Note to self: need to grab a copy of Version Control with Subversion. We have been using Subversion even while it still was in Alpha and Beta stages - and I am really convinced that it is more than up to its commercial counterparts, especially when it comes to platform and tool support!

"Don't assume because it makes an ASS out of U and ME". Right, should've taken that to heart when I switched from a Nokia cell phone to my new SPV C500. What happened?

Well, on my Nokia it worked this way: calls on line one had call waiting notifications turned on. So when I was in a call, I was notified that a call was waiting to be picked up when someone else called. However, for line two, I hadn't activated it. So when I was in a call, the caller was routed to the voice mailbox immediately. When I wasn't in a call, the phone rang when someone called on line two.

Not so on the SPV C500: here, callers on line two are always (!) routed to the voice mailbox, no questions asked - unless you turn on "Provide call waiting notifications" on line two. Whoops. That was quite a nasty surprise because line two is the incoming line for business calls.

Speaking of snags: my Nokia provided indication of whether a call came in on line one or line two - the SPV C500 doesn't seem to have this functionality, or I haven't yet found how to activate it. If you, dear reader, happen to know, let me know.

Bijan Javidi, Senior Principal Consultant at Microsoft, held a two-day Trainer the Trainer (TTT) event in Augsburg for the GLS Development Process Best Practice training. In the audience: Alexander Zeitler, Peter Koen (soon to be Softie), Bernhard Spuida, Hannes Preishuber, Achim Oellers and others (no specific order, just to name a few).

As rehashing the entire two days would be a tad lengthy, I only pick two items that are important to understand why anyone would attend such a training:

• Why Development Process?
• Definition of Development Process Best Practice

Let's start with "Why Development Process?"

• Make development
  • Predictable
  • Repeatable
  • Manageable
• Reduce costs
• Streamline application construction
• Establish standards
• Reduces risk in .NET projects

After those incentives to have a process at all, let's dig into what DPBP is - here is the definition:

• Process based development methodology
  • Ultra light-weight, pragmatic and prescriptive
  • End-2-end development process model
    • From requirements to deployment
• Minimum set of documents
  • Small number compared to UP
• Step-by-step guideline
  • How to create these documents
• Uses Office and Visio formats (UML)
  • DOC, XLS, and VSD templates
• DPBP is agile
  • Leverages many XP features
• End of prose text in development process
  • Minimizes text
  • Uses structured information
• Lazy modeling
  • Model only if you have to
    • Architecture metaphor (XP)
  • Uses minimum of everything to do the job

Bascically we are talking initialization, analysis, design, implementation and deployment. And that was then the contents of the two-day workshop in Augsburg.

Networking was commenced at the evening event on Monday, in the Welser Kuche with a medieval meal:

Want see more fotos? Look no further (German titles and description though)

The November issue of MSDN Magazine is completely about security: attack surface, application lockdown, cryptography, trustworthy code, intrusion prevention and much more. If you ain't already a subscriber, make sure you grab at least this issue at your local newsstand.

Got my Channel 9 guy at the Connect Event (more on this later with photos once I have managed to shrink my backlog) in Barcelona this week from Lenn Pryor. This photo will serve as a reminder that I have to get myself a Bluetooth headset for my shiny new C500.

The Security Risk Management Guide helps customers of all types plan, build, and maintain a successful security risk management program. The guide explains how to conduct each phase of a four-phase risk management program and how to build an ongoing process to measure and drive security risks to an acceptable level. This guide is technology agnostic and references many industry accepted standards for managing security risk. Download

Michael Howard has an interesting blog entry on the number of advisories for IIS 6 versus the number of advisories for Apache 2.0.x (advisories that are security-relevant, in case you are wondering). This doesn't make Apache look that good after all.

Brian Goldfarb has the details in his blog on Making the ValidatePath HTTP Module easier to deploy. (remember, the canonicalization issue with ASP.NET)