| Join | Help

Tuesday, April 08, 2008 9:50 PM

I'd like to report a negligence

I've always been interested in software security, and it's always been a number one priority for me. Software security is really honoring the trust of the people that use your software. I've also been fortunate to be the lead developer of a security product. I myself also tend to keep an eye on the security of other products.

We use a few applications in house that we really like. I decided poke around at the security of some of these products. I won't say any of the product names because they really are, good products sans some poor security. If I find a security bug in a piece of software, I will report it to support or the development team. I feel like I've done all that I can, and I'll leave it to them to fix it.

Though the one thing that there really is no excuse for is storing a password in clear text. While doing my digging, I found that two products we use stored passwords in clear text. One of them was attempting to hash a login password using String.GetHashCode, which isn't a good idea, but much better than a clear text. However, this product also stored some other passwords in clear text. They needed to be two way, so a hash wouldn't work; rather a symmetric encryption would be better off. The other system just used clear text for all passwords. This is really just neglecting security, it's not even a bug. It's just not caring.

It's not too hard to encrypt data in .NET, it's pretty easy and there are a lot of tutorials on it, and there are a few usergroups around that talk about it as well, too.

Seeing this makes me think a couple of things. The first being, are my standards too high? I don't think so honestly. I don't see any reason for storing a password in plain text other than reducing developer effort. The second thing is, how common is this? If two applications that we use have this issue, should I lose trust in all of the applications I use? It's not a comfortable thought; knowing that some software abuse the trust that we give them. The third thing is, I know one of these products is extremely popular. I'm surprised no one has caught this before. Am I really the only one that tinkers around with other software's security?

Off topic, but I am trying to get back into the swing of blogging again. I've set a goal of trying to blog every other day or more often. We'll see how it goes.

Cross posted from http://msmvps.com/blogs/vcsjones
Share this post: | bookmark it! | digg it! | reddit! | kick it! | live it!
Posted by Kevin Jones with no comments
Filed under:
Monday, April 07, 2008 11:33 PM

MVC Framework

The MVC framework is the new "hot" thing in the ASP.NET world for developers. As such, everyone has at least one blog entry about it. So, I think it's time I jumped on that ship. Though, I wanted to voice a few concerns with the MVC Framework, or at least how people perceive it.

The MVC design pattern is by no means new. It's been around since around 1979, and .NET is certainly not the first framework that supports the MVC Pattern, and nor is Microsoft's MVC Project the first for .NET. Spring is a very popular MVC solution for Java developers, and there is a .NET port of it as well. Though, I'm not here to give a history lesson either.

I often hang out at the ASP.NET Forums as a moderator and contributor. The MVC Framework is a pretty hot forum over there at the moment. Though after reading several posts, I can't help but get the feeling that several people aren't certain as to what the MVC design pattern is trying to solve.

So, at it's core, MVC is a design pattern that was originally used in SmallTalk-80. The original paper is up for interpretation, but at it's core theory, MVC's original goal was clean separation between layers of your application.

Yes, MVC gives you cool features like Routing, and a big  bonus of Unit Testing. Anyone that has been using unit testing before knows that good separation of your code is important to achieve practical unit tests, especially those who also practice Test Driven Development; but the true goal of MVC (or MVP for that matter) is decoupling logic.

Some people originally made the claim that the current ASP.NET model (before the MVC project) was an MVC model. Well... mmmnnn...ooo. Not quite. It could be argued that it was, but the "not quite" was the event processing in .NET. The initial argument was that the event handles on controls coupled the code behind too tightly. A better solution would be to have the event handles work with a presentation model.

OK, I've been rambling on a little bit. What's my point (if any)? I suppose that Microsoft's MVC is pretty cool. I am a little perplexed as to why everyone got so excited about MVC since Microsoft announced they were providing a Framework when there are frankly, better and more mature MVC Frameworks around, and I'll circle back around to Spring for that one. Spring has been around since .NET 1.1, and since it is a Java port, they have a lot of experience from there, too. I get concerned that some people really aren't using MVC for the purpose of decoupling and improving their code; rather for some of its specialized features, such as Routing.

Though, in all honestly I tend to lean towards the MVP pattern myself. Not quite as popular, I still prefer it because the view is not as coupled with the model. A good MVP project is Stormwind NMVP .

Cross posted from http://msmvps.com/blogs/vcsjones
Share this post: | bookmark it! | digg it! | reddit! | kick it! | live it!
Posted by Kevin Jones with no comments
Filed under: ,
Sunday, April 06, 2008 1:42 PM

Blog Moving

Hi everyone,

I've decided to move my blog to http://msmvps.com/blogs/vcsjones , so please update booksmarks and RSS feeds. However, I will continue to have my new blog cross-post on this site as well.

Share this post: | bookmark it! | digg it! | reddit! | kick it! | live it!
Posted by Kevin Jones with no comments
Sunday, April 06, 2008 1:35 PM

CaptainHook

This is my first post to the msmvps.com web site. I decided to move my blog from http://community.strongcoders.com/blogs/vcsjones .

So, I thought I would start off by talking about something a little obscure that a co-worker turned me onto.

OK, different captain hook. We're not talking about Dustin Hoffman, either. No, I am talking about the .NET Subversion hook framework from Phil Haack . Phil and his company released a nice .NET Framework Library on Source Forge .

OK, a bit of information, first.

I'm a big fan of Subversion. It's what we use at our company for all of our source control, and we use it for a lot of things besides maintaining our code. Documents, Code, etc. It's by far my favorite Source Control solution, and the details of that are another blog post.

Aside from Subversion, we also use an Agile planning and estimation program called TargetProcess. It's very useful for Agile shops. But for the purpose of this post, think of it as any other tracking system, like Bugzilla or FogBugz (we use FB too for a client).

One of my favorite features of TargetProcess is that it integrates with Subversion cleanly. When I commit with Subversion, all I have to do is put a pound (#) and then the ID of the "story" (think of that like a bug) and then I can track it from TagetProcess, view diffs, and read commit messages to that given story. For example:

KJ - #1234 - Fixed minor typo in Administration screen.

Now when I look in TargetProcess at #1234, I can see the commit message, and the files that changed.

So, the problem I am trying to solve on the team is forgetting to put a number in the commit message. Fortunately, Subversion allows us to hook pretty easily. Specifically in this case, we want to use a pre-commit hook.

Despite Subversion's ease of hooking, it can be a little tricky in .NET. And unlike the movies, CaptainHook is the protagonist for this. I'm not going to go into details of how captain hook actually works, but I will go into detail of what's great about it.

Subversion allows hooking at the repository level. So, for a given repository, there are several types of hooks. The one I am keen on is the pre-commit. If you look in a repository, there is a directory called "hooks". When a commit is made, it will start a file named "pre-commit" It can be a BAT file, executable, perl script, what have you. If the exit code does not equal zero, the commit will not go through.

CaptainHook, in a nutshell, is an executable that probes a directory for assemblies with "hooks" in them. It executes the hooks, and if any of the hooks return false, CaptainHook exits with a non-zero code, probably 1.

So, what we want to do is put a regular expression on the commit message... something like "#\d+". What does one of these hooks look like?

public class RequireTargetProcessNumber : PreCommitHook
{
     protected override bool HandleHookEvent(ITransactionInfo commit)
     {
          string commitMessage = commit.LogMessage;
          if (!HasTargetProcessNumber(commitMessage))
          {
               this.Context.Output.WriteError("TargetProcess Number was not specified in commit message.");
               return false;
          }
          else
          {
              return true;
          }

     }

     public bool HasTargetProcessNumber(string commitMessage)
     {
          return Regex.IsMatch(commitMessage, @"#\d+");
     }

}

So there are a few things going on in here... we are overriding the HandleHookEvent from our base class, PreCommitHook. This gives us an ITransactionInfo, which provides us with information about the current transaction. We test the commit message for our regular expression, and if it doesn't match, we fail. I extracted that regular expression to unit test it. If HandleHookEvent was public I could probably test it that way with a mock test as well.

Anyway, that's all there is to it. I can create as many assemblies of these as I want to modularize them, and drop them in a configurable path that CaptainHook looks for.

I highly recommend this for anyone that uses Subversion. It has a lot of other practical uses, such as emailing when a commit is done, or writing to an RSS feed on a successful commit.

Cross posted from http://msmvps.com/blogs/vcsjones
Share this post: | bookmark it! | digg it! | reddit! | kick it! | live it!
Posted by Kevin Jones with no comments
Filed under:
Tuesday, April 01, 2008 9:49 AM

April Fools

DSC00668 Yes, April Fools - one of my favorite days. What April Fool's day is not complete without covering your co-worker's desk and chair in sticky notes?

Though as a side note, I was re-awarded for ASP.NET MVP.

Share this post: | bookmark it! | digg it! | reddit! | kick it! | live it!
Posted by Kevin Jones with no comments
Filed under: ,
Saturday, March 29, 2008 6:16 PM

Next Richmond Code Camp

It's On! The next Richmond Code Camp is set for Saturday, April 26 th . Every year they keep getting better and better, so this one is going to be the best yet!

I'm set to speak there about some of the new stuff in SQL 2008 for Developers and DBAs, and I hope to see a lot of people there.

There is no schedule published as of yet, but keep and eye out for one on http://www.richmondcodecamp.com .

Share this post: | bookmark it! | digg it! | reddit! | kick it! | live it!
Posted by Kevin Jones with 2 comment(s)
Filed under:
Sunday, March 16, 2008 7:09 PM

.NET 2.0 and FIPS (again)

A while back I blogged about how .NET 2.0 threw exceptions if your environment was configured to force FIPS through the machine's security policy. Starting in .NET 2.0 SP1, there is now a way to disable this through the config file. Check out this blog to see the full details:

http://blogs.msdn.com/shawnfa/archive/2008/03/14/disabling-the-fips-algorithm-check.aspx

Share this post: | bookmark it! | digg it! | | kick it! | live it!
Posted by Kevin Jones with 2 comment(s)
Filed under:
Monday, March 10, 2008 5:05 AM

Clash

Sometimes, I tend to butt heads with a co-worker. Overall, we round each other off nicely (or perhaps I am butting heads there too?) Recently, we got into a discussion about security. What we were trying to accomplish was passing information securely over an (otherwise) insecure protocol, HTTP. My immediate answer was to use a public key implementation. Here was a brief description of my implementation:

  1. Server launches a client application. The server passes the client data that is encrypted using a symmetric key (AES 256).
  2. The client then generates a random public / private key pair.
  3. The client then requests the server for the symmetric key. It also hands it the public key.
  4. The server uses the public key to encrypt the symmetric key.
  5. The client then uses the private key to decrypt the symmetric key.
  6. The symmetric key is then used to decrypt the original data.

Not too hard, right? Well here is where we disagreed. The response from my co-worker was "Why use an RSA key at all? Just hand the symmetric key to the client".

Right then I sorta blanked out by what I just heard. After recovering, I asked, "You don't see a problem with that? That would be extremely easy to intercept for someone with a packet sniffer to pick up.

My co-workers response, was "We should just warn our users that they should be using SSL. You're RSA implementation is what SSL does to a degree".

Which, is correct. SSL does use a public and private key implementation. However, there are a few gotchas with that...

  1. SSL uses the same public and private key every time. If someone managed to get the private key, they could read all SSL requests and responses.
  2. SSL has bugs .
  3. What if they aren't using SSL? Do we require it? That will make the product hard to use. What if they don't want to use SSL?
  4. How do we communicate that SSL is a good idea? Knowledge base post? Make a warning dialog on the page that enables that feature? It sounds reasonable.

The problem with #4 is not everyone reads. Clients and customers don't read every single thing on the page. Someone will ignore some text on a page, no matter what you do to make it stand out.

SOMEONE WILL FORGET TO READ THIS.

If the client or customer were to find out that some data was being passed in a was that was known to be compromised, you can be sure they will not be happy, and depending, might stain the reputation of whatever it is you are working on.

It's easy enough to pass data securely. web services are a great means of that, if you are using WSE or for you .NET 3.0 junkies, WCF.

In the end, the RSA implementation was used, much to my relief.

So, what am I really trying to say?

You will never be taken seriously about security if you keep your mind on assuming that the customer's / client's environment is secure. Do everything you can to secure things. SSL is not a poor means of securing communication, but in our case, there is no way to guarantee it . If we do it ourselves, we are sure they are using a decent security implementation because we are forcing it.

So, why not have the application not work if it can't use SSL? That's a poor customer experience. The more transparent the functionality is, the better it is for the end-user's experience.

Share this post: | bookmark it! | digg it! | reddit! | kick it! | live it!
Posted by Kevin Jones with 4 comment(s)
Filed under:
Sunday, March 02, 2008 3:47 PM

Roanoke Valley Code Camp 2008

codecamp

March 1st was the Roanoke Code Camp 2008. This was my first Code Camp in Roanoke, and their second one. Congratulations to Robin Edwards and everyone else involved organizing this event. There were a few hiccups with the schedule, including my SQL Server 2008 presentation, which was canceled. On February 29th my SQL 2008 instance stopped working, and I couldn't get it running properly again. I decided to change the topic to Cryptography. I later discovered through colleagues that SQL Server 2008 didn't work on the 29th due to a bug in handling the leap year with its licensing. Not to mention, the touch pad on my laptop quit on me the night before, and I carelessly forgot a mouse. Though, later after the code camp, the touch pad started working again.

There were attendees from everywhere. Virginia, North Carolina, South Carolina, Georgia, and even one from Minnesota tried to attend, but due to flight difficulties couldn't make it.

I certainly looking forward to the next Roanoke Code Camp. Up next, the Richmond Code Camp. I hope to see a lot of familiar faces and some new ones! Richmond Code Camp is set for April 26th, 2008.

Share this post: | bookmark it! | digg it! | reddit! | kick it! | live it!
Posted by Kevin Jones with no comments
Filed under:
Saturday, February 16, 2008 5:01 AM

Powershell is addicting

It's been a while since my last tech post, but I couldn't help this one... 

Recently I have more or less fallen into the role of maintaining the infrastructure at our company. We recently got decent server to run a few Virtual Machines on. I've had mixed feelings on VMs, but that is a story for another day. We decided to go with VMWare ESX, which after 3 VM's is humming along smoothly. One of the things we needed to do was make sure our VMs were backed up properly. I am aware that ESX has this baked into it, but we aren't interested in backing up the whole VM, just a single folder in most cases. We recently accomplished this with a somewhat complex BAT script.   I decided to see if PowerShell could make things easier.

At first, I found powershell a bit frustrating. After a while though, I found it a very effective way to get something done. For instance, I needed to loop through several SVN repositories, run svnadmin hotcopy on them, then copy that across a network. That was really a breeze with powershell, whereas it would be a bit more difficult in a BAT script, if not hard to maintain and read. This is how I accomplished the task:

$repositoriesPath = "C:\source\repositories\"$backupPath = "C:\backups\"$repositories = get-ChildItem $repositoriesPath | where {$_.PsIsContainer}foreach($repository in $repositories){$repositoryDirectory = $backupPath + $repositoryif (Test-Path $repositoryDirectory){Remove-Item -path $repositoryDirectory -recurse -force}New-Item $repositoryDirectory -type directoryecho "Hotcopying repository $repository"svnadmin.exe hotcopy ($repositoriesPath + $repository) $repositoryDirectory}

The reason for the hotcopy is that it is generally a bad idea to read the SVN repositories directly. If you attempt to backup a repository during a transaction, you might end up with a wedged Berkley DB or even a corruption.

This script makes sense to me, it's easy to maintain and change if needed. And since we have full access to the .NET BCL, we can easily newup a MailMessage object and send a confirmation email that the backup was successful, or that it failed and needs to be fixed.

For a 1.0 release of powershell, I am very impressed. This was actually my first time using powershell, and wanted to see how practical it was.

Share this post: | bookmark it! | digg it! | reddit! | kick it! | live it!
Posted by Kevin Jones with no comments
Filed under:
Thursday, February 14, 2008 9:12 PM

Roanoke Valley Code Camp

It's that season again... Code Camps! Anyone in the Roanoke Valley area I would encourage to come out to the code camp on March 1st, as always there will be goodies to give away at the end, not to mention a good lineup of speakers. There's bound to be something that you'll find interesting. Check out the schedule here: http://www.rvnug.org/CodeCamp2008Schedule.html .

I will be doing a presentation on SQL CLR, which I think will be interesting. Bryce Covert, a co-worker I work with will be doing a presentation on Spring .NET, which I am looking  forward to.

Share this post: | bookmark it! | digg it! | reddit! | kick it! | live it!
Posted by Kevin Jones with no comments

Zune 2 Impressions

I finally managed to get my hands on the new Zune 2nd Generation 80 GB. I just finished my initial tinkering with it and thought I would share my thoughts.

Initially, reading the Zune Forums got my a little worried about the device. I heard lots of complaints about the new Zune Software, malfunctioning devices, and a bug in the new firmware which causes your battery to drain faster when it's off than when it is on. Although, that particular bug effected my old Zune 30 as well, but has since disappeared.

Pros

  • Much lighter and compact (in all dimensions) I no longer have the sense I have a brick in my pocket.
  • 2 2/3 times more disk space for video junkies and people with Loseless Quality Audio.
  • Tactile touch thing is pretty cool. I was happy with the round button thing, but you can fly through your library quickly now.
  • The screen is now protected by hard glass instead of plastic. The screen is clearer and more resistant to scratches.
  • Overall sounds better (maybe it's just me)? (See cons)
  • Improved battery life for Music. (Video life is about the same)
  • You can personalize it on zuneoriginals.net by ordering one with custom engraved text and images. Apple lets you do the text thing, but the images is a neat idea.

Cons

  • No equalizer. I was a little surprised by this one, but the reason behind it is to increase battery life. They removed the hardware components needed for an EQ. Above, I said better sound (last pro). The sound is better when you compare the Zune 2 with the Zune 30s when their EQ is off.
  • Not permanent, but they difficult to find.
  • Microsoft said they would be including their "premium headphones", probably due to the lack of an EQ. I was disappointed by them. They still sound very tinny. Perhaps I have just been spoiled by my other in-ear-drivers. Don't look for good bass quality in these headphones, and with no EQ, it is noticeable. I would spring for a pair of Bose if you are looking for a good pair.
  • Didn't come with a protective sleeve. I actually used my old one, and would have liked a new one.
  • Only available in black (maybe that will change later)
  • Pressing the "center" button can be a little tricky. If you press the "squircle" thing slightly off center, it will think you pressed a direction (such as left) then the center button, causing you to select the wrong thing. It takes some getting use to.

Overall, it is a very nice device, and would take it over any other media players.

Share this post: | bookmark it! | digg it! | reddit! | kick it! | live it!
Posted by Kevin Jones with no comments
Filed under:
Saturday, November 03, 2007 3:17 PM

Silverlight DevCamp

Today marked the first Silverlight DevCamp on the east coast, and it was a blast. I unfortunately was only able to stay until about 2:30.

Frank La Vigne  opened with the Key Note and did a nice walkthrough of Silverlight, and showcased us a lot of cool applications written in Silverlight. A lot of the samples he demonstrated are on the Silverlight .NET Website .

Andwer Duthie  continued to show us how easy it is to create simple animations and applications using Expression Blend, pretty neat stuff!

After that Peter Brown  presented a real world silverlight application using Silverlight 1.1. It's a carbon calculator that tells you how much carbon you emit, and how to offset it. It really showcased the power of silverlight.

After that I moderated an open discussion about Game Development in Silverlight. In the discussion we discussed some of the open source engines for Silverlight, including a physics engine. Also discussed were some of the barriers to silverlight game development, the marketshare, and comparisons to other technologies such as Flash, AJAX, and Shockwave. All in all the discussion went well, and everyone had a lot to contribute and talk about.

Unfortunately after that I had to take off. I would have loved to have stayed for the full camp. Hopefully there will be another one, or better yet, I hope we start seeing Silverlight usergroups budding around the nation.

Congratulations to Frank and all of his colleagues for putting together such a successful dev camp!

Share this post: | bookmark it! | digg it! | reddit! | kick it! | live it!
Posted by Kevin Jones with no comments
Monday, October 08, 2007 10:41 PM

Richmond Code Camp 4 and Reston Code Camp

This past weekend I spoke at Richmond Code Camp 4 about the new features of the C# 3.0 Language and some of the cool new things you can do with LINQ. I attended a session on SQLCLR presented by Hal Hayes, and custom MSBuild tasks by Kevin Israel. Needless to say, the code camp was a lot of fun. I encourage anyone in the Richmond Area to attend it, or a Code Camp regardless of where you are; they are educational, fun, and a good chance to meet new people.

The Reston Code Camp is scheduled for Saturday, November 17 th 2007 from 8 am to 6 pm, I encourage anyone in the northern Virginia to register and attend!

Share this post: | bookmark it! | digg it! | reddit! | kick it! | live it!
Posted by Kevin Jones with no comments
Monday, September 03, 2007 10:53 PM

My Impression of WiX

If anyone has created an MSI installer within Visual Studio - you probably came to the same conclusion that I did: It sucks. So, our company decided to abandon using MSI installers and decided to deploy our application as a ZIP. Making MSI's manually using the MSI SDK is cumbersome, and difficult. While that worked, I felt we took the easy way out. I always thought we should have offered both. There are those that want the ZIP because they like to do things manually, they like to know what happens; but there are those that don't care - and just want it to work.

A few months ago I spoke a Richmond Code Camp 3, where I happened to catch Darrell Norton  do a presentation on WiX (Windows Installer XML). It is, in a very loose description, what XAML does for C# as WiX does to MSI Packages. It allows you to create an MSI package from a completely XML based Solution. My first question was, "How easily can I make a NAnt script that does this for me?" The answered turned out to be very simple. There are really 2 programs needed to build a WiX project: candle and light . Candle takes your XML files, and generates an XML file set. Light, works in the sense of a linker, and finally produces the MSI. Althought the application installation does nothing fancy, it is pretty cool. With the Visual Setup Project, you just handed it a project, and it put it somewhere. You couldn't easily leverage all of the MSI foundation features, which WiX lets you do. One other thing that WiX made it easy to do was cleanup during an uninstall. If a customer were to uninstall the product (Why on earth would they do that?), the program can create various other files, such as a settings file, or a logging file. Removing these can be displeasing to the customer, so we should get rid of them. I also started making my own installer dialogs to more suit the product.

So, here we have something that is easy to use, but can fully leverage the capabilities of MSI. Microsoft used WiX to make the installers for Visual Studio 2005 and Office 2007, so it is capable of handling large applications.

The Visual Studio AddIn for it is could be better, but really, all you need is notepad or an XML File Editing tool like XML Notepad or Notepad++. I really like WiX, it's concept is simple, but it is a powerful tool - and it's open source on SourceForge.

Share this post: | bookmark it! | digg it! | reddit! | kick it! | live it!
Posted by Kevin Jones with no comments
Filed under:
More Posts Next page »