Conficker and Password Advice

I was just reading an article in The Age today about the Conficker virus, and the article was pretty straight forward… bad virus, infected lots of machines, uses brute force to crack passwords. Some of the advice that was given was obvious, use stronger passwords, make sure your OS is up to date, and any anti virus software you use is also up to date. However, the last sentence really bothered me

From the article :

"Go get a notebook, keep it next to your computer and record your password in it. No hacker in the world can hack the written page locked away in your office."

This is a quote from David Perry a “Software Security Specialist” from Trend Micro.

I have not heard worse advice regarding password security in many many years. Sure a virus can not leap out of the computer file through your notebook and try everything written down, but what about anyone who uses your office. Your cleaner, your spouse, your kids, their friends etc…. It’s the same basic principle with you bank card PIN number. If you write it down, then another person can potentially see it and use it, and if you follow the other advice in the article about using numbers and special characters (which you should) it makes it quite easy for a human to pick out a password from a heap of other random scribbling on your desk-side notepad. You may well say, but it’s only my spouse and my kids that use my office, and I trust them. Sure, but I’ve never seen it as an issue of trust in these cases, I see it as an issue of protection. I trust my spouse implicitly, but will never tell her my password. The reason being that if there is ever a security violation using my account, and my company asks me who else may have been able to find out my password, I can honestly and confidently say no-one, not even my spouse, there-by protecting her from any suspicion.

So what’s the solution. We know for a fact that username and password is a flawed security model, and we often talk about three-factor security, ie username, password and hardware key like a smartcard, as being more desirable. However, the reality is that the vast majority of systems are still protected by the humble username and password (two-factor security), so how do you choose a password that will protect your computer without the dreaded fear of forgetting it?

My tips are as follows. Pick something from your life that is obscure enough that other people wouldn’t be able to guess. As an example you may be into 70’s rock music, and in particular you may love the album from WHAM called “Make it Big”. That’s pretty obscure (not to say quite sad), or you may have just finished reading Dostoyevsky’s “The Brothers Karamazov” which is in itself an achievement worth remembering long after. Pick something from this aspect of your life, a phrase or a name, so in the first instance you might pick “Guilty feet have got no rhythm”, in the second case lets say one of the characters names “Dimitry Fyodorovich”, although a minor character may work even better, now adapt this to a password. Leave out some words and leave out spaces (if you want), then replace certain letters with numbers, capitalize others, and replace others with special characters like this “gui1tY#eeTn0rhythM”. In the second case something like this might would work “d!m!trYfY0d0r0v!ch”. Make sure the password length is greater than say twelve characters, and satisfies any other constraints your Systems Administrators want to put on your corporate network. Now you have a password that is, for you, fairly easy to remember without the necessity of writing it down, and extremely hard for a brute force crack to guess, or (and this is where the obscure thing comes in), no one who knows you will be able to guess either.

The other good thing is you now have a scheme for creating really interesting passwords, and it means that you can change the password regularly, and each time it is a game to see just how creative you can get in picking your new password. The more creative you get, the harder it will be for anyone or anything to break it, and the easier it will be for you to remember what it is.

Technorati tags: Security

WCF error when transferring large byte arrays

Today I was receiving the following error when attempting to send a reasonably large byte array to a WCF Service.

There was an error writing to the pipe: Unrecognized error 232 (0xe8).

 

As you can see another potential candidate for least descriptive error message known to mankind. The only references to this error that google could find (here and here) were not all that helpful as they were about timeouts and closing the channel, in my case nothing was timing out. The solution was eventually obvious, a simple oversight on my part, the maxReceivedMessageSize property of the binding needed to be set to an appropriately high number so that the channel would allow for such a large message to be sent. Note you'll also need to set the maxArrayLength parameter of your readerQuotas configuration entry to a suitably large number otherwise it won't accept your byte array. eg.


<binding name="MyBinding" maxReceivedMessageSize="99999998">
<readerQuotas
maxStringContentLength="65536"
maxBytesPerRead="9000000"
maxDepth="96"
maxArrayLength="2097152"/>
</binding>

Personal Projects

Most developers have them, an idea in the back of their mind for a project they'd like to write. Could be anything from a little utility app to automate something that they find tedious, through to the next big web 2.0/3.0 application that will change the world (or at least make them very rich). I know I always have a few that I've got on the boil from time to time. Mitch Denny has even gone as far as posting up some of his ideas. My biggest problem has always been finding the time between a fairly full on job, and a reasonably active social life, to sit down and make some significant progress on any of them. This in fact has formed part of my justification for taking a year off work and travelling to Argentina (for a full list of justifications see this post on our tangotrails blog).

I have been making some significant progress on a couple of my ideas over the past few months, and it has re-affirmed to me the professional value of having personal projects like these. The main project I've been working on is an idea to combine my technical side and my creative side. I won't say any more in this post, except that I want to see how far the web can push the way we experience the narrative form.

Because it is my project, and my idea I have full ownership over everything, good and bad. I have full ownership of the codebase, I have full control over the direction, over deadlines and milestones, I have full responsibility for testing and bugs, I'm even in charge of running a beta program (which I intend to do soon), and marketing the product. Legal issues, hosting provider, selection of tools, graphic art, everything is my responsibility, and mine alone. It has been a really educational experience to work on a project so fully from end to end, and not be able to assign parts of the application off that are "not my problem" to someone else. I am learning so much, not just about new technologies, but also some of the non-technical aspects of getting a project like this off the ground.

I think forward thinking companies should try to encourage these personal projects for their technical staff, even if the projects their developers want to work on don't wholly align with their business goals. I'm thinking along the lines of a company integrating personal project time into their staffs professional development plan. Something like allocating X days of your professional development time to a personal project. Of course you may need a project approval process, but this shouldn't be aimed at the business determining if the project is aligned with their goals, but more that the project is significantly challenging for the developer for her to really gain something out of it. Also, a short presentation of their work, in whatever state it is in after the allotted X days, would ensure the developer is kept honest, and that information is disseminated to other developers in the organisation.

I can see this benefiting this hypothetical forward looking company in a number of ways. For starters, I've seen a lot of developers get bored with what their business wants them to do on a day to day basis. Often developers end up in roles where the domain holds little or no interest for them, or if it once did, the constant focus on it destroys some of the enjoyment they once had. Focusing, even for a short time, on something completely different, that they are really interested in, will re-invigorate the developer. Also, having developers play with technologies outside of their normal sphere of day to day experience in the business, will make them a valuable asset if the business ever needs to consider any of those technologies in the future. Being able to advertise this approach to professional development would also attract the right sort of candidates when recruiting. A really forward thinking business may also be open to the possibility that one of their developers might just be creating the next big web 2.0/3.0 application and might even be willing to partner with them in an endeavour to commercialise it.

 

Technorati tags: Development, Professional Development, software

XHTML 1.1 strictly ASP.Net

For those of you who are interested in web standards, you may have noticed that when you create an ASP.Net application the standard project item templates create a web page that complies to the XHTML 1.0 Transitional doctype. This may or may not be what you want.  XHTML 1.0 Transitional is for existing websites that are in the process of migrating, or if a website specifically needs to support browsers that don't know about CSS. This is because XHTML Transitional still supports the presentation based tags such as <font> and <center>. New websites however, should generally adhere to the XHTML 1.1 strict doctype which does a better job of enforcing separation of content from presentation. So as an ASP.Net developer I have to re-jig all my pages when I add them into my solution, to comply with this doctype.

 

No longer do I have to do all this manual work, thanks to a fellow Readify colleague, Damian Edwards, who's work I really admire and respect, you can now add proper XHTML 1.1 strict templates when developing ASP.Net applications. Damian has created this CodePlex project that installs XHTML compliant item templates for ASP.Net Web Project items such as Web Form, Master Page, Ajax Web Form, Ajax Master Page, HTML Page, and StyleSheet for Visual Studio 2008.

 

Note : you also have to add the following to your web.config

<xhtmlConformance mode="Strict"/>

This tells the ASP.Net rendering engine... "no I really meant it when I said strict, and I know what I'm talking about."

What does this guarantee you as an ASP.Net developer?

Because of ASP.Net's browser capabilities detection mechanism, what this guarantees you is that when ASP.Net is serving a page to a modern browser, it will serve XHTML 1.1 strict compliant markup. Be careful, this does not necessarily mean that your site will validate with the W3C Validation Service, in fact I've been caught out on this one before.

This reminds me that I've been meaning for a long time now, to write a more concise article on developing standards compliant web pages in ASP.Net, I'll put it on my daily goals list, item #44 right after "learn Spanish". (sorry for those who don't quite get the obscure red dwarf reference).

Developing Live Writer Plugins

I really like Live Writer. I have been using it for some time now to maintain a number of blogs, and I think the advantages of this offline blog post editing tool outweigh the advantages of the online equivalent. I'm not going to go into an in depth feature comparison here, but I will say that one thing I really love is the ability to have plugins. I have installed a number of plugins myself, the two that I use most frequently are Flickr4Writer and Tag4Writer. They are just simple little utilities that generate small bits of html and save you from the drudgery of hand crafting cookie cutter HTML yourself.

What I love more about live writer plugins as a .Net developer, is that it's fairly easy to develop them yourself. There are some fairly good articles on this that I've found, so for anyone who wants to get started writing their own Live Writer Plugins, here is a list of recommended reading.

• Developing plugins for Windows Live Writer by Scøtt Lovegrove
• Writing Plugins for Windows Live Writer - Getting Started
• and of course there's the MSDN documentation msdn documentation

These are all great resources, but the one thing that each one of them fails to mention is that if you are developing on vista with UAC enabled (as you should be), or if you're developing on Windows XP as a least privileged user you need to change the permissions on the C:\Program Files\Windows Live\Writer\Plugins folder to allow the user you are running visual studio under to write and modify dll's in that directory.

Technorati tags: live writer, development, Visual Studio, plugins, .Net

Pocket PC development connectivity issues

I have been returning to my roots and doing some Pocket PC development recently. I haven't really done that much since Visual Studio 2003, and to be honest, apart from SQL CE 3.5 which is a modest improvement on SQL CE back then, I feel like everything is pretty much the same. Emulators are slow, debugging is tedious, and device connectivity is sporadic at best. I was happily developing away when for no apparent reason I got the following error when trying to connect to my device which was happily Active Syncing,

Connection failed. A socket operation was attempted to an unreachable network.

I tried everything, disconnect, re-connect the device, shut down, restart Visual Studio 2008, even rebooting my laptop, I was still getting this error. Google was no help either, it appears to be a fairly generic, but seldom encountered winsock error not specifically related to Pocket PC development. What eventually solved my problem was performing a soft reset on the device.

Stopping applications that run automatically on startup

I thought I'd put this information here mainly for my own purposes, because every time I decide to clean up the various applications that run up automatically when I can never remember the windows system tool to use to view these, so I end up doing a google search and have to wade through all the commercial products that do the same thing to find the name of it.

It is mscofig.exe, and is located in the %SystemRoot%\system32\ folder. On Vista you can just click on Start then type msconfig and hit enter. It is also accessible through the Administrative Tools folder in Control panel.

Once this has opened you can go to the startup tab and deselect any annoying programs that appear in the system tray that you really don't use, and don't provide an option for you to stop this behaviour.

Technorati tags: msconfig, startup, Vista, system tray

Consultingware model thwart with inefficiencies

A large proportion of my career has been spent writing consultingware, and I've come to the conclusion that consultingware is inherently an unstable model full of inefficiencies and road blocks that can lead to an un-productive environment.

Let me explain the consultingware model. Consultingware is where a software house (lets call them the supplier) creates a package that satisfies 80% of a generic market niche, and then goes about selling to customers in that market, the base package plus consulting services to customise the remaining 20% to deliver a final product that the client requires.

This sounds fair enough, especially considering that there are many systems that would seem very similar, but because of the way the business is run, just require some tweaking at the end user level to make it fit straight into there current business processes. It is also attractive from the point of view of the supplier producing the consultingware, because although it's not the ideal model of selling bits of paper with license numbers on them (i.e. shrink wrapped software), if you find the right niche, you can charge big bucks for the initial package to each of your clients, and then continue to charge fairly lucrative consulting rates to customise the application because the client is essentially locked in to buying consulting services from the one supplier. However there are a number of inefficiencies and false economies that are inherent in this model if either the supplier or the client are not careful.

Let me start with the ongoing issue of code maintenance and improvement. Usually the supplier has spent a long time producing this base package with little or no financial support from any actual sales, and unless you have an absolutely brilliant development team there are always going to be code maintainability issues, performance issues, architectural problems, scalability concerns etc.... The shrink wrapped and internal development models have fairly well known processes for continuous improvement of code. The issue with consultingware is two fold.

Firstly the client is never interested in things they can't see. They are only ever interested in high level features that they can use in their day to day business. Even if they start to complain about things like performance, they are likely to be reluctant to fully fund the necessary development time to fix these issues considering they are only one of potentially many clients (current and future), who will see the benefit of these improvements. The same logic can also be applied to bug fixes, why should client A pay consulting rates for a bug to be fixed just because they were the first to see it and demand it be fixed. This leaves the supplier with the responsibility for these kinds of structural issues which creates a bit of a dilemma.

Inevitably if these kinds of improvements are done without direct funding from a client, this means that developers who could normally be charged out at the lucrative consulting rate become non-chargeable for a time loosing the supplier money. Not only that but if the changes actually improve developer productivity, (i.e. it makes adding features more efficient), the supplier will start to see a negative shift in their profit/feature ratio as developers start finishing chargeable features quicker.

Admittedly this is a false way to look at the problem. Ideally the way the supplier should look at it is that improving their own efficiency will make their clients more profitable and more likely to expand their business and hopefully require more of the suppliers consulting services as they grow. This is sometimes a very difficult argument to propose to bean counters when it is full of if's and maybe's and things that can't be measured easily.

The next problem is the way in which suppliers attempt to grow their product. They think that they will use their clients consulting dollars to add generic features to the product so that they can build a more out of the box solution for the next client (i.e. turn that 80% functionality into a 85% or even 90%) so that they can get more sales. This is problematic because the client again is really only going to be willing to pay for what they actually get benefit from, and to implement a feature generically so that all clients can use it, will inevitably cost significantly more than implementing it specifically the way the client wishes to do it. For example if Client A has a SOE that dictates everyone uses IE7, they aren't going to be interested in paying the supplier to ensure that the software works with Firefox, safari, opera, etc...

Another issue that frustrates the problem is the upgrade cycle. As more clients come on board, and more features are added, when clients upgrade, they take on risks associated with features they never asked for. This requires a very modular approach to adding features, but even still often changes to the core software are required to add new features, and this will impact on existing features.

This feeds into the final problem I want to discuss, and that is who is responsible for testing? I've seen a number of wrong approaches to this, including "The client will test it". I would suggest that any client that takes on a piece of consultingware needs their head read if they don't do some form of user acceptance testing. However, again, the client will really only be interested in testing the features that matter to them, and not being a software company, they won't really appreciate proper regression test cycles. Ultimately a proper regression test and defect fixing cycle is going to be left to the supplier, but if no client is willing money towards that cycle, it will very quickly eat into the "lucrative" consulting rate the supplier charges for additional features.

So I guess I've really just stated the problem here, and offered no real solutions, and guess what... I don't intend to... at least not in this post. I would like to hear how other people have seen these issue tackled from both sides of the fence (client and supplier), and in a few weeks time, I'll put together another post with what I think are some potential solutions to the problem.

Tango Trails

Those who know me, know that I am a passionate Argentinean Tango dancer. Those who know anything about Argentinean Tango know that if your serious enough about Tango, Buenos Aires becomes like Mecca... you have to visit it once in your life. Niki and I are planning such a trip, and as such have decided to start a blog about not only the trip, but anything relating to our journey into Tango. For anyone that's interested, the blog is called "Tango Trails".

Problems with Sony Camcorder software

I purchased a Sony HDR SR7E camcorder a while back, and for the most part I love it, but there is one thing that is really frustrating me. The software that comes with it to playback videos on your home PC in the native AVCHD format (Motion Picture Browser) has a really unusual problem.

 

As you can see the top half of the screen is fine, but the bottom half is just a solid green line. The camcorder itself plays back the videos fine, and when you make a DVD or convert the videos to mpeg-2 format, the resultant video is fine, the problem only seems to exist in the Motion Picture Browser software.

I am running Windows Vista, Motion Picture Browser Version 2.1.00.04170 on a Dell Latitude D820 with 2GB RAM. I can't seem to find any mention of it on Sony's website, the only other mention of it I have been able to find is here. If anyone else has seen this issue, or if anyone else knows what the solution might be, I'd love to hear about it.

 

Technorati tags: Sony, handycam, HDR SR7E, AVCHD

Why Web Standards?

I am currently in Vancouver attending the web directions north conference. So far it's been really good, and I have some great ideas for some blog posts on some cool CSS techniques I've learnt from Andy Clarke's workshop on CSS, but you'll have to wait as I want to play with some ideas for a while. For now I want to talk about something else.

I have asked John Allsopp (the man behind the company behind web directions) for a video interview tomorrow, and he's agreed. Amongst other things i want to ask him the question "As asp.net developers, why should we be worried about web standards?" (this question is mainly to let him evangelise about web standards), and i thought, maybe I should attempt to answer that question myself, so here goes.
If you are writing a public facing website (or web application as is most common for asp.net developers), then the truth of the matter is that you CANNOT assume a particular browser. Ie7 DOES NOT, & WILL NOT be the only browser that you have to consider. Firefox is an extremely popular browser & looks like maintaining (if not increasing) it's popularity, i even have it as my default browser, not to mention opera, safari, and others.
Further to this, you CAN NOT even assume windows xp or vista as your base operating system. there are many people who are still running windows98 (mainly for licensing reasons, but they still represent a market you may want to reach). Plus the hordes of people who still haven't had the Microsoft chip implanted into their neural system, and insist on running Linux, mac OSX, etc. Add to this the growing market of handheld devices such as PDA's and phones, all with their different browsers, and you have a truly overwhelming number of combinations and permutations that are possible.

Now lets throw into the mix something that I have seen very little support for in the ASP.Net community as a whole, and that is Accessibility. When most people think of accessibility, they think of screen readers, but that is just one end of the spectrum, people with impaired vision (my partner included) often simply want to increase the font size a little, which renders a lot of designs I've seen in the past quite bizarrely to say the least. Why should we worry about Accessibility? I hear you ask... forgetting the ethical concerns, and the fact that the web was originally designed to be accessible to ALL, the fact of the matter is that (at least in Australia) you can be SUED if you do not comply to accessibility standards, the Sydney Olympics was sued to the tune of $500,000 for this very reason.

A quick concession here is that Web Standards compliance does not always mean accessible, there are many things you can do and still remain standards compliant, but be completely inaccessible, the issues for accessibility are somewhat more ethereal, however, web standards is a fairly good starting point.
Given all this, as a developer, you still need to pick a browser support matrix, otherwise you will go insane attempting to test with ALL versions of ALL browsers that have ever been in existence, (I'm not sure if anyone still ever uses lynx, the good old text based unix web browser, but it is certainly and interesting exercise to open up your website in it and see what happens), but even once you have determined your browser support matrix, unless you have a very narrow focus group, this will include more than just IE7. Also even though you might not be directly considering older browsers, it doesn't hurt not to purposely break them just because you can.

Having decided on a browser support matrix, then you will quickly realise that the best way to not only get the best results in all your current browsers, but also to anticipate V.next of those browsers is to use to the best of your ability the currently agreed upon web standards.

For some reason this seems to many ASP.Net developers to be a real problem, this is partly because of some cultural issues with developers in the Microsoft space, and partly because of the way ASP.Net abstracts the developer from the final markup that is actually rendered to the browser (I want to deal with this at length in another post), but to be honest, there is really no excuse. There are very few effects that you would like to achieve that you cannot do through the use of standards compliant markup and css, and a little bit of fore thought. If you go the extra mile and approach it from a more ideological point of view where you attempt to separate the content from you presentation, you get the added benefit of making you website at least readable on all different types of browser, not to mention generally a lot closer to being accessible by assistive technologies (such as screen readers) the likes of which most of us will NEVER get the opportunity to test against.

 

Of course if you are working on an Intranet site for a company that runs an SOE that they will NEVER change (eg Windows XP with IE6), then feel free to write whatever browser specific functionality you need to to get the job done, and pray they never upgrade to IE7.

 

Technorati tags: WDN08

Heading off to Web Directions North

I am currently sitting in Melbourne Airport about to board a plane for Vancouver to attend the Web Directions North conference. I am quite excited about the people that are speaking there, and I am hoping to gain some great insight into aspects of design and user experience as well as informed opinions on the future of new web technologies. I have also been asked to run a "Birds of the Feather session" on aspects of Internet security and Identity. I am certainly no expert on either of these, but my interest has been sparked by recent experiences, and I look forward to discussing these issues with people who know a lot more about it than I do.

 

Technorati tags: WDN08

CAPTCHA foiled by Mechanical Turk

An article on CGI Security about CAPTCHA highlights a very obvious flaw in the whole philosophy of CAPTCHA. For those who are too lazy to click the link and read the 2 paragraphs the article basically describes how some very inventive worm writers enlist the help unknowing participants who are visiting pornographic web sites to play a game that offers to reveal a pornographic image piece by piece as the user breaks a code (obviously the CAPTCHA the worm is currently observing at the site it is trying to create a bogus account for).

I have to concede this is a very clever use of the Mechanical Turk idea. CAPTCHA is designed to weed out humans who are genuinely trying to sign up to a site and create accounts from computer based worms that are trying to create bogus accounts for their writers evil ends. CAPTCHA actually stands for Completely Automated Public Turing test to tell Computers and Humans Apart, and there is the flaw... the Turing test is designed to distinguish between humans and computers, if you the computer you're testing can enlist on-mass large numbers of humans to take the test for it, then the test will be rendered redundant.

This raises some very interesting concerns for identity verification. Everyone wants their site to have the smallest possible barrier to entry, even the simplicity of CAPTCHA systems can sometimes prove to be a barrier eliminating a small number of false positives. So what's the alternative? I'm not quite sure, maybe something like Windows CardSpace, or a competing identity management protocol that allows a third party company trusted by both the provider and the client to validate credentials, but of course there would have to be overwhelming take up of the same protocol set by both providers and clients which seems to me to reduce to a chicken and egg kind of problem. Also the cost of maintaining this systems integrity by the trusted third party would need to recouped from either the client or the provider. I have to confess, I'm not really an expert on identity management, so I'd love to hear others thoughts.

Web Directions North

Well, it's official, I'm going to Web Directions North 2008. Last year I went to Web Directions South, and really enjoyed it, this year I was in Cyprus during Web Directions South, so I'll have to settle for Vancouver. It's a real pity because I would have loved to have heard Chris Wilson (IE Platform architect at Microsoft) presenting on Moving the web forward. I must say, he is a brave man as a lot of people in the crowd would not exactly have been Microsoft fans, and would blame IE's standards issues for making their jobs harder, but I think his slide deck, and his audio interview with Kevin Yank from Sitepoint, state the dilemma fairly well.

So what am I looking forward to at Web Directions North?

I decided that considering I am travelling so far for this conference, I should probably attend the workshops, so I've booked myself in for Transcending CSS, and Desgining really usable websites. As a developer I feel that one of my weaknesses is web design, and as such I think that these workshops will be hard, but rewarding.

As far as the conference sessions go, all of them sound really interesting, but I'll just highlight a few that I am really excited about. Being interested in security, the Ajax Security session is looking good, it will be interesting to see Silverlight and Adobe Air compared, given my background in PDA development, I am interested to see where Mobile Web Design & Development is going to go, and given the presenters (Dave Shae and John Allsop), Where's your web at should be very interesting indeed.

 

Technorati tags: WDN08

Speaking on Visual Studio 2008

I have become a big subscriber to the Chris Hewitt school of self education. I have been working with Chris at Readify for bout 3 years now, and I remember back when I first joined he told me "If you want to learn a new technology, simply book yourself in to do a presentation on it in 2 months time". It is so true, the fear of making a complete fool of yourself in front of your peers is ample encouragement to get yourself across any topic. I have done this a few times now with technologies like Ajax, Vista, and SQL Server. I am now doing it for Visual Studio 2008 which has just RTM'ed. I have been playing with the beta versions of VS2008 for a while now, and today I am now installing the RTM version. I am speaking at Victoria .Net SIG in December. There are about 5 speakers doing 20 minute segments on "What's new in Visual Studio 2008 ...",  I am doing "What's new in Visual Studio 2008 IDE".

Check the Victoria .Net SIG web site closer to the date for more details, both the date and place are still up in the air at the moment.

ASP.Net and Standards (cont.)

My collegue Damian Edwards pointed me to an article on MSDN (ASP.Net and XML) that explains the behaviour I described in my previous post on Asp.Net and Web Standards . From the article...

"If you submit an ASP.NET Web page to a validation service such as the W3C Markup Validation Service, ASP.NET might render a version of the page that does not conform to XHTML standards. This is because the validator service does not report itself as a browser type that ASP.NET recognizes, such as Internet Explorer or Mozilla. When ASP.NET cannot recognize the browser type, it defaults to rendering downlevel markup, which does not include XHTML-conformant elements and attributes, or features such as cascading style sheet styles."

The article also discusses how to configure ASP.Net using a browser capabilities file to force it to render valid XHTML. I'll have a play with this tonight when I get home.

Cross Site Scripting Detection Tool

Just discovered a very interesting tool from Microsoft to combat Cross Site Scripting Vulnerabilities.

The XSS Detect Code Analysis tool has been released in beta, and does static code analysis to determine potential XSS Vulnerabilities within ASP.Net applications. I ran it on my standard XSS test application and managed to detect the standard XSS mistakes. I will say this though, it is still in beta, and when I tried to run it over our real site, the tool managed to crash Visual Studio. I can't wait til it RTM's, I'll be following this tool with a lot of interest.

ASP.Net and Web Standards

We were having a discussion the other day on our internal tech list about Web Standards and validation, and I made the comment that I like to treat web standards validation like compiler warnings, in production code ideally you should not have any, because even though the vast majority of them are benign, and browsers will happily ignore them, they could be hiding 1 or 2 that are going to cause you grief. A colleague of mine Darren Neimke, challenged me to show any of my production code that I had that would stand up to this test. So I hurriedly tried to search around for something and ended up sending him a link to my, very much work in progerss site that I set up to play around with some ajax stuff scottbalwin.com.au, just to show him that I do try to put my money where my mouth is. Of course I did double check to see if the front page validated, in fact I checked a few of the links, and all that I checked validated fine. What I hadn't quite expected was for Darren to take the time to go through all of my links until he found one that didn't. On one of my ajax playground pages I had 6 validation errors. Ok, my bad, so what was I doing wrong? Well it turns out that 2 of those errors were due to me using a code syntax highlighting control, that in and of itself produces standards compliant html, but when you wrap it inside a <pre> tag, as it suggests in the sample that comes with it, you get an error saying <pre><div> aren't aloud to go together in xhtml transitional. Ok, simply change the <pre> to a <div style="white-space : pre"> and the problem goes away with no loss of formatting... Yay, but what about the other 4 errors?

What was really weird is that when I did my usual test of openning it up in IE from my dev environment, viewing the source and then pasting the source into the validator, it validated perfectly. So confident that I'd fixed ALL the issues I uploaded it to my website. I then used the validator to test the url,  and lo and behold 4 errors... doh! it took me a while to figure out what was going on, but eventually after realising that some controls in ASP.Net can emit different html depending on the user agent that is requesting the page, and a quick little test later on my own machine and sure enough, if the user agent is IE (or firefox for that matter), the calendar control emits perfectly standards compliant xhtml transitional code, but for reasons best known to a small group of developers at Microsoft, if the user agent is "Unknown" or whatever the W3C validator claims as the user agent, it emits non standards compliant html. So I am currently trying to figure out the best way to fix this issue so that even unknown user agents receive valid html.

I now understand why people who are really serious about standards often end up writing their own ASP.Net in place of the standard Microsoft ones.

Oh and by the way Darren, don't bother checking to see if my blog validates, because it doesn't, and it is simply due to laziness that I have just selected a standard template from blogger,and haven't attempted to beat it into standards compliance. One of these days....

Vote below the line campaign (more info)

I Found a really good article in The Age that explains just how important your preferences are.

Slow and steady fixes the bug

I just recieved a notification from Microsoft that a bug I reported in the XML subsystem of SQL Server 2005 in March of 2006 has finally been fixed and will be shipped with the RTM (I assume SQL Server 2008 RTM). It took them a while, but they eventually got onto it. It was an extremely obscure bug, but it seems as though I wasn't the only one to see it.
Unfortunately because I no longer work for that client any more, I will not be able to verify the fix, I guess that's part of being a consultant.