary for podcasting and every time I came back with:

Microphone
Pre-amp
Digital Recorder
PC Editing Software

For each item on this list I have heard some very disturbing suggestions for what type/brand to use. I thought I would dispel some myths about each piece of hardware.

Microphone

Behringer is not a professional product line. They say they are; they are NOT. I said it, and I will say it again: Behringer does not make professional equipment. No way, no how. They market the products as professional equipment that all the big stars use, but in actual fact the equipment would never make it on a tour. It can’t. It’s not stable enough, and it’s not reliable enough. It WILL break.

Enough ranting about that. There are two main types of Microphones you will be dealing with when podcasting. Dynamic and Condenser. They both have their merits. Dynamic microphones are usually cheaper because they are easier to make. The sound quality is theoretically lesser than a Condenser Mic. And a Dynamic Mic does not need an external power source.

Sound quality is always an issue when recording. However, a podcast is 99% vocal. At least on the recording side it is. On the frequency spectrum vocals range between 80 Hz and 1100Hz. You do not need a super-ultra-fantastic microphone for this job. In some cases you do, but generally if that were the case you wouldn’t be reading this article – you would be talking to an audio recording professional.

You also have your choice between a Cardioid and an Omni-directional Mic. An Omni-directional microphone will pick up sound from 360 degrees. It’s great for dealing with multiple people talking at once, but horrible if you are talking in a loud environment. A Cardioid (pronounced: car-dee-oid) microphone is directional. It will pick up sound from a single direction, and is excellent if you are the only person talking in a very noisy environment.

My two cents: go talk to a sound guy directly and tell them what you are doing. They will understand. Brand-wise I like Shure and Sennheisser. By all means contact me if you want more help.

Pre-amp

A pre-amp will do one of two things, but first I need to explain how a microphone works. Essentially a microphone works by producing a very small electrical signal that is a representation of the sound hitting a membrane within the microphone capsule. Different types of microphones (electret, condenser, dynamic, piezoelectric etc) capture and translate the frequency patterns differently. The important thing to know is that the electrical signal coming out of the microphone is extremely low.

The voltage is so low that most recorders cannot handle the voltage. They need more. A pre-amp takes care of this problem. It amplifies the signal just enough so the recorder can use it properly. In some cases microphones need voltage going to them before they can actually produce a signal. Condenser microphones are notorious for this. The required voltage is called Phantom Power. It’s a long winded explanation of what actually happens with the phantom power, but for all intensive purposes, the pre-amp will usually take care of the phantom power too. This is definitely something you need to talk to a sound guy directly about.

Digital Recorder

I never got into digital recording, but just from basic analog to digital conversion theory, here are some thoughts:

Get a recorder that converts to a lossless format. .Wav files are the most standard. When recording you want the highest possible quality available.
Get a recorder that has a balanced audio input. XLR is balanced. Get a microphone that outputs through XLR, and a pre-amp that takes XLR and outputs XLR. You will end up with better quality. Balanced connections do wonders for interference. It won’t remove interference already in the system, but it will prevent any other from getting in.
Get one that is durable. You will drop it. You just will.

PC Editing Software

For editing the podcast you want a piece of software that can handle multiple tracks. This allows you to layer chunks of audio without losing data. It also gives you more wiggle room to move parts around. I like Adobe Audition. There are many others out there though.

Microsoft and the Antitrust Browser...A Decade in the Making

Fri, 16 Jan 2009 18:18:53 GMT

It seems just like yesterday that some government was telling Microsoft that the bundling of Internet Explorer with Windows was unbecoming of an industry leader, because it screwed other web browsers out of market share.

The European Union has made a decision stating Microsoft cannot bundle Internet Explorer with Windows anymore, if they want to sell in any European countries. This decision was the result of Opera Software ASA, the people behind the Opera browser. The complaints are two-fold.

Market share is nearly seized completely by IE because it comes preinstalled with Windows, which is the dominant operating system.
Because the majority of browsers are IE, websites need to conform to IE’s html rendering which is “non-standard”.

I’d agree with the first statement, but I find it bogus. Regardless of whether or not IE has dominant market share, you still need a browser. How would you get your hands on the installation files for the new browser? Certainly not by downloading it from the internet… You can get the software from the store. Not likely. That just means one more piece of software to worry about. You can have the browser company mail it to you. Is Firefox a company? Do they have offices? Seriously? WTF? Oooh, or maybe Microsoft can have a basic version of a web browser, that all it does is go to one specific site. The site then has a list of all available web browsers on the market, which you can then download. I’m actually at a loss to say for once.

With regards to the second point, Internet Explorer certainly does not have a great track record for sticking to HTML standards. But I have to say Firefox, Opera, Safari, etc, don’t conform either. None of them conform to the HTML standards completely. With that being said, Internet Explorer 8 is supposed to be ACID 2 compliant, meaning it is compliant at least as much as everyone else. In other words, it shows the face:

I’m going to keep an eye out for news from the EU, because I suspect they will overturn the ruling in some way or another. Some people say Internet Explorer is only to be used to download Firefox. Now that it’s not there, how the hell do you plan on downloading Firefox, eh?

Windows LiveID Almost OpenID

Tue, 13 Jan 2009 20:55:12 GMT

The Windows Live team announced a few months ago that their Live ID service will be a new provider for the OpenID system. The Live team was quoted:

Beginning today, Windows Live™ ID is publicly committing to support the OpenID digital identity framework with the announcement of the public availability of a Community Technology Preview (CTP) of the Windows Live ID OpenID Provider.

You will soon be able to use your Windows Live ID account to sign in to any OpenID Web site.

I saw the potential in OpenID a while ago, long before I heard about Microsoft’s intentions. The only problem was that I didn’t really find a good way to implement such a system on my website. Not only that, I didn’t really have a purpose for doing such a thing. The only reason anyone would need to log into the site would be to administer it. And seeing as I’m the only person who could log in, there was never a need.

Then a brilliant idea hit me. Let users create accounts to make comment posting easier. Originally, a user would leave a comment, and I would log in to verify comments, at which point the comment would actually show up. Sometimes I wouldn’t log in for a couple days, which meant no comments. So now, if a user wants to post a comment, all they have to do is log in with their openID, and the comment will appear.

Implementing OpenID

I used the ExtremeSwank OpenID Consumer for ASP.NET 2.0. The beauty of this framework is that all I have to do is drop a control on a webform and OpenID functionality is there. The control handles all the communications, and when the authenticating site returns it’s data, you access the data through the control’s properties. To handle the authentication on my end, I tied the values returned from the control into my already in place Forms Authentication mechanism:

if (!(OpenIDControl1.UserObject == null))
{
    if (Membership.GetUser(OpenIDControl1.UserObject.Identity) == null)
    {
        string email = OpenIDControl1.UserObject
                       .GetValue(SimpleRegistrationFields.Email);
        string username = "";

        if (HttpContext.Current.User.Identity != null)
        {
            username = HttpContext.Current.User.Identity.Name;
        }
        else
        {
            username = OpenIDControl1.UserObject.Identity;
        }

        MembershipCreateStatus membershipStatus;
        MembershipUser user = Membership.CreateUser(
            username,
            RandomString(12, false),
            email,
            "This is an OpenID Account.  You should log in with your OpenID",
            RandomString(12, false),
            true,
            out membershipStatus
            );

        if (membershipStatus != MembershipCreateStatus.Success)
        {
            lblError.Text 
                    = "Cannot create account for OpenID Account: " 
                    + membershipStatus.ToString();
        }
    }
}

That’s all there is to it.

Dammit!

Tue, 13 Jan 2009 15:46:52 GMT

It seems my beta version of Windows 7 is not genuine. Next Time I’ll just torrent an .iso from the internet instead of getting it from TechNet. Doh!

Actually, it seems I hit the bug that affects all beta builds. I accidentally set my clock forward a year (don’t ask), which is after this beta expires. An honest mistake on my part, but the question is how the hell do I prove it’s now genuine?

At the moment there is no Genuine Advantage application for Windows 7, so if this starts causing me grief I might have to reinstall Windows. Hopefully I can just change the product key. We shall see.

A Waste of People’s Time

Tue, 13 Jan 2009 13:05:00 GMT

Someone pointed this out to me: http://it.gps678.com/9/ce1882bb886e17de.html.

It seems I wrote a game called FizzVaders. XNA Game Studio’s must be pretty freakin’ good, if I can write a game in my sleep. Cuz I sure don’t remember!

On a more serious note, this is lame. It’s a randomly pieced together forum thread, with misleading names. I’m not sure what the purpose is for this type of site. I can think of only two reasons: it’s a link farm, or it’s used for advertising. I suppose it’s better than the time a porn site indexed the CanITPro blog, and had my guest posts show up on Google under said porn site. That was awkward…

Generally, when someone search’s for me, or I search for someone, I want information on them. I don’t want link lists or porn. Unless I’m looking for porn. ;) So how does a search engine filter these types of sites out?

SQL Server 2008 Spatial Data

Fri, 09 Jan 2009 21:28:58 GMT

I’ve been a little reticent in my posts on SQL Server 2008 lately. It certainly didn’t come down to being too busy, as I’ve had far too much time on my hands in the last month. But, I suppose writing these technical posts always came from looking for something to do while procrastinating on another project. Which is odd, because I never found writing all that easy…

Getting back to the topic at hand, lets talk space. I did a lot of talking on spatial data (literally) in presentations and sales talks, but didn’t really write too much on it. So, much like my talks, lets do some basic research.

Spatial data in SQL Server is handled by a Complex Data Type. It references a point in space, by way of coordinates (x, y, z). Usually they are handled in degrees, referring to latitude and longitude. However this not always the case. You can use your own scale or units if you are mapping flat surfaces, which I will explain in a moment.

So what are the data types?

You have two to choose from:

Geography data type
Geometry data type

With the Geography data type you store geodetic values, which reference the Lat/Lon values. You would use this on a large scale, where the curvature of the earth has an effect (or any spherical surface for that matter).

The geometric data type can be used with any units, as it represents simple coordinates (x, y, z) on a flat surface. You can use this on any scale, as long as you don’t have to take into account spherical curvature.

Now, just referencing a single point can have its uses, but a lot of times you want to store more than a single point. Like if were storing a selection of area. This is done by using a collection of points that form a polygon. You can also store a collection of points that create a line. This could be useful if you were storing routes.

Using the data types

A point in space:

-- Creates a point instance representing the point (3, 4) with an SRID (Spatial Reference System Identifier) 0.
DECLARE @g GEOMETRY;
SET @g = GEOMETRY::STGeomFromText('POINT (3 4)', 0)

SELECT @g.STX
SELECT @g.STY
SELECT @g.Z
SELECT @g.M
GO

Create a polygon (known as a multipoint):

-- Create a polygon
DECLARE @g GEOMETRY;
SET @g = GEOMETRY::STPolyFromText('POLYGON((0 0, 0 3, 3 3, 3 0, 0 0), (1 1, 1 2, 2 1, 1 1))', 10)

SELECT
    @g.STStartPoint().STX AS 'Point 1 - X',
    @g.STStartPoint().STY AS 'Point 1 - Y',
    @g.STPointN(7).STX AS 'Point 7 - X',
    @g.STPointN(7).STY AS 'Point 7 - Y'
GO

Create a line:

-- Creates a line with 3 points (1/1, 2/4, 3/9) and a SRID of 0
DECLARE @g GEOMETRY;
SET @g = GEOMETRY::STGeomFromText('LINESTRING(1 1, 2 4, 3 9)', 0)

SELECT
    @g.STStartPoint().STX AS 'Point 1 - X',
    @g.STStartPoint().STY AS 'Point 1 - Y',
    @g.STPointN(2).STX AS 'Point 2 - X',
    @g.STPointN(2).STY AS 'Point 2 - Y',
    @g.STEndPoint().STX AS 'Point 3 - X',
    @g.STEndPoint().STY AS 'Point 3 - Y'
GO

Now some function fun

Figure out where the instances intersect:

-- Return the points where the two geometry instances intersect each other
DECLARE @geom1 GEOMETRY
DECLARE @geom2 GEOMETRY
DECLARE @result GEOMETRY

SELECT @geom1 = GeomColumn1 FROM SpatialTable WHERE ID = 1
SELECT @geom2 = GeomColumn1 FROM SpatialTable WHERE ID = 2
SELECT @result = @geom1.STIntersection(@geom2)
SELECT @result.STAsText()
GO

Make some calculations (using your own units if you wish):

-- Doing some calculations
DECLARE @g GEOMETRY;
SET @g = GEOMETRY::STPolyFromText('POLYGON((0 0, 0 3, 3 3, 3 0, 0 0))', 0)

SELECT
    @g.STArea() AS 'Square meters',
    @g.STLength() AS 'Length',
    @g.STDimension() AS 'Dimensions'
GO

Conclusion

This is by no means an in depth article on Spatial data. I always thought spatial data was fairly straightforward, so explaining what it was in depth was a little redundant. However, it doesn’t always translate properly to using

Zune Player

Tue, 06 Jan 2009 21:45:10 GMT

At first I was a little skeptical at the quality of the Zune Player, as it’s basically in direct competition with Windows Media Player. In retrospect, that’s probably what made it what is today. It’s designed to sync the Zune media player, and it works very well as an alternative to Media Player. There are a couple problems that I have with it though:

It’s a resource hog
It requires a good video card to show effects
It sorts things in weird ways when meta data is missing

The Zune Player is built on .NET. It has a very big initial memory footprint. It gets better as it settles into place. My assumption is that it’s using WPF to make itself look pretty, and that’s where all the effects come from. As a result some video cards aren’t capable of handling the effects renderings. For instance, my laptop’s video card just dies when the effects are on. Zune will turn them off if need be. If the Album Artist meta tag is empty, Zune sticks “Various Artists” in place thereof. Zune sorts based on Album Artist in the default view, so when I loaded my library into it, a whole whack of songs where under Various Artists, which isn’t all that useful. With that being said, all the (legally) downloaded content had proper meta tags and were sorted perfectly.

However, with all the negatives, comes a few gems. Sorting is a breeze. Playlists are extremely easy to build. Filtering works. And it’s a really slick UI.

I’m a little miffed the band image is pixilated, but all the extra info brought with it makes up completely. Talk about slick.

It also makes decent random playlist decisions. On the UI and UX side of things it gets the job done. It’s pretty stable. It hasn’t blown up on me yet. I give it my approval. Check it out: www.microsoft.com/zune.

A Collection of Personal Essays

Tue, 06 Jan 2009 17:47:59 GMT

I was thinking earlier about what the best way to organize all the longer posts I’ve written was. If my last sentence was any meter for what’s in these posts, I’m sorry! In any case, I wanted to label them as more than posts. Wikipedia defines an ‘essay’ as:

An essay is usually a short piece of writing. It is often written from an author's personal point of view. Essays can be literary criticism, political manifestos, learned arguments, observations of daily life, recollections, and reflections of the author.

One of these days I’m going to write a plug-in for Windows Live Writer that takes a search query and looks it up on Wikipedia. It then heuristically finds the best definition of said query and sticks it in a <blockquote> tag.

Anyway, back to the topic. Based on Wikipedia’s definition of an Essay, I can easily call any of these longer posts an essay. So what I’m going to do is make a static link to this post in my Navigation section, and have a list of links to said essays below.

More to follow. I just need to make them available online. And yes, it is very coincidental that at first glance they all reference xkcd.

What Makes us Want to Program? Part 5

Sat, 03 Jan 2009 07:38:58 GMT

In Part 4 I discussed a supposition I made a few years ago in High School. The supposition suggested that genius programmers can do what they do not only because they are left-brain oriented, but because they have a well developed Pre-Frontal Cortex. It is neither fact nor fiction. Simply an idea.

So why the hell does it make us want to program?

It all comes down to curiosity. The Pre-Frontal Cortex governs mediating conflicting thoughts, makes choices between right and wrong or good and bad, and governs the workflow involved in predicting future events. Curiosity is the result of the conflict between knowing and not knowing. Part of it is the decision process to figure out if you really want to know, and if you choose to know, what will happen as a result.

With that being said, Neuroscience studies into curiosity are still in the infancy stages, so the requisite proof is no where to be found yet. At the moment, curiosity is seen to come from the Caudate Nucleus in the Basal Ganglia of the brain. It is known for Learning and Memory.

So, if we are curious about something, it excites the Pre-Frontal Cortex. If we are left-brained in nature, and our curiosity steers us in a direction of problem solving or logic (something we are good at) the brain excites the pleasure centers, and when our pleasure centers get excited we enjoy what we are doing.

With a well developed Pre-Frontal Cortex, our curiosity is magnified. But then again, this is simply an idea.

What’s with the history lesson then?

Each part of the story was the result of curiosity. I started with QBasic because I read an article in Popular Electronics (I’m surprised it was still published at the time) that required a computer interface. I didn’t understand the article (remember I was around the age of 9) so I tried to understand the code.

I couldn’t understand the language enough to do anything meaningful so I started learning HTML. Something far simpler to grok. This was the case throughout the story. The impetus behind all my actions was curiosity.

It wasn’t until Grade 9 that I found PHP which really allowed me to understand programming. It certainly wasn’t over a weekend that I learned it, but nevertheless the cartoon makes you ask: why would you spend a weekend messing with Perl (or any other language)? Curiosity, that’s why! It’s this thing called curiosity that is useful to career success.

Schooling will get you in the door, but your curiosity will make you succeed.

What Makes us Want to Program? Part 4

Sat, 03 Jan 2009 06:54:51 GMT

In my previous post, I started talking about using Microsoft technologies over PHP and open source technologies. There were a couple reasons why I chose to make the move. First, from a development perspective, everything was object oriented. PHP was just getting started with OOP at the time, and it wasn’t all that friendly. Second, development time was generally cut in at least half, because of the built in controls of ASP.NET. Third, the end result was a more rich application experience for the same reason. The final reason comes down to the data aspect.

Pulling data from a database in PHP wasn’t easy to do. The built in support was for MySQL, with very little, if next to nothing for SQL Server. In a lot of cases that isn’t always a bad thing. MySQL is free. You can’t argue with that. however, MySQL wasn’t what you would call ACID compliant. Defined, MySQL did not have the characteristics of being Atomic, Consistent, Isolated, and Durable. Essentially, when data goes missing, there is nothing you can do about it. SQL Server on the other hand is very ACID compliant. This is something you want. Period.

Once .NET 2.0 was released, a whole new paradigm came into play for data in a web application. It was easy to access! No more, or at least next to very little boiler plate coding was necessary for data access now. Talk about a selling point. Especially when the developer in question is 16 going on 17.

Now that I didn’t need to worry about data access code, I could start working on figuring out SQL. At the time t-SQL scared the crap out of me. My brain just couldn’t work around datasets. The idea of working with multiple pieces of data at once was foreign. I understood single valued iterations. A for loop made sense to me. SELECTs and JOINs confused me. Mind you, I didn’t start Statistics in math until the following year. Did SQL help with statistics, or did statistics help me finally figure out SQL? It’s a chicken and the egg paradox.

So here I am, 17 years old, understanding multiple languages, building dozens of applications, and attending developer conferences all the while managing my education in High School. Sweet. I have 3 years until the next release of Visual Studio comes out. It was here that I figured I should probably start paying more attention in school. It’s not so much that I wasn’t paying attention, it’s just that I didn’t care enough. I put in just enough effort to skate through classes with a passing mark. It was also at this point in time that I made an interesting supposition.

Experts tend to agree that people who are programming geniuses are also good at math and critical thinking or reasoning. Not one or the other, but both. Now I’m not saying I’m a programming genius, but I suck at math. It was just never in the cards. But, according to all those High School exams and the psychological profiling they gather from them, my Critical Thinking and Reasoning skills are excellent. Top 10% in Canada according to the exam results. My math skills sit around top 20-30% depending on the type.

Neurologists place this type of thinking in the left hemisphere of the brain. The left brain is associated with verbal, logical, and analytical thinking. It excels in naming and categorizing things, symbolic abstraction, speech, reading, writing, arithmetic. Those who live in the left brain are very linear. Perfect for a software developer.

The supposition I made had more to do with the Pre-Frontal Cortex of the brain. It does a lot of work, some of which is planning complex cognitive behaviors. Behaviors like making a list, calculating numbers, abstracting thoughts, etc. It plans out the processes our brains use to get things done. This is true for both sides of the brain. So, suppose you are left brain-oriented. You are predisposed to be good at development. Now, suppose your Pre-Frontal Cortex is very well developed, more so than the average person. It could be reasoned that part of being a programming genius is having a well developed Pre-Frontal Cortex.

So why does this make us want to program? Find out in Part 5.

What Makes us Want to Program? Part 3

Sat, 03 Jan 2009 06:03:58 GMT

In my second post I discussed my run in with ASP, and how PHP was far better. I ended the post talking about an invitation to a Microsoft event. This was an interesting event. Greg and I were the only people under 30 there. When that’s a 15 year difference, things get interesting. Especially when you need your mother to drive you there… The talk was a comparison between Microsoft based technologies and Linux based technologies. The presenter was a 10 year veteran of IBM, working on their Linux platform, who then moved to Microsoft. For the life of me I can’t remember his name.

His goal was simple. Disprove myths around Linux costs versus Windows costs. It was a very compelling argument. The event was based around the Windows Compare campaign. It was around this time that Longhorn (Longhorn that turned into Vista, not Server 2008) was in pre-beta soon to go beta, and after discussing it with Greg, we decided to probe the presenter for information about Longhorn. In a situation like that, the presenter either gets mad, or becomes really enthusiastic about the question. He certainly didn’t get mad.

Throughout the rest of the talk, the presenter made some jokes at mine and Greg’s expense, which was all in good fun. Based on that, we decided to go one step further to ask how we can get the latest Longhorn build, at one of the breaks. the conversation went something like this:

Me: So how do people get copies of the latest build for Longhorn?
Presenter: Currently those enrolled in the MSDN Licensing program can get the builds.
Me: Ok, how does one join such a licensing program?
Presenter: Generally you buy them.
Me: How much?
Presenter: A couple thousand…
Me: Ok let me rephrase the question. How does a student, such as myself and my friend Greg here, get a the latest build of Longhorn when we don’t have an MSDN subscription, nor the money to buy said subscription?
Presenter: *Laughs* Oh. Go talk to Alec over there and tell him I said to give you a student subscription.
Me: Really? Cool!

Six months later Greg and I some how got MSDN Premium Subscriptions. We had legal copies of almost every single piece of Microsoft software ever commercially produced. Visual Studio 2005 was still in beta, so I decided to try it out. I was less than impressed with Visual Studio 2003, but really liked ASP.NET, so I wanted to see what 2005 had in store. At the time PHP was still my main language, but after the beta of 2005, I immediately switched to C#. I had known about C# for a while, and understood the language fairly well. It was .NET 1.1 that never took for me. That, and I didn’t have a legal copy of Visual Studio 2003 at the time.

Running a Longhorn beta build, with Visual Studio 2005 beta installed, I started playing with ASP.NET 2.0, and built some pretty interesting sites. The first was a Wiki type site, designed for medical knowledge (hey, it takes a lot to kill a passion of mine). It never saw the light of day on the interweb, but it certainly was a cool site. Following that were a bunch of test sites that I used to experiment with the data controls.

It wasn’t until the release of SQL Server 2005 that I started getting interested in data. Which I will discuss in the my next post.

What Makes us Want to Program? Part 2

Sat, 03 Jan 2009 05:21:13 GMT

In my previous post I started talking about part of my personal history with software development, and when QBasic got me hooked. I ended the post talking about the move to Canada. We arrived in Canada literally a week (7 days exactly) before Grade 9 started. After getting enrolled in school, I tried to find something to keep my mind occupied. It was either that or contemplate what Grade 9 would be like for someone who used to live 3000 miles away in another country. And winter. Still 4 months away, but definitely something I didn’t want to think about. Being that we moved to a house in the country, I couldn’t just walk around town either. Mental occupation was harder than I thought.

So what does a 14 year old boy, new to the country, living in the middle of nowhere, do to keep himself from going crazy? Install Linux of course! I needed something to keep my interest, as well as to keep the gears in my head moving. If memory serves, I started out with a vanilla copy of Red Hat Linux. It was pretty easy to install, but being new to the OS architecture, the device mapping was a little confusing. After a couple months of studying the Linux architecture, I started writing shell scripts, and even delved into the source code. After testing some minor modifications to different components I started to learn the basis for the C/C++ languages. Imagine that, a 14 year old kid understanding the basis for C++.

While trying to keep my mind still occupied, I came across an interesting find: The National Security Agency’s Security Enhanced Linux Kernel. If compiled and installed wrong, you will destroy the build. Learned that the hard way… And seeing as I couldn’t find a proper driver for my modem anyway, I gave up on Linux and moved back to XP. Not that the internet was all that useful anyway; I was connecting at 28.8 half the time.

Going back to the image in Part 1, I met an interesting character in school. He turned out to be one of my best friends, and fellow developers, Greg. We started working on some odd projects here and there in VB, until I was tasked with building a web store. Since I had never actually brought HTML and Dev together, I was a little nervous about what I was getting myself into. Going with what I knew well, I started in ASP with VB code. This was not ASP.NET. Earlier, I had said I never found VB all that intuitive as a language. The syntax never really made sense to me. So my friend suggested I take a look at PHP as an alternative. I liked it.

PHP had the flow of C, and the usefulness of VB. With PHP I got the store finished and launched. The site worked great. I was 15.

Once the first spring of my existence in Canada rolled around, a couple friends and I decided to start a band. We sucked. But seeing as one of the other members was Greg, we had an awesome website. We had media streaming, custom modified forums, and full site statistics. The statistics were built around the forum. The site pulled data from recent posts, recent events, and recent user logins, and compared the data to the media streams. We could see who was doing what. Mind you, there was only about 50 people who loitered around the site, but the site was a great proof of concept for what we could do.

Following the demise of the band, Greg and I were invited to a Microsoft hosted event. It was here that I fell in love with ASP.NET. Which I will discuss in Part 3.

What Makes us Want to Program? Part 1

Sat, 03 Jan 2009 04:33:34 GMT

When I saw this comic a couple weeks ago, it hit a chord just right with me.

Except of course it was PHP, and grade 9. The funny thing was, I started writing programs way back when I was in grade 5. I tried to start learning development when I was in grade 3. Let me tell you, there are certain subtleties to programming that don’t quite become apparent to a 9 year old.

10 PRINT “Steve is Awesome!”
20 GOTO 10

While QBasic was fun to play with, I gave up on that when I found a book on Visual Basic in Grade 5. I vaguely remember it being Visual Basic 5 too. I could be wrong. It was a little more than 10 years ago – you do the math. The problem I found with VB was that it didn’t feel all that intuitive from a language perspective to me. I could never find it to flow properly. But at the time, that’s all I had to go on. So I gave up on development for a while and tried my hand at HTML. Once again, certain things just aren’t apparent at certain ages. When I first tried HTML, I started in notepad. Shortly thereafter I ended in notepad. Maybe sports would be more fun? Nah… Enter FrontPage a few months later.

After finally getting the hang of FrontPage, I built some amazing (read: ugly) sites. All-in-all they weren’t bad for an 11 year old.

Once middle school rolled around, I tried my hand at the other sciences and found out I really enjoyed biology. Being the semi-OCD-like person I am, I put all my attention into biology and medicine, with a curiosity for chemistry. I knew way too much for my own good.

Now I have to mention that all of this is taking place in beautiful Southern California. I was born and raised there for 14 years. At the end of Grade 8, my parents decided to move to Canada. Don’t ask - long story. And at that time, I was still into the life sciences. In my next post, I’ll continue on with my story.

The Tag Cloud

Thu, 01 Jan 2009 22:07:57 GMT

For a while now I’ve been categorizing my posts. At the time of design for this site I didn’t really have an idea of what I was going to do with the categories, but speculated I might build a tag cloud. The problem was I didn’t really understand the fundamentals of a tag cloud:

Get all categories from posts
Count number of posts per category
Add weighting to category
Format text to distinguish weighting
Link to all posts within that category

On the surface it looks fairly simple. Query the database, do some mathematical fiddling to get weights, create a List of links and stick a style attribute to modify font-size based on weighting.

Well it’s not quite that easy. The query was fairly straightforward, and creating the list and stylizing it was pretty simple. Getting the weights on the other hand was a pain. The problem was figuring out a fair weighting solution.

Standard Deviation and Statistical Analysis

Originally I figured I could get away with ordering the numbers, and then finding the difference between each increment. Unfortunately some topics I discuss more frequently than others. For instance, I talk about SQL a whole lot more than I talk about Open Source-stuff. A huge skewing problem would have arose. So, going back to High School Statistics class (holy crap, I actually can use this in real life! My teacher [,if he were dead,] would be rolling over in his grave) I go back to one of the first things I learned: The Standard Deviation.

The standard deviation is a measure of the dispersion of a collection of numbers. It is defined as the root-mean-square (RMS) deviation of the values from their mean, or as the square root of the variance. To calculate the standard deviation on a dataset:

Find the mean, , of the values.
For each value x_i calculate its deviation () from the mean.
Calculate the squares of these deviations.
Find the mean of the squared deviations. This quantity is the variance s².
Take the square root of the variance.

In calculation form it looks like this:

The variable s signifies the standard deviation. Thanks to Wikipedia for the pictures.

In C# the code would look like:

double StdDev(List<double> values, out double mean)
{
    mean = Statistics.Mean(values);
    double sumSquares = 0;
    int count = 0;

    foreach (double d in values)
    {
        double diff = (d - mean);
        sumSquares += diff * diff;
        count++;
    }

    return Math.Sqrt(sumSquares / count);
}

If they taught math in the form of programming (“this is how you do it in code…”), Math might not have sucked! Yes, I do realize math is the precursor to programming, but a boy can dream.

Back to the Cloud

Once the standard deviation is found, I can apply the weighting. Essentially I started at a deviation of 0 and assigned it the default font-size for this site. As the deviation falls below 0 the font decreases, and as it increases above 0 it increases. Fairly straightforward. Once I got the weighting, I applied CSS, and built a web part accordingly.

Windows Live Writer

Thu, 01 Jan 2009 12:10:57 GMT

I finally got around to building a MetaWeblog API Handler for this site, so I can use Windows Live Writer. It certainly was an interesting task. I wrote code for XML, SQL Server, File IO, and Authentication to get this thing working. It’s kinda mind-boggling how many different pieces were necessary to get the Handler to function properly.

All-in-all the development was really fun. Most people would give up on the process once they realize what’s required to debug such an interface. But it got my chops in shape. It’s not every day you have to use a Network Listener to debug code. It’s certainly not something I would want to do everyday, but every so often it’s pretty fun.

While in the preparation process, there were a couple of procedures that I thought might be tricky to work out. One in particular was automatically uploading images to my server that were placed in the post. I could have left it to the manual process, what I started out with, which involved FTP’ing the images to the server, and then figuring out the URL for them, and manually inserting the img tag. Or, I could let Live Writer and the Handler do all the work. Ironically, this procedure took the least amount of code out of all of them:

public string NewMediaObject(string blogId, string userName, string password,
                             string base64Bits, string name)
{
    string mediaDirectory 
                = HttpContext.Current.Request.PhysicalApplicationPath + "media/blog/";

    if (authUser(userName, password))
    {
        File.WriteAllBytes(mediaDirectory + name, Convert.FromBase64String(base64Bits));

        return Config.SiteURL + "/media/blog/" + name;
    }
    else
    {
        throw new Exception("Cannot Authenticate User");
    }
}

Now its a breeze to write posts. It even adds drop shadows to images:

Live Writer also automatically creates a thumbnail of the image, and links to the original. It might be a pain in some cases, but it’s easily fixable.

All I need now is more topics that involve pictures. Kitten’s optional. :)

Open Source Windows

Wed, 31 Dec 2008 23:14:35 GMT

Some days you just have to shake your head and wonder. As it turns out, I'm a little late to hear about this, but nonetheless, I'm still shaking my head.

It turns out that Windows has gone open source. And (!!) it's not being made by Microsoft anymore. Well, Windows™ is still made by Microsoft. Windows is now made by a group under the gise of ReactOS.

ReactOS® is a free, modern operating system based on the design of Windows® XP/2003. Written completely from scratch, it aims to follow the Windows® architecture designed by Microsoft from the hardware level right through to the application level. This is not a Linux based system, and shares none of the unix architecture.

So essentially, these people are taking the Windows architecture (based on XP/2003), and redesigning it from scratch. Or rather, are re-coding it from scratch, because redesigning would imply making something different. Sounds vaguely familiar to, oh, something called Vista. Except uglier.

Now, that nagging feeling we are all getting right about now should be visualized as a pack of rabid lawyers. Isn't this considered copyright infringement? They outright define the product as a copy.

And what about the end users? Are all programs designed to run on Windows supposed to be able to run on this ReactOS? Why bother with testing? The XP architecture is now almost 8 years old by now. That means anything designed to run on Vista, or soon to be designed to run on Windows 7, wouldn't stand a snowballs chance in hell, running on ReactOS.

I would love to see how a .NET application runs on it.

ADO.NET Entity Framework and SQL Server 2008

Tue, 30 Dec 2008 22:30:31 GMT

Do you remember the SubSonic project? The Entity Framework is kind of like that. You can create an extensible and customizable data model from any type of source. It takes the boiler plate coding away from developing Data Access Layers.

Entity is designed to seperate how data is stored and how data is used. It's called an Object-Relational Mapping framework. You point the framework at the source, tell it what kind of business objects you want, and poof: you have an object model. Entity is also designed to play nicely with LINQ. You can use it as a data source when querying with LINQ. In my previous post, the query used NorthwindModEntities as a data source. It is an Entity object.

Courtesy of Wikipedia

The Architecture, as defined in the picture:

Data source specific providers, which abstracts the ADO.NET interfaces to connect to the database when programming against the conceptual schema.
Map provider, a database-specific provider that translates the Entity SQL command tree into a query in the native SQL flavor of the database. It includes the Store specific bridge, which is the component that is responsible for translating the generic command tree into a store-specific command tree.
EDM parser and view mapping, which takes the SDL specification of the data model and how it maps onto the underlying relational model and enables programming against the conceptual model. From the relational schema, it creates views of the data corresponding to the conceptual model. It aggregates information from multiple tables in order to aggregate them into an entity, and splits an update to an entity into multiple updates to whichever table contributed to that entity.
Query and update pipeline, processes queries, filters and update-requests to convert them into canonical command trees which are then converted into store-specific queries by the map provider.
Metadata services, which handle all metadata related to entities, relationships and mappings.
Transactions, to integrate with transactional capabilities of the underlying store. If the underlying store does not support transactions, support for it needs to be implemented at this layer.
Conceptual layer API, the runtime that exposes the programming model for coding against the conceptual schema. It follows the ADO.NET pattern of using Connection objects to refer to the map provider, using Command objects to send the query, and returning EntityResultSets or EntitySets containing the result.
Disconnected components, which locally caches datasets and entity sets for using the ADO.NET Entity Framework in an occasionally connected environment.
- Embedded database: ADO.NET Entity Framework includes a lightweight embedded database for client-side caching and querying of relational data.
Design tools, such as Mapping Designer are also included with ADO.NET Entity Framework which simplifies the job on mapping a conceptual schema to the relational schema and specifying which properties of an entity type correspond to which table in the database.
Programming layers, which exposes the EDM as programming constructs which can be consumed by programming languages.
Object services, automatically generate code for CLR classes that expose the same properties as an entity, thus enabling instantiation of entities as .NET objects.
Web services, which expose entities as web services.
High level services, such as reporting services which work on entities rather than relational data.

LINQ and SQL Server 2008

Tue, 30 Dec 2008 21:53:23 GMT

No, Zelda is not back. LINQ stands for Language Integrated Query. It's a set of query operators that can be called in any .NET language to query, project, and filter data from any type of data source. Types include arrays, databases, IEnumerables, Lists, etc, including third party Data Sources. It's pretty neat.

Essentially LINQ pulls the data into data objects, which can then be used as you would use a Business Object. The data object is predefined by a LINQ Provider. Out of the box you have LINQ to SQL, LINQ to XML, and LINQ to Objects for providers. Once you define the data object based on provider you can start querying data:

Within the foreach loop the 'Customers' class is a data class that was defined based on a LINQ to SQL Provider. In this case, the database was Northwind.

Syntactically LINQ is very much like the SQL language, mainly because they both work on the same principle. Query (possible) large amounts of data and act on it appropriately. SQL is designed to work with large datasets. Most other languages work iteratively. So SQL was a good language choice to mimic.

However, there is a small problem that I see with LINQ. If I'm doing all the querying at the DAL layer instead of using things like Stored Procedures within the database, and I need to modify a query for performance concerns, that means the DAL has to be recompiled and redistributed to each application out in the field. That could be 10,000 different instances. Wouldn't it make more sense to keep the query within a Stored Procedure? Just a thought...

Merry Christmas!

Thu, 25 Dec 2008 17:15:55 GMT

What?

The Tragically Hip Media Player

Wed, 24 Dec 2008 16:47:12 GMT

It's not every day you come across a band that is willing to stream all of it's songs free of charge. Especially at a fairly high bit rate. Well it seems the Tragically Hip have decided to do so.

It's a little game changing actually. The band has decided to let everyone and their mother listen to the music free, with no advertisements. Mind you, you can't take it with you. But there is nothing technical stopping you from recording the stream. That was always the fear with online streaming that the Record Labels and the RIAA had. I don't condone pirating, of anything, but I do believe in free arts. So this is cool. Especially because I like The Hip.

It's also pretty straightforward to use. On the main page select all the songs you want in the playlist, and then click "Launch Music Player". Very intuitive.

Windows 7 Teasers

Sun, 21 Dec 2008 01:03:13 GMT

I had been out last week due to the flu, which sucks. There were a few meetings that ended up getting rescheduled, which I hate having to do. Anyway, I had the pleasure of playing around with the Windows 7 beta earlier and managed to get a couple screen shots.

Windows 7 Calculator

Windows 7 brings a whole whack of new features to the user's fingers, and finally they've updated the calculator. The codebase hadn't been touched since Windows 3.11.

Windows 7 Paint

The Paint application that comes with Windows 7 is actually pretty useful. The brushes are nice, and you can get away with basic image manipulation without butchering the picture. It's feature rich, and easy to use.

Windows 7 WordPad

Notice the ribbon bar? Very elegant. Makes simple text editing a breeze. Also, it uses the new Office XML Standard instead of RTF for its default documents now.

Protecting Data in Transit between applications and SQL Server

Thu, 04 Dec 2008 13:34:47 GMT

Alright, so you've just implemented Transparent Data Encryption on your database. Your database is extremely secure. The data, not so much. You see, the problem is this: the data travels unencrypted between SQL Server and your application. Whoops.

To enable SSL Encryption on the server side, there are a couple of fairly simple steps involved:

In SQL Server Configuration Manager, expand SQL Server Network Configuration, right-click Protocols for <server instance>, and then select Properties.
In the Protocols for <instance name> Properties dialog box, on the Certificate tab, select the desired certificate from the drop down for the Certificate box, and then click OK.
On the Flags tab, in the ForceEncryption box, select Yes, and then click OK to close the dialog box.
Restart the SQL Server service.

To enable SSL Encryption on the client side:

Copy either the original certificate or the exported certificate file to the client computer.
On the client computer, use the Certificates snap-in to install either the root certificate or the exported certificate file.
In the console pane, right-click SQL Server Native Client Configuration, and then click Properties.
On the Flags page, in the Force protocol encryption box, click Yes.

finally, set your connection string within the application to 'Use Encryption for Data=True'.

Driver={SQL Native Client};
Server=myServerAddress;Database=myDataBase;Trusted_Connection=yes;Encrypt=yes;

That's really not all that difficult. One more reason to have a more secure infrastructure!

Transparent Data Encryption

Thu, 04 Dec 2008 13:16:51 GMT

Transparent data encryption (TDE) is a new encryption feature introduced in Microsoft® SQL Server™ 2008. Unlike previous versions of SQL Server, TDE, as an encryption method, is a lot easier to implement, and is a lot less resource intensive. Essentially, TDE encrypts everything within the database.

Previous versions of data encryption in SQL Server involved cell-level encryption, which posed problems, as you had to use a Varbinary column. Scans were difficult, and searching was awful, if not impossible. Essentially, everything had to be handled out of process for that column. Because encryption happens at the Buffer Pool level, all processes are transparent to the user. The encryption happens at file level, not within the file structure. This allows indexes to work without being hindered by the use of Varbinary columns. For more information check out the MSDN Whitepaper on TDE at http://msdn.microsoft.com/en-us/library/cc278098.aspx (which is where I stole the pretty graphic).

To enable TDE, you must have the normal permissions associated with creating a database master key and certificates in the master database. You must also have CONTROL permissions on the user database.

Perform the following steps in the master database:

1. If it does not already exist, create a database master key (DMK) for the master database. Ensure that the database master key is encrypted by the service master key (SMK).

CREATE MASTER KEY ENCRYPTION BY PASSWORD = ‘some password’;

2. Either create or designate an existing certificate for use as the database encryption key (DEK) protector. For the best security, it is recommended that you create a new certificate whose only function is to protect the DEK. Ensure that this certificate is protected by the DMK.

CREATE CERTIFICATE tdeCert WITH SUBJECT = ‘TDE Certificate’;

3. Create a backup of the certificate with the private key and store it in a secure location. (Note that the private key is stored in a separate file—be sure to keep both files). Be sure to maintain backups of the certificate as data loss may occur otherwise.

BACKUP CERTIFICATE tdeCert TO FILE = ‘path_to_file’
    WITH PRIVATE KEY (
        FILE = ‘path_to_private_key_file’,
        ENCRYPTION BY PASSWORD = ‘cert password’);

4. Optionally, enable SSL on the server to protect data in transit. Perform the following steps in the user database. These require CONTROL permissions on the database.

5. Create the database encryption key (DEK) encrypted with the certificate designated from step 2 above. This certificate is referenced as a server certificate to distinguish it from other certificates that may be stored in the user database.

CREATE DATABASE ENCRYPTION KEY
    WITH ALGORITHM = AES_256
    ENCRYPTION BY SERVER CERTIFICATE tdeCert

6. Enable TDE. This command starts a background thread (referred to as the encryption scan), which runs asynchronously.

ALTER DATABASE myDatabase SET ENCRYPTION ON

To monitor progress, query the sys.dm_database_encryption_keys view (the VIEW SERVER STATE permission is required) as in the following example:

SELECT db_name(database_id), encryption_state
FROM sys.dm_database_encryption_keys

Why Upgrade to SQL Server 2008?

Thu, 04 Dec 2008 11:55:21 GMT

Looking through all the marketing material you get as a Microsoft Partner is a daunting task. In the interim what I've done is upload all the materials to my internal SharePoint site, and index all the documents. That way, if I need to search for something all I have to do is open SharePoint and do a search. Very handy for hiding documents for later viewing.

Anyway...In my travels I came across the marketing reasons to upgrade to SQL Server 2008. I did a presentation at Techdays in Montreal on a few of these, but that was really just a high level overview. Here is the list:

Transparent Data Encryption
External Key Management
Data Auditing
Pluggable CPU
Transparent Failover for Database Mirroring
Declarative Management Framework
Server Group Management
Streamlined Installation
Enterprise System Management
Performance Data Collection
System Analysis
Data Compression
Query Optimization Modes
Resource Governor
Entity Data Model
LINQ
Visual Entity Designer
Entity Aware Adapters
SQL Server Change Tracking
Synchronized Programming Model
Visual Studio Support
SQL Server Conflict Detection
FILESTREAM data type
Integrated Full Text Search
Sparse Columns
Large User Defined Types
Date/Time Data Type
LOCATION data type
SPATIAL data type
Virtual Earth Integration
Partitioned Table Parallelism
Query Optimizations
Persistent Lookups
Change Data Capture
Backup Compression
MERGE SQL Statement
Data Profiling
Star JoinEnterprise Reporting Engine
Internet Report Deployment
Block Computations
Scale out Analysis
BI Platform Management
Export to Word and Excel
Author reports in Word and Excel
Report Builder Enhancements
TABLIX
Rich Formatted Data
Personalized Perspectives

What I'm thinking I'll do is make a post on each item once a week or so. Maybe more often if I have free time. :)

No, not yet, I wish...Still funny

Wed, 03 Dec 2008 00:02:33 GMT

Soon, it will happen soon. I will work for them! The kitteh says so!

Context.RewritePath and the Global.asax file

Tue, 02 Dec 2008 16:06:00 GMT

I've always been fond of making my URL's clean and simple. With that being said, URL variables are always useful. But in the case of this site, I decided to clean up the URL's so it's very easy for people to find content. To do this, I added the code:

void Application_BeginRequest(object sender, EventArgs e)
{
    HttpContext context = HttpContext.Current;
    string path = context.Request.Path;

    if (path.Contains(".aspx"))
    {
        if (path.ToLower().Contains("/article/"))
        {
            string id 
             = path.Remove(0, path.LastIndexOf("/") + 1).Replace(".aspx", "");

            try
            {
                int.Parse(id);
                context.RewritePath("~/article/article.aspx?ArticleID=" + id);
            }
            catch
            {
                // don't do anything because it's a postback
            }
        }
    }
}

It's fairly simple to follow. First, I checked to see if it was an ASPX page, so I can weed out all the HTTP Handlers being used. Then I checked if it's a page I want to manipulate. Essentially, what Context.RewritePath does is take the incoming URL and modify it before it hits the page handler. So when I go to /Article/3.aspx, the code see's that it contain's both '.apsx' and 'article', and then because I know the format, I am stripping off everything else and keeping the article ID. Once that is done I pass the ID to the page that actually get's called behind the scenes. It's a quick and dirty way to make URL's human-friendly.

The Lazy Admin and Why You Need It to Live

Fri, 28 Nov 2008 21:33:28 GMT

I was talking with Daniel Nerenberg yesterday at Techdays in Ottawa. He had been given the administrator's password a while ago since Rodney has been too busy working for Microsoft. He has some interesting thoughts on what to do with The Lazy Admin.

Being a lazy admin means following best practices and using the tools available to be proactive about maintenance. SMS 2003, MOM 2005, WSUS and the slew of Microsoft best practices analyzers can help by automating updates and application deployments as well as monitoring servers and services. This enables you to find and fix small problems before they pile up into larger issues. Proper planning, implementation and proactive maintenance will maximize system availability and minimize the occurrence of issues, allowing you to put your feet up on the desk, relax, and be a lazy admin!

The site is full of information. Lots and lots of information. It's a great place to have discussions about anything administrative. Or about anything lazy for that matter. I am a lazy admin! And I will be loitering on the site.

Live Messenger and all its Goodness

Tue, 25 Nov 2008 23:00:18 GMT

I've been playing around with the Windows Live Messenger Web SDK. It's an interesting little toy. I suppose 'toy' is a little improper, as there are a lot of API's available to work with. You can check out the API at http://dev.live.com.

I'll admit, I was a little iffy on the idea of adding my presence to the site. What good is it if all I'm doing is telling people that I'm online? Well, it turns out I can do more. If you click the presence button:

You open a window that allows you to chat with me. Pretty neat, I think. When I came across it, I decided I wanted to modify it a little, so it's more in theme with this site. Basically all I did was put it into a modal window:

Theres a bit of work required to put it into a modal window, so I will cover that next time I post.

Ottawa, Here I Come!

Tue, 25 Nov 2008 13:28:21 GMT

Techdays is back in swing for Ottawa. It's taking place at the Mariott Hotel on Thursday November 27th. I'll be presenting on Microsoft SQL Server: Essential Database Maintenance for New and Seasoned DBAs. The synopsis is:

Every DBA knows that managing a database using SQL Server requires dealing with a key set of components of SQL Server in an optimal in order to make their lives easier. But what are the elements of SQL Server that you need to really focus on to get the best bang for the DBA buck, and what best practices should be followed to ensure an optimally-running an instance in SQL Server? In this session we will walk through the Top 10 List of DBA techniques and best practices to ensure a smooth running database and instance. You’ll learn: how to optimize data files and transaction logs; why TempDB is special and how to treat it properly; indexing strategies dealing with corruption; and much, much more.

Unfortunately this is my last presentation with the Techdays tour :(. Luckily I'll be able to catch up with some old friends, and talk to some of the smartest groups of people I know. It will be fun.

I Hate Being Wrong...

Mon, 24 Nov 2008 01:04:47 GMT

Actually I don't. I learn a whole lot more when I'm wrong.

From time to time I get the feeling that when I write about something, I'm just pulling it out of my butt. I try to read up on the topics that I'm writing about, and will reference my sources as appropriate. However, there are the times that I just write from memory, and by god, it gets me in trouble more times than it doesn't.

It's the "meant well, but failed in the process" dynamic. What I knew, and what I wrote are two seperate things. It's really annoying when that happens. It might be the idea that what I'm writing sounds as if it were absolute fact, and not the ramblings of some kid. Remember, I'm only 20!

Or maybe I need to just find a niche within IT that I can devote all my time to. I've tried doing that with Windows Server, but I like development. I tried doing that with ASP.NET, but I like management. Hmm... What can I become an expert in that involves development and management? Some may have already figured it out. It turns out SQL Server is a good place to get a mix of both. I wouldn't say I'm an expert in all aspects of SQL Server, but I would like to be eventually.

Which is once again why I like being wrong. I learn a whole lot more from being wrong than I do from always being right.

...Just some ramblings of a 20 year old.

Microsoft SQL Server 2008 Internals

Sat, 22 Nov 2008 17:45:52 GMT

It's almost released! Only Three and a half months to go! Pre-Order at Amazon .

TorontoSql.com, TorontoSql.net, TorontoSql.org just registered

Thu, 20 Nov 2008 22:20:41 GMT

Boredom is a bad thing! Especially when you are putting off work. So what do I do to waste my time? Check out local user groups. The websites at least. A few days ago I posted a few links to some promising groups. To my disappointment there really aren't that many Microsoft oriented user groups in Toronto. I wouldn't call it a bad thing. More of an opportunity.

I have determined that TorontoSql.com, TorontoSql.net, and TorontoSql.org were not registered. So for $30 I registered all three of them. Now I have to put them to good use. Currently they are pointed to www.syfuhs.net, until I find a proper home.

More to come on that front!

What is a Mandelbrot Set Anyway?

Thu, 20 Nov 2008 16:55:44 GMT

Internet Explorer just crashed on me! I now have to rewrite this. I've gotta build Live Writer support into my site one of these days. Anyway...

A Mandelbrot Set is a fractal. It is a complex formula based image (more on that in a moment). You pass values to define scale. Wikipedia defines a Mandelbrot Set as (because I can't for the life of me remember the *real* definition) a set of points in the complex plane, the boundary of which forms a fractal. Mathematically, the Mandelbrot set can be defined as the set of complex c-values for which the orbit of 0 under iteration of the complex quadratic polynomial

x_n+1 = x_n² + c

remains bounded . A Complex number, c, is in the Mandelbrot set if, when starting with x₀=0 and applying the iteration repeatedly, the absolute value of x_n never exceeds a certain number (that number depends on c) however large n gets.

Yeeeeaaaah. Exactly. Talk about a pain to remember. I prefer to remember the code definition:

Math.ComplexNumber C = z;
int iteration = 0;
while (z.Modulus < escapeRadius && iteration < maxIteration)
{
    z = z * z + C;
    iteration++;
}

int colorIndex = 0;
if (iteration < maxIteration)
{
    z = z * z + C; iteration++;
    z = z * z + C; iteration++;
    double mu = iteration - (Math.Log(Math.Log(z.Modulus))) / logEscapeRadius;
    colorIndex = (int)(mu / maxIteration * 768);
    if (colorIndex >= 768) colorIndex = 0;
    if (colorIndex < 0) colorIndex = 0;
}

This specific example was found on http://llbb.wordpress.com/2007/04/12/mandelbrot-set-with-smooth-drawing-using-c/. I'm looking for my original code that I used when studying Computer Science in high school. But that was a long time ago. Once I find the original code, I'll post an addendum.

Wasting Time the SQL Way...

Thu, 20 Nov 2008 15:46:26 GMT

Found on The Daily WTF:

-- AUTHOR: GRAEME JOB 
-- CREATED: 12-OCT-2008 
-- BECAUSE: SINGLE SQL COMMAND < 50 LINES. JUST BECAUSE. 
WITH 
      XGEN(X, IX) AS (              -- X DIM GENERATOR 
            SELECT CAST(-2.2 AS FLOAT) AS X, 0 AS IX UNION ALL 
            SELECT CAST(X + 0.031 AS FLOAT) AS X, IX + 1 AS IX 
            FROM XGEN 
            WHERE IX < 100 
      ), 
      YGEN(Y, IY) AS (              -- Y DIM GENERATOR 
            SELECT CAST(-1.5 AS FLOAT) AS Y, 0 AS IY UNION ALL 
            SELECT CAST(Y + 0.031 AS FLOAT) AS Y, IY + 1 AS IY 
            FROM YGEN 
            WHERE IY < 100 
      ), 
      Z(IX, IY, CX, CY, X, Y, I) AS (           -- Z POINT ITERATOR 
            SELECT IX, IY, X, Y, X, Y, 0 
            FROM XGEN, YGEN   
            UNION ALL 
            SELECT IX, IY, CX, CY, X * X - Y * Y + CX AS X, Y * X * 2 + CY, I + 1 
            FROM Z 
            WHERE X * X + Y * Y < 16 
            AND I < 100 
      ) 
SELECT REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE( 
      REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE( 
      REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE( 
      (X0+X1+X2+X3+X4+X5+X6+X7+X8+X9+X10+X11+X12+X13+X14+X15+X16+X17+X18+X19+ 
      X20+X21+X22+X23+X24+X25+X26+X27+X28+X29+X30+X31+X32+X33+X34+X35+X36+X37+X38+X39+ 
      X40+X41+X42+X43+X44+X45+X46+X47+X48+X49+X50+X51+X52+X53+X54+X55+X56+X57+X58+X59+ 
      X60+X61+X62+X63+X64+X65+X66+X67+X68+X69+X70+X71+X72+X73+X74+X75+X76+X77+X78+X79+ 
      X80+X81+X82+X83+X84+X85+X86+X87+X88+X89+X90+X91+X92+X93+X94+X95+X96+X97+X98+X99), 
      'A',' '),   'B','.'),   'C',','),   'D',','),   'E',','),   'F','-'),   'G','-'), 
      'H','-'),   'I','-'),   'J','-'),   'K','+'),   'L','+'),   'M','+'),   'N','+'), 
      'O','%'),   'P','%'),   'Q','%'),   'R','%'),   'S','@'),   'T','@'),   'U','@'), 
      'V','@'),   'W','#'),   'X','#'),   'Y','#'),   'Z',' ') 
FROM ( 
      SELECT 'X' + CAST(IX AS VARCHAR) AS IX, 
      IY,   SUBSTRING('ABCDEFGHIJKLMNOPQRSTUVWXYZ', ISNULL(NULLIF(I, 0), 1), 1) AS I 
      FROM Z) ZT 
PIVOT ( 
      MAX(I) FOR IX IN ( 
      X0,X1,X2,X3,X4,X5,X6,X7,X8,X9,X10,X11,X12,X13,X14,X15,X16,X17,X18,X19, 
      X20,X21,X22,X23,X24,X25,X26,X27,X28,X29,X30,X31,X32,X33,X34,X35,X36,X37,X38,X39, 
      X40,X41,X42,X43,X44,X45,X46,X47,X48,X49,X50,X51,X52,X53,X54,X55,X56,X57,X58,X59, 
      X60,X61,X62,X63,X64,X65,X66,X67,X68,X69,X70,X71,X72,X73,X74,X75,X76,X77,X78,X79, 
      X80,X81,X82,X83,X84,X85,X86,X87,X88,X89,X90,X91,X92,X93,X94,X95,X96,X97,X98,X99) 
) AS PZT

It Produces a Mandelbrot set. I remember doing it in java and thought it was tough. C# was much easier, but this just makes my head hurt...

[EDIT]: Be sure to set the window output to Text, otherwise it doesn't work...

Instant Initialization for SQL Server

Thu, 20 Nov 2008 15:02:38 GMT

So what is it?

It's cool. Err...More specifically it's a part of Windows that deals with writing files to disk. I won't go into the file system behaviour, but when dealing with SQL Server it comes into play when the database grows, or a database is created/has space allocated. When you allocate space for a database, the file(s) are zeroed out. That means all the allocated space has 0's written to it. While it works for small database files, larger files tend to take much longer to allocate. A question then comes up as: Well why don't you zero out the file as you need it, instead of doing it at the beginning? Instant Intialization now comes into play. It allows for data to be zeroed out on the fly. That 10GB space you just allocated for database growth doesn't have to be scrubbed immediately. It can be dealt with when it's actually needed. Pretty cool, indeed.

So how do I use it?
It's actually pretty straightforward. You give your SQL Server service account or the local group SQLServerMSSQLUser$instancename the SE_MANAGE_VOLUME_NAME privilege. The account or local group has to be allowed the "Perform Volume Maintenance Task" local security right. The local admin account has this priveledge in the first place, so if you are using that account as the service account you don't need to do anything. HOWEVER(!) Don't use the fricken admin account as your SQL Server Service Account. Bad things happen! With that being said, onto the next point.

If you made the changes while the Service is running, you have to restart the service. It's an on startup check that is done. Also, it's only available on SQL Server 2005+. That's actually all there is to it.

On-Disk Data Structures in SQL Server

Mon, 17 Nov 2008 15:53:35 GMT

Just some links to read. Carefully. There's a lot of information. These posts were made by Paul S. Randal on www.sqlskills.com. I'll do a more thorough job of weeding out information when I'm not strapped for time.

Toronto and Area User Groups of Interest

Mon, 17 Nov 2008 15:07:59 GMT

Since moving to Toronto I have been looking for user groups that I think I could benefit from. So far I have found a couple of interest:

TSQL.CA - Toronto SQL Server User Group - http://www.tsql.ca/Default.aspx?base

Toronto .NET User Group - http://www.torontoug.net/

ISSA Toronto (Information System Security Association) - http://www.issa-toronto.org/

I'm still looking, but these look promising.

DevTeach and SQLTeach...

Sun, 16 Nov 2008 17:45:56 GMT

DevTeach Montreal and SQLTeach Montreal are less than a month away but it's not too late to register. These are great conferences with sessions covering .NET FX, Future, SQL Server, VSTS/Team System, Silverlight, Agile Development, Software Architecture, ASP.NET. Aside from the great content, build up your professional network by rubbing shoulders with the speakers in an intimate conference. The list of speakers is particularly impressive this year. From MS you'll get to see Elisa Flasko and Carl Perry from the Data Programmability Team, Beth Massi and Yair Alan Griver. Of course .NET Rockers Carl Franklin & Richard Campbell will be there with fellow MS Regional Directors Tim Huckaby, Joel Semeniuk, Stephen Forte, Jim Duffy, Guy Barrette and Barry Gervin.

But wait, there's more...

Every attendee will get Visual Studio 2008 Pro, Expression Web 2 and Tech-Ed Developer DVD set in their bag. That represents over $1,000 worth of software!
The TechDays/DevTeach rebate coupon will get you a $350 discount if you use it for the December Montreal event. That's $250 more than its original value!
The user group discount has been increased from $50 to $100 for the December Montreal event. Just use rebate code OT00NETUGC

Now to wait for them to come to Toronto!

Floating down the FILESTREAM...again

Sun, 16 Nov 2008 17:28:13 GMT

In my previous post I talked about the basic idea of what FILESTREAM is. The sales pitch if you will. In this post I thought I would talk about how to actually implement FILESTREAM?. It's actually really easy.

FILESTREAM's live in a filegroup. Semantically, anyway. You will define what folder the data sits in.

ALTER DATABASE Production ADD
FILEGROUP FileStreamGroup1 CONTAINS FILESTREAM;
GO

Simple enough. Next you add a file to the filegroup.

ALTER DATABASE Production ADD FILE (
       NAME = FSGroup1File,
       FILENAME = 'F:\Production\FSDATA')
TO FILEGROUP FileStreamGroup1;
GO

Again, pretty simple. You'll notice the F:\Production\FSDATA. That’s where the files are stored. Now, lets create a table that holds the FILESTREAM.

CREATE TABLE DocumentStore (
       DocumentID INT IDENTITY PRIMARY KEY,
       Document VARBINARY (MAX) FILESTREAM NULL,
       DocGUID UNIQUEIDENTIFIER NOT NULL ROWGUIDCOL
              UNIQUE DEFAULT NEWID ())
FILESTREAM_ON FileStreamGroup1;
GO

And that's it. To insert data into the table, do it like you would any VARBINARY data.

Floating down the FILESTREAM...

Sun, 16 Nov 2008 17:06:04 GMT

The old CCR lyrics popped into my head "Rollin' down the river..." and then of course I realized a river isn't a stream, nor is it any way related to data streams, and I lost my concentration for 20 minutes-ish. What does this have to do with FILESTREAMS? Nothing really.

Let's talk a little about Filestreams in SQL Server 2008. So, what is FILESTREAM? According to Microsoft, FILESTREAM is a technology "which allows storage of and efficient access to BLOB data using a combination of SQL Server 2008 and the NTFS file system". Thats all fine and dandy, but what does it really mean? FILESTREAM, very eloquently put, stores large BLOBs of data on the file system.

In previous versions of SQL Server, you didn't have all that much choice when it came to working with large BLOB data. Your options were three-fold.

1. Store it in the database.

2. Store it on the file system.

3. Store it in a BLOB store.

Storing the data in the database was tricky. If the data was small in size, it worked out fairly well. But in instances where you had to store large pieces of data, such as videos, or audio files, keeping the data within the database was a major blow for performance.

So what is the next best option? Store the data on the file system, and leave a pointer in the database. You didn't have performance issues, and data was streamed directly from the file system. However, you did have problems with data consistency. You didn't benefit from the transactional properties of SQL Server. Backup's were a pain, and managing the streaming was tricky from a programmatic perspective.

Next up, and the final option was a BLOB store. Basically, it works much like the filesystem approach, except it was more manageable, and had transactional characteristics due to a tie in with the database. An example is the EMC Centera. Drawback: Fricken EXPENSIVE. Worked great though...

Now onto SQL Server 2008. FILESTREAM works very much like option number 2, has transactional benefits like option number 1, and is cheaper than option number 3. How does it do it? It's actually pretty simple. A column of VARBINARY(MAX) is created in a table, with an AS FILESTREAM attribute. Once data is stored within the column, a piece of metadata tells SQL Server to write the file to disk, and stick a pointer in the column.

So far that takes care of replacing option number 2. So how is transactional consistency dealt with? Easy. NTFS as a file system is transactional by nature, so FILESTREAM takes full advantage. Backing up is dealt with the same way as all databases are, and is done transparently. That takes care of option number 1.

Now comes the issue of price. Well, it turns out FILESTREAM is available for free. It is built in, starting with SQL Express. That's all I have to say about that, which takes care of option number 3.

That in a nut shell is SQL Server FILESTREAM. My next post will be on how to actually implement FILESTREAM on a 2008 database.

Fun with Full Text Search

Thu, 13 Nov 2008 12:53:47 GMT

Okay, so I have been playing around with Full Text Search in SQL Server 2005. I've worked with it from an administrator's point of view, which is certainly very interesting, but I haven't really gotten to play around with it from a development perspective. Basically, I stuck an index on the body column for this blog, and did a simple FTS query.

Now, to do a query with the functionality of FTS you actually end up using some new keywords:

...
WHERE CONTAINS
         (body, @q)
...

WHERE FREETEXT
    (body, @q)

...

At first I worked with CONTAINS, which takes the same parameters for the most part. While it worked, it would struggle with multiple words in a query. Second I tried FREETEXT, which is more friendly to multiple search keywords.

This takes care of a simple search on the body of the blog article, but what about if I'm searching for something in a title? There are lots of ways to do it, some much better than others. Here is the simplest query I could come up with. It is neither designed to be fast, nor as accurate is possible. It is designed for simplicity. It could very easily be reworked, and if anyone has some ideas as to what could work, let me know! I'd like to see what other people would do.

CREATE PROCEDURE [dbo].[DoSearch]
            @q nvarchar(4000)
AS
BEGIN   
SET NOCOUNT ON;
SELECT     [PostID],
     [Title],
     [Body] AS PostSnippet,
     [EntryDate] AS PostDate 
FROM     [dbo].[sb_posts] 
WHERE FREETEXT
    (body, @q)
OR       [Title] LIKE '%' + @q + '%'
;

END

Thoughts? Comments? Questions? Give'r!

Presenting at Techdays!

Mon, 03 Nov 2008 00:44:04 GMT

What is Techdays?

The Canadian IT Pro Team would love to call it a Tech-Ed of the north, except on tour. Check out the site: www.techdays.ca to get the info, but the dates are:

Date	City	Venue
October 29/30	Toronto	Toronto Congress Centre
November 6/7	Montreal	The Palais des Congrès
November 27	Ottawa	Mariott Hotel
December 4	Winnipeg	Delta Hotel
December 10/11	Calgary	Calgary Stampede Roundup Centre
December 17	Halifax	Halifax World Trade Centre
January 21/22	Vancouver	Vancouver Convention Centre

I will be doing a presentation in Montreal and Ottawa entitled Microsoft SQL Server: Essential Database Maintenance for New and Seasoned DBAs. The synopsis is:

Every DBA knows that managing a database using SQL Server requires dealing with a key set of components of SQL Server in an optimal in order to make their lives easier. But what are the elements of SQL Server that you need to really focus on to get the best bang for the DBA buck, and what best practices should be followed to ensure an optimally-running an instance in SQL Server? In this session we will walk through the Top 10 List of DBA techniques and best practices to ensure a smooth running database and instance. You’ll learn: how to optimize data files and transaction logs; why TempDB is special and how to treat it properly; indexing strategies dealing with corruption; and much, much more.

I'm also doing a session entitled Beyond Relational SQL Server 2008: Managing Unstructured and Semi-Structured Data:

The amount of data that does not fit into the tabular format of relational tables is increasing tremendously, be it images, sounds, text documents, XML documents, or semi-structured data. Integrating this data with the robust, efficient processing capabilities of SQL Server and providing integrated querying and management of that data together with the standard relational data becomes increasingly more important. This presentation will present new and existing functionality on how SQL Server 2008 supports these non-relational kinds of data. The presentation will provide insights into FILESTREAM, Remote Blob storage, new XML functionality, integrated Full-Text Search, sparse columns, filtered indexes and the new hierarchyID type.

Should be fun. See you there!

71-432 Revisited...

Wed, 02 Jul 2008 14:58:46 GMT

On Monday June 30th I wrote the 70-432 beta exam for Microsoft SQL Server 2008, Implementation and Maintenance. See, the thing with beta's is that you don't find out about how well you did until about 8 weeks after the beta period is finished. I suspect I will be finding out mid-August as the final release of the exam will be towards the beginning of September-ish. So without breaking the NDA I signed here's what I've learned:

70-432
For the love of god, make sure you know the 70-431! Everything about managing SQL Server is the same, except for product feature differences...the steps are extremely similar.

Make sure you know about the new main features of 2008: Performance Studio, Resource Governor, Policy Management etc...

High Availability has changed some what. Mirroring is fully functioning. It's ready out of the box. Whereas with 2005 you had to enable an internal feature, pre-SP1.

You need to know about the different types of backup procedures: Full, Bulk-Logged, Simple.

Finally, do NOT stay up all night studying and then drink the entire pot of coffee before you take the exam...your bladder will not forgive you, nor will the examiners!

With that, good luck and have fun.

TS: Microsoft SQL Server 2008, Implementation and Maintenance (70-432)

Sun, 08 Jun 2008 16:01:59 GMT

After passing the certification for 2005, I've been given the opportunity to write the 70-432 beta exam. It's the same basic exam as the 2005 version, except, naturally, for 2008. I would hazard a guess that it's going to cover much of the same material, and cover all the new stuff for 2008. Luckily from a management perspective there aren't too many life-altering differences. For the complete rundown of whats going to be covered on the actual RTM exam (couldn't think of a better way to differentiate between the two :)) you can find information here: http://www.microsoft.com/learning/en/us/exams/70-432.mspx.

However, seeing as most people are lazy (Myself included) I'll give a quick rundown of what to expect.

***NOTE*** This information may be outdated by the time the exam is released. It falls under the same category as beta API's.

Installing and Configuring SQL Server 2008 (10 %)

Installation: File Locations, default paths, service accounts
Configuration of Instances: mostly sp_configure
Configuration of services: Configuration Manager, SQL Browser
Configuration of Components: SSIS, SSAS, SSRS, Replication
Setting up and using SQL Mail
Enabling/Disabling and creating indexes

Maintaining SQL Server Instances (13 %)

Managing SQL Agent jobs
Managing SQL Agent alerts
Manage SQL Agent operators
Implementation of the Declarative Management Framework
Backup and restoration of SQL Server environment (OS and database levels)

Managing SQL Server Security (15 %)

Logins and Server Roles
Users and Database Roles
Instance permissions
Schema and object permissions
Auditing of SQL Server instances
Transparent data encryption
Surface area configurator

Maintaining a SQL Server database (16 %)

Backup databases
Restore databases
Manage/configure databases: files, filegroups, recovery models, etc
Database snapshots
Maintaining database integrity: DBCC, CHECKDB, suspect pages
Maintence plans

Performing data management tasks (14 %)

Importing/Exporting data: BCP, BULK INSERT, COPY ROWSET, etc
Managing data partitions
Data compression
Maintain Indexes
Manage collations

Monitoring and Troubleshooting SQL Server (13 %)

Identify SQL Server service problems
Identify concurrency problems: locking, blocking, etc
Identify SQL Agent job execution problems
Locate error information

Optimizing SQL Performance (10 %)

Implement resource governor
Database engine tuning advisor
Collect trace data by using SQL Server Profiler
Collect performance through Dynamic management views
Collect performace data through System Monitor
Use Performance Studio

Implementing High Availability (9 %)

Implement database mirroring
Implement clustered instances
Implement log shipping
Implement replication

I have set up my exam for June 30th. Time to study my butt off. From what everyone else has told me, who have taken beta exams in the past, they tend to be much harder than the final exams. The idea is that they chop off the easiest questions and the hardest questions from the beta exam and from that they do some mathematical reasoning to pick and choose from whats left over. In the end they have a fully working exam. Unfortunately, Microsoft forces us to sign Non-Disclosure Agreements when we take the exams so no details of what I actually found on the exam will be posted. Let's hope it's not that scary. ;)

Thursday's Slide Deck and Demo

Fri, 30 May 2008 14:19:34 GMT

Here is my slide deck and demo from Thursday May 29th. I'm still waiting from the rest of the team for their resource links, but this should be able to tide you over for a few days anyway. :)

The Link List for Thursday's Presentation

Thu, 29 May 2008 03:26:55 GMT

Here is a list of links that I found useful when putting together this presentation on SQL Server 2008 Spatial Data.

Mike Ormand's Blog
http://mikeo.co.uk/demo/sqlspatial/default.aspx

The Virtual Earth Online SDK
http://dev.live.com/virtualearth/sdk/

Johannes Kebeck's Virtual Earth Blog
http://johanneskebeck.spaces.live.com/

Spatial Data Viewer
http://codeplex.com/SpatialViewer

Klaus Aschenbrenner's Blog
http://www.csharp.at/blog/

More information is on the way. After the presentation I'll upload the actual demo and slide deck.

Heroes Happen Here - SQL Server 2008 & Windows Server 2008

Tue, 20 May 2008 17:33:54 GMT

May 29, 2008: OttawaSQL.net and OWSUG Presents Heroes Happen Here - SQL Server 2008 & Windows Server 2008

Free Evening Event @ Microsoft Ottawa

Thursday, May 29th 5:30 - 8:30 PM

RSVP: Event Registration

Location: Microsoft Ottawa, World Exchange Plaza, 100 Queen Street, Suite 500, Ottawa

Refreshments: Pizza and Pop

Session 1: SQL Server 2008 & Windows Server 2008 High Availability, David E. Myers and Todd Lamothe
We will explore the range of SQL Server 2008 high availability solutions and see how enhancements to clustering support in Windows Server 2008, such as geographically dispersed clusters expands on the HA possibilities.

Session 2: SQL Server 2008 Spatial Data & Microsoft Virtual Earth, Lynda Rab and Steve Syfuhs
Spatial data types and the related functions are new to SQL Server 2008. We will demonstrate the use this new technology and show how it can be combined with Virtual Earth to visualize the spatial data.

Event Sponsor: Ottawa Windows Server User Group, Microsoft Canada

Event Partners: TechNet Canada, MSDN Canada

RSVP: Event Registration

SubSonic .NET Project

Tue, 20 May 2008 16:30:46 GMT

Over the last year or so I've been trying to find different methods of accessing data in databases without having to write out all the usual CRUD (Create, Read, Update, Delete) code. In that time, I've come across a number of different ways to do this. Some being auto generated CRUD statements, others being abstracted DALs (Data Access Layers). The purpose of this post is to tell you about the SubSonic .NET Project.

What is it?
SubSonic is a Data Abstraction Layer. It takes your database schema and presents you with usable classes and interfaces. To access data you do something like:

// Create IEnumerable collection of products from Products table
ProductCollection coll = new ProductCollection().Load();

// Get info on each product
foreach (Product p in coll)
{
     Console.WriteLine(p.ProductID + " " + p.Name + "$" + p.Price);
     Console.WriteLine(p.ShortDescription);
}

You can also create new records fairly easily too:

// Create a new object
Product p = new Product();

// Fill it with interesting information
p.Name = "My Most Awesomest Product";
p.Price = 99.99;
p.ShortDescription = "This product is the end all, be all.  It rocks.";

// Save it to the table
p.Save(Profile.Username);

Now, SubSonic can do a whole lot more than this. But these parts were the selling point for me. Check it out at http://subsonicproject.com/. The greatest part, is because it's a .NET Class, it can be used with ASP.NET or WinForms.

The only downside is that there is a learning curve, and it takes some time to wrap your head around what it does. Good stuff though. Makes your head go dizzy like if you stood up too fast. Check out the source with Reflector too... it's worth a read.

Database Snapshots

Tue, 20 May 2008 16:01:42 GMT

During the OttawaSQL.NET study group for the exam 70-431: Microsoft SQL Server 2005 Implementation and maintenance, I did a presentation on Database Snapshots. I thought I would post the info.

Database snapshots are point in time representations of a database. They are read only. However, they can be Queried through SELECT statements. To create a snapshot, right-click database and select Script Database To... to get the DB files set up.

Then, modify the NAME and FILENAME attributes on each filegroup, usually just changing the filename to '.ds'

Finally, add 'AS SNAPSHOT OF [DatabaseName]'

*** Fair warning, this will not work in SQL Express ***

USE [master]
GO
CREATE DATABASE [AdventureWorksSnapShot] ON  PRIMARY 
( 
    NAME = N'AdventureWorks_Data', 
    FILENAME = N'C:\Program Files\Microsoft SQL Server
                \MSSQL.2\MSSQL\Data\AdventureWorks_Data.ds' , 
    SIZE = 167872KB , 
    MAXSIZE = UNLIMITED, 
    FILEGROWTH = 16384KB 
)
 LOG ON 
( 
    NAME = N'AdventureWorks_Log', 
    FILENAME = N'C:\Program Files\Microsoft SQL Server
                \MSSQL.2\MSSQL\Data\AdventureWorks_Log.ds' , 
    SIZE = 2048KB , 
    MAXSIZE = 2048GB , 
    FILEGROWTH = 16384KB 
)
AS SNAPSHOT OF [AdventureWorks]
GO

Add some data to the AdventureWorks Database to test this:

USE [AdventureWorks]
INSERT INTO 
    [AdventureWorks].[Sales].[Currency]
    (
        [CurrencyCode]
        ,[Name]
        ,[ModifiedDate])
    VALUES
    (
        'SSM'
        , 'Steves Currency'
        , GETDATE()
    )

Query Snapshot to verify data wasn't moved:

USE [AdventureWorksSnapShot]
SELECT 
    * 
FROM 
    [AdventureWorksSnapShot].[Sales].[Currency] 
WHERE 
    [Sales].[Currency].[CurrencyCode] = 'SSM'

It is also possible to recover from a database snapshot. One option is to write a query to grab data from the snapshot and INSERT/UPDATE data in the original database.

The other option is to RESTORE the database from a snapshot.

The key thing here is any backup made after the snapshot in question will be broken, an