IndexOf has overloads that take StringComparison which allows me to specify how the comparison is done: culture (in)sensitive, case (in) sensitive, et cetera. Why is it that Contains doesn't sport such an overload? IndexOf makes a LINQ query look so much more ugly than Contains...

This time it is the Visual Studio 2008 extensions for Windows Sharepoint Services 3.0:

Given all my past run-ins with developing on x64, how is anyone supposed get any development work done on a x64 box?

The MSDN article Synchronous and Asynchronous Operations explains what options are available to you when using WCF. It even tells me that svcutil.exe has an /async switch. Great!

Now, back to my current home turf, Compact Framework. There is netCFsvcutil.exe, that comes with the Compact Framework Power Toys 3.5. Guess what? That option isn't available in this scaled down rendition of svcutil.

Once again Compact Framework makes it so much harder to work productively, and here's why:

http://msdn.microsoft.com/en-us/library/2e08f6yc.aspx

Quote: Asynchronous delegates, specifically the BeginInvoke and EndInvoke methods, are not supported in the .NET Compact Framework.

Back to the drawing board and the thread pool (most likely).

I am currently working on a Compact Framework project, and started development on a different machine - where I successfully used the Cellular Emulator of the Windows Mobile SDK. Today, on the other machine (the laptop), it didn't start but present me with the following error message:

After some searching (on the G-word search engine), I came across this post:

http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=3538593&SiteID=1

Sure enough I am using Vista x64, heck, we are living in 2008 with multicore CPUs and 4GB+ of RAM!

And here is the Catch 22: when moving development to a Virtual PC image, you don't get USB ports which you need for connecting to a real device...

This is a bugfix release for the previously posted port of nGallery to ASP.NET 3.5. The following changes are incorporated:

• Bugfix: slideshow had "photos/" hardcoded in nGalleryLib (for navigation buttons)
• Bugfix: Event log exceptions, please see Get GoogleBot to crash your .NET 2.0 site (plus ASP.NET 2 + url rewriting considered harmful in some cases). Nicolas Sorel was nice enough to provide me with his .browser definition files.
• Bugfix: default_highlight_image.jpg no longer resided in /photos and therefore caused an exception for galleries that had no highlighted image; moved it back to \photos
• Change: AlbumHandler no longer implements IHttpHandler
• Change: AssemblyInfo.cs changed version to 2.0 to differentiate from original 1.6.1

That's all the changes that happened, here are the source and deployment files:

nGalleryTNG2_ProjectFiles.zip (2.95 MB)
nGalleryTNG2_WebFiles.zip (1.03 MB)

I posted a version of the Really Simple Guestbook - With XLinq for Orcas Beta 2 earlier on this blog. Today, I updated this small application for VS2008 RTM. The following changes are incorporated:

• It is now a Web project, no longer file system based
• It includes AIP for form spam protection (aka captcha)

I decided to not include the Microsoft Anti-Cross Site Scripting Library V1.5, that is up to the reader if additional security is required (note: you'd have to add this to AddEntry.aspx's logic of inserting new guestbook entries).

Download: XlinqGuestbook.zip (165.53 KB), License: BSD

I updated the TFS Code Comment Checking Policy so that it works with VSTS 20008 RTM. The downloaded labeled as Beta 1 comes with the well-known setup, the changes to the August test version are only minimal: the parser has been updated (to better support C# 3.0), and all projects now target .NET Framework 3.5.

Please use the discussions to report any issues you find.

TechEd Developers 2007 is over, and before moving on (and flying back to snow in Austria), here is the list of sessions I attended this year:

• TLA201 - A Tour of Visual Studio 2008 and the .NET Framework 3.5
• OFF401 - .NET Developers Advanced Introduction to SharePoint 2007
• TLA324 - What's New in Team System for Software Testers
• SEC301 - CLR Security in .NET Framework 3.5
• DAT201 - Entity Framework Introduction
• WEB401 - Building Highly Scalable ASP.NET Web Sites by Exploiting Async Programming Models
• TLA304 - Building Services with the Service Factory: Modeling Edition
• DAT303 - Entity Framework: Application Patterns
• TLA305 - Continuous Integration With and Without Team System
• TLA307 - Improving Code Performance with VSTS 2008 Team Edition for Software Developers
• DAT304 - Managing Unstructured Data in SQL Server 2008: Introducing the FileStream Datatype
• TLA403 - Loose Coupling in Practice: CAB in the Real World
• ARC401 - Designing High Performance, Persistent Domain Models
• TLA407 - Dealing with Concurrency and Multi-Core CPUs with Today's Development Technologies
• SBP307 - Modeling and Composition of Applications
• TLA319 - The Joins Concurrency Library
• TLA405 - Parallel and Async Functional Programming on .NET with F#
• WEB403 - Securing your High-Risk ASP.NET Web Applications - A Case Study

Compared to last year, I managed to attend more sessions, however, there were also more duds. The last session (WEB403) turned out to be the one that earned the raspberry this year (a close runner-up: TLA403). Coming out on top I decided to nominate three: OFF401, TLA307 and DAT303.

XSSDetect is a static code analysis tool that helps identify Cross-Site Scripting security flaws found within Web applications. It is able to scan compiled managed assemblies (C#, Visual Basic .NET, J#) and analyze dataflow paths from sources of user-controlled input to vulnerable outputs. It also detects whether proper encoding or filtering has been applied to the data and will ignore such "sanitized" paths. Download

Article at The Register: How ASP.NET began in Java. Reminds me of the "C# is COOL" t-shirt I have...

If you are interested in IronPython, you should check out Matt's latest SharpDevelop addin: IronPython Integration In SharpDevelop 2.2. His blog post details the status of code completion, Windows Forms designer support, plus: converting code from C# or VB.NET to IronPython.

Please note that this is a work in progress, and that the official release of this addin will be for SharpDevelop 3 and IronPython 2.0.

The recently released version of CruiseControl.NET has a small issue with MSBuild Output in the Web dashboard: Unable to load transform: c:\ccnet\webdashboard\xsl\msbuild.xsl. A fix can be found in this thread in the fourth post. The reason to upgrade to 1.3? CC.NET now runs on .NET 2.0 (it has been ported), and it has a feature I want to try: integration queues.

Microsoft released a UAC demo. It is just basic process elevation (read: save the time by not downloading it), which I described in more detail (with more reuseability) in UAC Elevation in Managed Code: Starting Elevated Processes.

I have been patiently waiting for this one, quote from the download page: “Acropolis” builds on the rich capabilities of Microsoft Windows and the .NET Framework, including Windows Presentation Foundation (WPF), by providing tools and pre-built components that help developers quickly assemble applications from loosely-coupled parts and services.

Download

Bill Staples put together a post on what's new in IIS7 Beta 3. He also talks about the all-new IIS7 FTP server (which I knew about for a long time - I had hoped Beta 3 would be available for my MSDN Briefing in Vienna last month, but no such luck). Also, he mentions the GoLive! license for IIS7.

The video recordings for the main tracks of FOSDEM 2007 are online now. Of interest for .NET developers might be Miguel's session on "Turbocharging Linux with Mono".

At long last at least a CTP is available. Definitely worthwhile to check out.

I admit it: UAC Elevation in Managed Code: "Talking" to an Elevated Process via WCF is a kludge. The reason why I dabbled with this approach at all is that I failed to implement COM elevation with managed code (not elevating a COM component, but the COM component itself). However, at long last, I succeeded in that respect too: I now present you the all-managed code solution to UAC elevation!

Once again I built myself a small demo frontend application:

As you can guess, the first button does plain vanilla COM InterOp without any UAC elevation. Thus its code is rather simple:

private void simpleCallButton_Click(object sender, EventArgs e)
{
  Type t = Type.GetTypeFromCLSID(new Guid("71E050A7-AF7F-42dd-BE00-BF955DDD13D4"));
  object o = Activator.CreateInstance(t);
  t.InvokeMember("SayHello", BindingFlags.InvokeMethod, null, o, null);
}

Why this reflection magic? Well, the COM component I am calling here is implemented in .NET - and both VS as well as tlbimp balk at reimporting the exported type library.

The COM component in question has been regasm'ed & gacutil'ed (ManagedElevator project in the download). Although the name implies that I am after elevation, it is pretty much a standard COM component written using C#:

public class TheGuids
{
  publicconststring IHelloWorld ="B8CD5C09-9ACD-49b0-BF6F-C7B0F29795F9";
  publicconststring ClassToElevate ="71E050A7-AF7F-42dd-BE00-BF955DDD13D4";
  publicconststring AppId ="75AB90B0-8B9C-45c9-AC55-C53A9D718E1A";
}

[Guid(TheGuids.IHelloWorld)]
[InterfaceType(ComInterfaceType.InterfaceIsDual)]
publicinterface IHelloWorld
{
  [ComVisible(true)]
  void SayHello();
}

[Guid(TheGuids.ClassToElevate)]
[ClassInterface(ClassInterfaceType.None)]
publicclass ClassToElevate : IHelloWorld
{
 public ClassToElevate()
 {
 }

 [ComVisible(true)]
 publicvoid SayHello()
 {
  MessageBox.Show("Hello World");
 }
}

So how do you go from "standard" "plain-vanilla" COM component to COM elevation? The part that stumped me for so long was the ClassInterface attribute - if you forget this guy, you'll end up with an InvalidCastException thrown by UACManager.LaunchElevatedCOMObject.

But that's not quite all to get up and running with COM elevation: in addition, you need to modify the default registration for this component - specifically, you need to configure the DllSurrogate. This is where the AppId GUID comes into play: it isn't used in code (kept there for documentation purposes only), but in registryadditions.reg. It binds the various registry keys. And speaking of this .reg file, please take note of the LocalizedString value: it contains the text for the UAC prompt (also check out UACPrompts.rc, resource.h, compilerc.bat as well as the properties of the ManagedElevator project where the compiled .res file is referenced).

Note Before importing the .reg file into the registry make sure to fix the file path contained in LocalizedString! And if you create your own elevated COM component DO NOT reuse any of my three GUIDs - use guidgen.exe to create your personal ones.

From there, UAC elevation is smooth sailing. The Reflection version of COM elevation looks very similar to non-elevated calls:

private void managedElevation_Click(object sender, EventArgs e)
{
  // CLSID
  Guid classId =new Guid("71E050A7-AF7F-42dd-BE00-BF955DDD13D4");

  // Interface ID
  Guid interfaceId =new Guid("B8CD5C09-9ACD-49b0-BF6F-C7B0F29795F9");

  object o = UACManager.LaunchElevatedCOMObject(classId, interfaceId);

  Type t = o.GetType();
  t.InvokeMember("SayHello", BindingFlags.InvokeMethod, null, o, null);

  Marshal.ReleaseComObject(o);
}

Of course this is not really a good solution (late binding). So instead I manually imported the IHelloWorld interface:

[
ComImport(),
Guid("B8CD5C09-9ACD-49b0-BF6F-C7B0F29795F9"),
InterfaceType(ComInterfaceType.InterfaceIsDual)
]
  interface IHelloWorld
  {
   [
   MethodImpl(MethodImplOptions.InternalCall, MethodCodeType = MethodCodeType.Runtime),
   PreserveSig
   ]
    void SayHello();
  }

Which makes calls into the elevated COM object much easier and cleaner:

private void managedElevationInterface_Click(object sender, EventArgs e)
{
  Guid classId =new Guid("71E050A7-AF7F-42dd-BE00-BF955DDD13D4");
  Guid interfaceId =new Guid("B8CD5C09-9ACD-49b0-BF6F-C7B0F29795F9");

  object o = UACManager.LaunchElevatedCOMObject(classId, interfaceId);

  IHelloWorld ihw = (IHelloWorld)o;
  ihw.SayHello();

  Marshal.ReleaseComObject(o);
}

So why should you use the COM elevation solution instead of starting the process? Well, there are a couple of reasons:

• You can package more than one component into a DLL and still have custom UAC prompts thanks to LocalizedString
• Your users don't get "an unidentified program..." warnings. Thank you COM registration
• If you ever need to talk more extensively with the elevated process then this approach can be adapted more easily

The source code

ConsumeMyElevatedCOM.zip (97.56 KB)

You will find a file aptly named notes.txt in the ManagedElevator project that describes all the necessary steps to get up and running.

I hope you find this sample useful and not have to spend as much time as I did. Cheers!

In the blog post UAC Elevation in Managed Code: Starting Elevated Processes I talked about how to start an elevated process. However, just starting a process might not cut the mustard, for example if you need to hand over data to the elevated process. You could achieve this by passing, let's say, some data as command line arguments to ProcessInfo before starting the elevated process. But that seriously limits communication.

So how can you perform communication with an elevated process? My first idea was to use .NET Remoting. Once I thought through the multi-instance scenario, I quickly realized that this meant the server had to be running in the non-elevated application, because only it could properly choose a port. And because I am not a fan of Remoting anyways, I decided to give WCF (Windows Communication Foundation, a pillar of .NET 3.0) a try.

It looked like smooth sailing at first, but then I realized that with WCF too I needed to implement the service inside the non-elevated application. This time, however, the reason was "How do I know when the elevated application has initialized before I can actually start communicating with it?". Back to the drawing board.

The final solution now looks like this: the non-elevated application starts a service. The operations contract specifies a callback, which, once the elevated application has signalled its readiness, can be used by the non-elevated application to "talk" with the elevated application. I didn't intend to go duplex, but hey, if there's no other way I am willing to take plunge. Speaking of tricks of the trade: I am using imperative binding to a named pipe. Reason? Well, WS bindings won't work (see here and here), and the TCP channel would pop up a firewall warning. That's why.

Let's look at the applications - first the non-elevated one:

This time I forfeited eye candy (the shield button). Same (missing eye candy) goes for the elevated application as it is a console application only:

Solution-wise, this simple two-application scenario is split into four projects:

So where do we start? With the easy part inside ElevationContract:

[ServiceContract(Namespace ="http://Christoph.Wille.Samples",
CallbackContract =typeof(IElevatedProcess))]
publicinterface IWaitForElevatedProcess
{
  [OperationContract(IsOneWay =false)]
  void ElevatedProcessStarted();
}

[ServiceContract(Namespace ="http://Christoph.Wille.Samples")]
publicinterface IElevatedProcess
{
  [OperationContract(IsOneWay =false)]
  void SayHello(string message);
}

The interface IWaitForElevatedProcess is implemented in StandardUserApp. It is the service endpoint that is initialized before the elevated process is started - and once the elevated application is up and running, it calls into ElevatedProcessStarted. And we are in business for using the IElevatedProcess callback that is implemented in the ElevatedProcess console application.

So how is the service endpoint intialized - let's take a look inside:

private const string theProcess =@"..\..\..\ElevatedProcess\bin\Debug\ElevatedProcess.exe";

privatevoid tryitButton_Click(object sender, EventArgs e)
{
  string channelIdentifier = MiscHelpers.CreateRandomString(64);
  MyUACServiceHost.StartService(channelIdentifier);

  // starting it modal doesn't work (obviously - unless we have more threads, of course)
  ElevatedProcess.Start(theProcess, channelIdentifier);
}

Interesting tidbit #1 is CreateRandomString: it creates a random string to use for the address. Why? Well, if multiple instances of our application are running and trying to elevate a process, we are in trouble. Which brings me to StartService:

internal static void StartService(string pipeEndPoint)
{
  NetNamedPipeBinding binding =new NetNamedPipeBinding();
  binding.Name ="uacbinding";
  binding.Security.Mode = NetNamedPipeSecurityMode.Transport;

  Uri baseAddress =new Uri("net.pipe://localhost/uac/"+ pipeEndPoint);

  myServiceHost =new ServiceHost(typeof(SampleService), baseAddress);
  myServiceHost.AddServiceEndpoint(typeof(IWaitForElevatedProcess), binding, baseAddress);
  myServiceHost.Open();
}

As I said before, I am doing it imperatively (no configuration in app.config necessary). That's all there is to getting the service up and running.

Now let's switch to the console application's Main method:

static void Main(string[] args)
{
  if (args.Length != 1)
  {
    Console.WriteLine("One argument expected - the channel identifier");
    return;
  }

  NetNamedPipeBinding binding =new NetNamedPipeBinding();
  binding.Name ="uacbinding";
  binding.Security.Mode = NetNamedPipeSecurityMode.Transport;

  String url ="net.pipe://localhost/uac/"+ args[0];
  EndpointAddress address =new EndpointAddress(url);

  WaitForElevatedProcess client =new WaitForElevatedProcess(
      new InstanceContext(new SampleCallback()),
      binding,
      address);

  client.ElevatedProcessStarted();

  Console.WriteLine("The elevated process is now ready");
  Console.ReadLine();

  client.Close();
}

Similar to normal client WCF code, however, with the duplex twist hidden inside WaitForElevatedProcess:

public class WaitForElevatedProcess : DuplexClientBase<IWaitForElevatedProcess>, IWaitForElevatedProcess
{
  public WaitForElevatedProcess(System.ServiceModel.InstanceContext callbackInstance,  
    System.ServiceModel.Channels.Binding binding,
    System.ServiceModel.EndpointAddress remoteAddress)
       : base(callbackInstance, binding, remoteAddress)
  {
  }

  publicvoid ElevatedProcessStarted()
  {
    base.Channel.ElevatedProcessStarted();
  }
}

Once the channel is connected, this elevated process calls back into the service piece which lives in the non-elevated application, namely SampleService:

[ServiceBehavior(ConcurrencyMode = ConcurrencyMode.Reentrant,
      InstanceContextMode = InstanceContextMode.PerSession)]
publicclass SampleService : IWaitForElevatedProcess
{
  publicvoid ElevatedProcessStarted()
  {
    OperationContext.Current.GetCallbackChannel<IElevatedProcess>().SayHello("Chris");
  }
}

This method is the workhorse where I can talk to the elevated process - if only my callback interface had more as well as more serious methods ;-)

Speaking of talking, I owe you the code for the callee in the console application:

[CallbackBehavior(ConcurrencyMode = ConcurrencyMode.Reentrant)]
publicclass SampleCallback : IElevatedProcess
{
  publicvoid SayHello(string message)
  {
    Console.WriteLine("Hello world "+ message);
  }
}

That's it - to recap: first, we initialize the WCF service. Then elevate a process. This process, once initialized, calls into our service and leaves a callback. And then we are in business talking to the elevated process (setting data, being notified when the elevated application quits and why, ...).

Sample warnings before you download: MyUACServiceHost definitely should be instance instead of static. And, more restricting - starting the elevated process modal won't allow communication unless you start the service on a separate thread. For simplicity reasons I didn't do this for the POC.

ElevateProcessTalkWCF.zip (27 KB)

Before concluding I wanted to add a few words: my ideal implementation for UAC would be COM elevation. That way, one can put more than one component into a single DLL, and still get a meaningful UAC prompt thanks to the LocalizedString registry key - which is per component, and not per executable (which is the case for this solution if you add multiple actions). If you need differing prompts for each administrative action, there is only one course of action you can take with processes: create multiple executables. Not very pretty, but I failed with writing an elevatable (not a word, I am sure) managed (C#) COM component.

The previous installment UAC Elevation in Managed Code: Starting Elevated Processes dealt with starting executables with the "real" administrative token. In this blog post, we deal with starting a COM component with elevated privileges. For in-depth background information, please consult Kenny Kerr's absolutely excellent post on Windows Vista for Developers – Part 4 – User Account Control.

To start with, we need a COM component. Instead of writing an ATL C++ COM component from scratch, I took the MyElevateCom sample from CoCreateInstanceAsAdmin or CreateElevatedComObject sample from the Vista Compatibility Team Blog. Note that for building it, check out my post Visual Studio on Vista: Not so Fast!

Assuming that you built and successfully registered the COM component (it is built to the instuctions from Kenny's post), you can go about and write the managed caller. First, we need a reference to the component:

Then comes the tricky part - actually instantiating the COM component. When you take a look at the C++ example, you see that quite some "moniker magic" is involved that cannot be replicated by simply newing up the component. So how to mimic this behavior in managed code? The Microsoft® Windows® Software Development Kit for Windows Vista™ and .NET Framework 3.0 Runtime Components comes to the rescue: inside, you find C:\Program Files\Microsoft SDKs\Windows\v6.0\Samples\CrossTechnologySamples.zip, which contains the VistaBridge sample.

From that, I took the VistaBridgeLibary, and modified the static UACManager.LaunchElevatedCOMObject method a bit:

[return: MarshalAs(UnmanagedType.Interface)]
publicstaticobject LaunchElevatedCOMObject(Guid Clsid, Guid InterfaceID)
{
  string CLSID = Clsid.ToString("B");
  string monikerName ="Elevation:Administrator!new:"+ CLSID;

  NativeMethods.BIND_OPTS3 bo =new NativeMethods.BIND_OPTS3();
  bo.cbStruct = (uint)Marshal.SizeOf(bo);
  bo.hwnd = IntPtr.Zero;
  bo.dwClassContext = (int)NativeMethods.CLSCTX.CLSCTX_LOCAL_SERVER;

  object retVal = UnsafeNativeMethods.CoGetObject(monikerName, ref bo, InterfaceID);

  return (retVal);
}

Modifications: the method is now public instead of internal, and CLSCTX changed to local server (otherwise it wouldn't work).

Next, we need a UI:

This button is the CommandLinkWinForms control from VistaBridgeLibary, with the ShieldIcon property set to true.

Let's hook up the event code:

private void tryItButton_Click(object sender, EventArgs e)
{
 Guid IID_ITheElevated =
  new Guid(0x5EFC3EFB, 0xC7D3, 0x4D00, 0xB7, 0x2E, 0x2F, 0x86, 0x4A, 0x1E, 0xAD, 0x06);

 Guid CLSID_TheElevated =
  new Guid(0x253E7696, 0xA524, 0x4E49, 0x9E, 0x50, 0xBF, 0xCC, 0x29, 0x91, 0x31, 0x23);

 object o = UACManager.LaunchElevatedCOMObject(CLSID_TheElevated, IID_ITheElevated);

 ITheElevated iface = (ITheElevated)o;

 // Call the method on the interface just like in the C++ example
 iface.ShowMe();

 // Release the object
 Marshal.ReleaseComObject(o);
}

The interface ID as well as class ID guids come directly from the C++ project (it is always a good idea to "speak" more than one language), but you could obtain those from the type library or registry as well if you don't have the source code of the component handy.

Object creation is handled via LaunchElevatedCOMObject, and the resultant object is cast to the interface from the imported type library. Noteable (and important) is the last line: because the object wasn't created by the runtime, we have to take care of its destruction (the created interface doesn't have a Release() method, so we use Marshal.ReleaseComObject).

That's it - your managed code is now instantiating an elevated COM object that has full reign over the system.

ElevateCOMComponentSample.zip (117.07 KB)

I would agree that this is indeed a sensible error message when I were about to add a COM reference to an inproc (DLL) server. However, this is an out of process server, an EXE. This guy (callee) does load in a separate process space from the caller, with a separate instance of the .NET runtime. Someone care to enlighten me why this restriction is in place?

By the way, tlbimp behaves the same way (just to make sure...):

TlbImp : error TI0000 : System.Runtime.InteropServices.COMException - Type library 'OutOfProcServer' was exported from a CLR assembly and cannot be re-imported as a CLR assembly.

From the "What could possibly go wrong?" department: starting a WPF application (verified offenders are MsbuildG and VistaBridge from the Windows Vista SDK) crashes Vista. Or the graphics driver to be more precise. The result is nonetheless a perfectly reproducible BSOD on my IBM X31 laptop. The funny part? This ATI Mobility driver (6.14.10.6546) came from the Windows Vista Update Service and is MS HW Compat signed!

Matt followed through with his promise (see CCCP 1.2 Available With Setup) to write a tutorial on how to create a WiX-based installer with SharpDevelop: Creating an Installer with SharpDevelop

Today I got around to trying CCNetConfig, which provides a UI for editing CruiseControl.NET's ccnet.config file. Thanks to the SharpDevelop project, I have a rather good test case with a couple of continuous integration plus nightly builds:

Our ccnet.config file is maintained by using Notepad (yes, you read that right). As such, I added a few <!-- --> comments here and there, mostly for pointing me to documentation, blog articles or just disabling a feature temporarily. Therefore, you can already guess my biggest gripe: on saving the file, it is auto-reformatted and all my comments are gone.

Other than that, it is a really good way of editing ccnet.config especially because all properties are easy to edit and you are presented the documentation automatically, no more searching around for tag / attribute help on the Web.  Overall: very useful if you don't spend all day being release manager.

Michael Howard has all the links in this blog entry Online Security Sessions from TechEd IT Forum Available. Topics include: malware cleaning, UAC internals, social engineering, Vista kernel changes, Vista firewall and IPSec enhancements. Which reminds me that the post-conference DVDs should tip up in my mailbox rsn.

This Q&A item is part of the current MSDN magazine's Security Brief's column by Keith Brown. I am pretty sure that this problem will rear its head sooner or later on every developers machine, that's why I am 'pinning' the link in my blog for my own reference too.

From the nuggets page: Don't have the time to read a 10-page how-to article or watch a full length webcast? Try an MSDN Nugget, a webcast that takes you step-by-step to discovering new functionality or exploring a hot developer topic, all in 10-15 minutes. If you haven't seen this yet, check it out!

Read the post from Miguel Microsoft and Novell Collaborate. Good news for Mono, OpenOffice and Samba.

Today, we shipped Beta 2 of SharpDevelop 2.1 (release information). Usually, we only ship two betas (followed by release candidates), but last weekend we decided to add a third one to this release cycle - to build a rock-solid foundation for the releases coming after version 2.1.

Speaking of last weekend: three of us met for the annual #develop developer days (#d^3 2006, a four day event) - way short of the original invitation list. But this turned out to be an advantage for discussing architecture and componentization. A lot of improvements already made it into Beta 2, a few more are yet to come in Beta 3.

Part of this effort was the creation of a presentation on SharpDevelop, which includes an area of interest to all .NET developers out there: a list of our components that can be reused outside the context of SharpDevelop plus the documentation and samples for those components. Remember: SharpDevelop is LGPL, so feel free to use our components!

In addition to this "general" slide deck, Daniel (SharpDevelop technical lead) also created a "Level 600" introduction to NRefactory, which can be found here. Definitely interesting for those of you that want to use code completion in our text editor control.

Finally, SharpReport now is a project in its own respect. The reason(s)? Well, SharpDevelop and SharpReport are developed on different schedules, so now we are customers of each other and no longer intertwined. Cool stuff coming on this front: export to various formats, allowing you to use SharpReport - yes - for generating reports in ASP.NET sites!

The November 2006 issue has lots of good security articles, which are available online too. Check out Security Habits, Threat Modeling (STRIDE approach), Extending SDL or SQL Security to name a few.

Last Tuesday, I held the talk "Advanced Code Access Security" at UG Styria in Graz. This talk was originally part of the MSDN Security Briefings held in Austria earlier this year, for which MS Austria had asked MVPs to help create and deliver security content. Advanced CAS seemed an interesting enough developer topic to re-run at user groups, and Mario (the author of this session) has allowed me to publish the slide deck and demos for the general public.

AdvancedCodeAccessSecurity.pdf (4542 KB)

AdvancedCAS.zip (599.6 KB)

Please note that I have published only demos four (setting CAS via setup) and six (using CAS in addin application) - those are the "completed" versions of the demos.

Today, I was asked whether there was a "real" difference between debug and release builds of a C# project - other than the PDB files. I didn't know for sure, so I set out on a search for more information, which turned up the blog entry debug vs. release in C#. The interesting part is the first comment by Josh Williams: "...the /debug[+|-] switch controls JIT optimizations <snip />. Disabling JIT optimizations is very useful for debugging purposes but will very much affect the runtime perf of an app as much of the optmization of your code is done by the JIT, not CSC..."

Now that definitely turns shipping a debug build to customers into a non-starter.

Beta 1 of SharpDevelop2 2.1 is available for download. While I was putting together the annoucement for v2.1 yesterday, I realized that for a point release, we really managed to put in a lot of new cool features:

• FxCop Support
• Component Inspector
• WiX Support
• Incremental Search
• Code Navigation History
• List Data Sources in SharpReport
• XPath Queries
• Code Completion for Different Frameworks
• GoTo XML Schema Definition
• Targeting Different Frameworks
• Hosting of SharpDevelop in 3rd Party Applications

A couple of WOW features (for me, at least): Not only can you compile an application for different versions of .NET, you also get version-specific code completion support. Another cool one is that you can host SharpDevelop in your application, providing your application a "macro editor" (on steroids I might add) with full .NET support. And to pick a third, code analysis rounds out our professional offering in addition to code coverage as well as unit testing.

Two features did not make it for the Beta 1 announcement as they don't yet cover all the scenarios we are hoping for: integrated Subversion support (yeah!) and targetting the Compact Framework for Windows CE devices. Those slipped silently into this release.

As you can see, SharpDevelop is ever growing and the developers working on it can be rightly proud of their achievements!

Finally, a kind of "call to action": let us know what you think! Not only in our forums, but also in your blogs, communities, et cetera. We need your feedback regarding feature set, stability, and much more.

Disclaimer: I am the PM for the #develop project.

After almost two years in development, the #develop team has shipped version 2.0 of its open source integrated development environment (IDE) SharpDevelop2. The new version supports the .sln / .*proj project file formats of Visual Studio 2005, therefore you can open and edit existing projects inside SharpDevelop2. The team however does not view SharpDevelop2 as a competitor for the Express line of products (comparison) from Microsoft, but it aims at software developers that need best of breed tools for their software development process - like unit testing, code coverage, documentation generation and more. In the same vein, version 2.1 will complement those existing features with integrated source code control, code analysis tools as well component testing.

SharpDevelop2 is especially well-suited for developers that chose the Boo language, because SharpDevelop2 offers first-class support for code completion as well as the Windows Forms designer. Aside from this unique selling point there a couple of smaller but nonetheless productivity-enhancing features in version 2.0: code conversion (eg VB.NET to C#, but see for yourself), support for Mono, documentation preview, RegEx compilation und quite a few more.

A lot of the features are owed to the ease of integration and extensibility provided by the addin system found in SharpDevelop2. This addin system can be used by developers in their own application - this being the reason for the rather unconventional license choice for SharpDevelop2: LGPL instead of GPL, which is much more common for development tools such as #develop. Re-use by third parties has been the driving factor to change the license.

Thanks to all the contributors that made SharpDevelop2 a reality, especially the technical lead on the 2.x effort, Daniel Grunwald.

Get it here

Currently reading: The Security Development Lifecycle

• Microsoft Pre-Release Software Microsoft .NET Framework 3.0 - June 2006 CTP (Note: on Vista, only build 5456 is supported!)
• Microsoft Visual Studio Code Name “Orcas” Community Technology Preview – Development Tools for .NET Framework 3.0
• Microsoft® Visual Studio® 2005 Extensions for Windows® Workflow Foundation Release Candidate 2
• Hands-on Labs for Windows® Workflow Foundation Release Candidates
  

And if you still haven't had time to take a closer look at WinWF, check out Karsten's My Five Day Course For Hitting the WPF Curve/Cliff.

The blog post ADO.NET vNext: The Entity Framework, LINQ and more on the Data Access Blog has links to all relevant articles on the next version of ADO.NET and the Entity Data Model (EDM). Make sure to read at least the vision document.

Half an hour ago, I completed my talk "Windows Workflow Foundation & ASP.NET 2.0". As promised, here is the list of links to sites / documents that I used to prepare this talk & accompanying samples.

• Coming improvements to ASP.NET hosting of Windows Workflow Foundation after WF Beta 2.2
• Cutting Edge, Windows Workflow Foundation Part 1, Part 2
• Examples of using Persistence and Tracking in ASP.NET
• Using WF to run a page-flow
• Of course, http://wf.netfx3.com/ (Webcasts et al)

Also, see my last post on ASP.NET PageFlow CTP. This was the last part on "future technologies".

Update A foto from my talk on Monday (debugging a workflow in ASP.NET):

Yesterday night, I watched a WebCast from TechEd Boston - "An Overview of ASP.NET and Windows Workflow Foundation". What this innocuous title hid was the fact that Kashif Alam (PM in the Developer Division) was presenting vNext features for ASP.NET workflow integration: Page flow (PageFlow) as well as UI flow (UIFlow), plus the accompanying extensibility model.

What do those two separate approaches provide? Well, you get MVC (model-view-controller) support for same-page (UIFlow) as well as cross-page (PageFlow) scenarios. Pretty neat was the included "Choosing the right solution" slide to get an idea what's in store:

As developers, we will get our hands on this later this year in the form of the "ASP.NET PageFlow CTP" (at least that's the current name), and it will be deployed with Orcas.

NetFx3 is the new community site that focuses on the four .Net Framework 3.0 technologies Windows Communication Foundation, Windows Presentation Foundation, Windows Workflow Foundation and Windows CardSpace.

When working with a team, it is always a good idea to have dependencies in a separate folder so everyone can reference them using relative paths:

References from this dependencies folder then look as follows in the MyWinApp.csproj file:

  <ItemGroup>

    <Reference Include="Boo.Lang, Version=1.0.0.0, ...">

      <SpecificVersion>False</SpecificVersion>

      <HintPath>..\Dependencies\\Boo.Lang.dll</HintPath>

    </Reference>

...

    <Reference Include="System" />

...

    <Reference Include="System.Xml" />

  </ItemGroup>

So every team member that checks out the project will be able to work in their workspace, as well as the build server will have all the proper references. Great.

But what about the following scenario: depending on Release or Debug, you need different references - how can you solve this problem? The first step is to go and create a directory for each configuration below the Dependencies folder:

Next, copy the assemblies to the respective directories. Plus, you have to modify the .csproj file and add $(Configuration) to the external reference's hint path:

  <ItemGroup>

    <Reference Include="Boo.Lang, Version=1.0.0.0, ...">

      <SpecificVersion>False</SpecificVersion>

      <HintPath>..\Dependencies\$(Configuration)\\Boo.Lang.dll</HintPath>

    </Reference>

That's it - even Visual Studio will honor this change and still provide you with IntelliSense.

Before closing, I want to mention a new tool - even though it doesn't (yet) support editing the hint path, you should check out Attrice's Microsoft Build Sidekick. It allows you to graphically edit .*proj files:

Disclaimer: I am the Senior Project Wrangler for #develop. Therefore I am biased as well as knowledgeable.

Today, we shipped RC2 of SharpDevelop2. For those of you who haven't heard of it before, it is an Integrated Development Environment (IDE) for .NET. I will get to the features in just a second. First, I want to thank all developers that spent time on making v2 a reality. Daniel, the lead developer on v2, actually implemented a nice little tool for showing the project statistics, you can read more and download the utility in his blog Analyzing the code in SharpDevelop. Wow, we started quite a long ago on this baby.

I promised to get back to the feature set. Let's tackle it with more than a grain of blog posts and feature videos:

Supported Programming Languages

My definition of support is as follows: full code completion (aka IntelliSense) and a working Windows forms designer. Therefore, three languages qualify: C#, VB.NET and Boo. Aside from those fully supported languages, you get syntax highlighting for many more.

Speaking of syntax highlighting and code completion: both features are supported for XML files. You can check it out in the xml editing experience feature video (yes, this is available since v1.1!) You get this for MSBuild files too!

Features You Would Expect

Let's start with the integrated debugger. This has been our achilles heel since the very beginning, as implementing a debugger isn't exactly a piece of cake. However, thanks to David, v2 sports a debugger and you can watch a demo.

Let's continue with a simple list: Search & Replace, code folding, code templates (just try Ctrl+J in the editor), a toolbox and more.

Cool Features

Ahhh. At last. Let's see what we got:

• Unit testing (since 1.1, NUnit-based)
• Code Coverage (2.0, based on NCover - read more in Matt's blog post)
• Documentation generation (since 1.1, based on NDoc)
• Quick XML Doc (since 1.1, just try Ctrl+Q to get a preview of the HTML help that will be generated for your XML comments)
• Auto code generation (since 1.1, just try Alt+Ins)
• Code converter - convert your projects from C# to VB.NET and vice versa (since 1.1). New in 2.0: three way with Boo.
• Reports. Yes, SharpDevelop ships with a free-to-use report engine, #report. It was added late in 1.x, now improved for 2.0. Watch the demo
• Support for multiple frameworks - although 2.0 is the default, SharpDevelop can target 1.1 as well as Mono. Even Gtk# is supported.
• Ctrl+Mousewheel zooming. You will like it. I do.

What's Not There

We ain't a big software company, so we have to tackle features in order. Therefore, you won't find ASP.NET support in SharpDevelop, as well as others: CF support (planned for 2.1), version control (planned for 2.1), ClickOnce (planned for 2.1)...

Even if you don't plan on using SharpDevelop for your daily work, give it a try and let us know what you like and what not on our forums. You might even learn about a cool new feature like Component Inspector that is coming with 2.1, code-named Serralongue. And we'd be more than happy to welcome additional developers, testers, writers and translators.

Six labs, both available in C# and VB.NET. Download (nuff said)

Found this on Alex' blog (he posted it in German last week): Microsoft UK has released a document (PDF) titled "The Developer Highway Code" (The drive for safer coding), which covers the following topics:

• Integrating Security into the Lifecycle
• Security Objectives
• Web Application Security Design Guidelines 
• Threat Modelling
• Security Architecture and Design
• Security Code Review
• Security Deployment Review

The document covers v1 and v2 of the .NET Framework, and it does contain useful checklists. Be sure to grab it!

If you ever consider using NGen with your .NET applications, then you simply MUST read the article The Performance Benefits of NGen in the current issue of MSDN Magazine. It can't get any more authoritative than that (the author Surupa Biswas works on the runtime's back-end compiler and focuses primarily on pre-compilation technologies).

On my flight to Seattle today (or yesterday, depending on the time zone) I started to read Professional ASP.NET 2.0 Security, Membership, and Role Management by Stefan Schackow. The book definitely is a must-have for every ASP.NET developer, even if you decide to read one chapter only: A Matter of Trust (#3). This one will save you loads of time when you have to deploy an application into non-full trust environments. However, the other chapters are worthwhile too, like #2 which details exactly which identity is used when by what part of the engine. Bottomline: highly recommended reading.

Will be there Wednesday & Thursday as ATE (Ask the Experts), so drop by in the experts zone and say hello!

Yesterday, I picked up on an old code piece of mine - sending images to the client via an HttpHandler. Why in the world would you implement that with a handler when there is http.sys kernel mode caching? Well, I had a few unique constraints:

• the images had to live outside the Web root and any of its vroots
• the image names had to be concealed because the naming would give away information, and renaming the images prior to publishing on the Web was out of the question

Now, a common approach to sending images from a certain directory (leaving requirement #2 by the wayside for the moment) would be this:

image.aspx?image=iamthebest.jpg

So what is wrong with this approach? First and foremost using an ASP.NET page. The page lifecycle is a drain on performance and throughput, because you simply don't need it. That sorts out why I chose to go with an HTTP handler.

Secondly, somebody could DOS your server. You heard me right. For the background, check the article Trap Alert: Files that aren't. A .NET version (managed C++) of this checker can be found in this download (the article Dateityp-Ermittlung in Managed C++ is only available in German).

How do you get around this issue? Well, how about reading the directory up front, and instead of having the filename in the URL, send the hash! When the image is requested, take the hash and look up the corresponding file, presto. In addition you get one security feature for free: no directory traversals can be hidden in your code.

When I uncovered the code yesterday, I decided to rewrite it for more general use. So what do you get?

• The ImageCacheControls project: it contains the ImageCache class, which does most of the heavy lifting. In addition, you get an ImageCacheControl server control, as well as the implementation of the HTTP handler. (Don't forget to check out the Readme.txt for the latest on feature set and known issues)
• The Web project: a rather simple Web site with demo files in it. The file I want to direct your attention to is Image.ashx. This is the one file - aside from the control project binaries - that needs to be copied to your projects to get started with ImageCache. Note that I made it easy to work with C# (default) or VB.NET.

Usage of ImageCache is demonstrated in default.aspx.cs plus the source code of default.aspx (design time of the control does not work, known issue).

The code behind looks like this (CreateMapping loads the directory contents, initializes the hash to file name map, stores it into the cache):

using ChrisOnNET.ImageCache;

public partial class _Default : System.Web.UI.Page
{
   protectedvoid Page_Load(object sender, EventArgs e)
   {
      // normally, this would be done in global.asax
      ImageCache.CreateMapping("demo", Server.MapPath("~/TestImages/"));

      // the DIY approach to rendering the image tag
      string testHash = ImageCache.GetHashForFile("026.jpg", "demo");
      Response.Write("<image src=\"Image.ashx?bucket="+
         "demo"+
         "&image="+
         Server.UrlEncode(testHash) +
         "\" />");

      // the elegant approach to rendering the image tag
      Response.Write("<image src=\""+ ImageCache.GenerateUrl("036.jpg", "demo") +
      "\" />");

      // see HTML source for server control approach (Design time not working, known issue)
   }
}

Rendering Image tags in Page_Load isn't nice, but after all it is only intended to show the functionality. Most likely you are going to use the declarative ImageCacheControl anyways:

<%@ Page Language="C#" AutoEventWireup="true"  CodeFile="Default.aspx.cs" Inherits="_Default" %>

<%@ Register Assembly="ImageCacheControls" Namespace="ChrisOnNET.ImageCache" TagPrefix="cc1"
%>

<html xmlns="http://www.w3.org/1999/xhtml"
>

<head runat="server">

    <title>Untitled Page</title>

</head>

<body>

    <form id="form1" runat="server">

    <div>

        <br />Using the ImageCacheControl:&nbsp;

        <cc1:ImageCacheControl ID="ImageCacheControl1" 


            Bucket="demo"

            FileName="026.jpg"

            runat="server"
/>

    </div>

    </form>

</body>

</html>

That's basically it. Let me know what you think.

ImageCacheTakeOne.zip (59.55 KB)

New runtime components are available which are compatible with the release versions of .NET Framework 2.0, Visual Studio 2005, as well as Office "12" Beta 1 (which I don't have anyways).