StructureTooBig Blog

ASP.NET University!

Brian Hitney — Wed, 02 Jul 2008 19:08:00 GMT

ASP.NET University!I am thrilled to announce that Glen Gordon and I will be presenting ASP.NET University in Atlanta, on July 16th. For info on the event, visit this page:

http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032382618&Culture=en-US

ASP.NET University is part of a the .NET University series started by Doug Turnure . It covered .NET 3.0 -- and since then, several other "University" series have been developed for Biztalk and Sharepoint, with more on the way. Check out the .NET U home page . I'll have the content loaded on the site shortly, and we'll make periodic updates over time. So what's in ASP.NET U?

1. ASP.NET Overview: We’ll talk about the project setup and options, and have a brief discussion about Webforms and the page lifecycle and where user controls, server controls, and master pages fit in. We’ll also talk about some of the security options available, and we’ll stick our feet in a bit deeper and discuss some of the more advanced topics like custom HttpModules and effective caching strategies.

2. ASP.NET AJAX: Learn how to leverage ASP.NET AJAX in your applications. We’ll look at getting started with some straightforward examples, and we’ll look at troubleshooting and profiling AJAX code to get the best performance possible. We’ll also look at consuming web services and WCF services straight from AAJX.

3. ASP.NET MVC: Looking for more design abstraction? MVC may be for you. Based on the model-view-controller design pattern, ASP.NET MVC allows clear and clean abstractions of data, logic, and presentation tiers.

4. Servers and services: First we’ll take a look at what’s new in IIS7 for web developers. After a brief tour, we’ll check out some cloud-hosted services from live.com – like how to integrate Virtual Earth, use the Live Search API, gadgets, and more. A fun way to end the day!

As Glen points out, all of the .NET U content is friction-free, well documented, and easy to consume. User groups can take it, code camps can use it -- it's all about spreading the knowledge.

I'd like to thank the following people for helping me get this content shipped:
Rob Zelt, for his assistance with the MVC Framework content.
Jim Duffy, for his assitance with the Virtual Earth and Gadgets section.
Scott Forsyth, for assistance with the IIS7 content.

Interested in having us present the content locally? Let us know!

Silverlight Controls Contest

Brian Hitney — Wed, 02 Jul 2008 18:58:00 GMT

Silverlight Controls ContestPage Brooks recently told me about a cool Silverlight Controls Contest he's come up with:

Welcome to the Silverlight Control Builder Contest! With this contest, we hope to incite the development of many open and free Silverlight Controls that all developers can use in their applications, and what better way to do this than through a friendly contest!

This contest is your chance to demonstrate your control building skills to the Silverlight community and win some pretty cool prizes at the same time!

Check out the site here: http://gosilverlight.org/

There are tons of great prizes, so either finish that control or dream one up, 'cause time is limited!

Mobility Event Resources

Brian Hitney — Wed, 25 Jun 2008 18:56:00 GMT

Mobility Event ResourcesGlen and I just finished our Mobility show in Charlotte and Atlanta, and the feedback has been really positive. For those who came out, thank you! Special thanks to Chris Craft for co-presenting with us.

Glen posted his resources here in his blog post, and I'll do the same here.

First up, my quick "2 hour demo" (the app I built 2 hours before the event) that demos integrating Live Search into your mobile applications. I started with Chris' Lunch-O-Matic application, and when the restaurant was chosen, we kicked off a Live Search query of all local places. Obviously, it's just a simple example lacking true GPS integration and other features, but it's a good example of how easy it is to get off the ground with these types of applications. Keep in mind that to use this application, you'll need your own AppId available from dev.live.com site.

Modified Lunch-O-Matic application (VS2008 Solution)

Live Search API/help:
http://msdn.microsoft.com/en-us/library/bb251794.aspx
http://dev.live.com

Also, I demonstrated a sample Kiosk application that leverages both .NET and native (via P/Invoke) functionality to control the device:

Kiosk Application (VS2008 Solution)

Even though we didn't specifically cover much beyond Mobile Devices (WinCE, Zune, etc.) the topic of .NET Micro came up at the Atlanta show, specifically with folks wondering how to get started with some sample hardware. This page has several of our partners, including Device Solutions Tahoe starter kit:

http://msdn.microsoft.com/en-us/embedded/bb267307.aspx

And:

http://msdn.microsoft.com/en-us/embedded/bb267253.aspx

Thanks to everyone who made it out to the show!

INETA / MSFT Community Summit

Brian Hitney — Thu, 12 Jun 2008 16:35:00 GMT

INETA / MSFT Community SummitRob Zelt (INETA) and I (well, 99% Rob, 1% me) are hosting an INETA Community Leadership Summit near Greensboro, NC. It's a great opportunity for user group leaders and those interested in helping/participating in the community ecosystem a chance to come together and discuss important topics, and enjoy some good networking opportunities.

Here's an agenda:
10:00 AM - 11:00 AM     Registration / Introductions
11:00 AM - 2:00 PM       Usergroup Leader working lunch
2:00 PM - 7:00 PM        Community Social / Dinner*
*Open to families. Bring along your spouse, significant other, or kids!
(times subject to change slightly based on feedback if needed)

For more info, check out the INETA site:
http://live.ineta.org/blog/2008/06/06/CarolinaCommunityLeadershipSummit08.aspx

Yesterday's Workflow Presentation

Brian Hitney — Wed, 28 May 2008 18:53:00 GMT

Yesterday's Workflow PresentationLast night I gave a presentation on Windows Workflow Foundation (WF) at the Charlotte Developers Guild . Following up on that, I figured I'd post some resources for the talk:

First, the presentation slides are available on our .NET U site .

The demo app that I built is available here. Within the project, I commented out the SqlPersistence and SqlTracking initialization -- to use them, you can uncomment those code blocks and setup a database using the scripts available in the .NET 3.0 installation folder. The script for the bug database is included in the project -- the connection and database will need to be configured to get the application to run, or, alternatively, you can comment out the database calls. By doing this, no data/workflows will be persisted if the application gets shut down, but it doesn't diminish the application and workflow functionality.

Mobility Event

Brian Hitney — Wed, 28 May 2008 18:22:00 GMT

Mobility EventGlen Gordon and I are teaming up to deliver a full day of mobility! If you're within driving distance of Atlanta or Charlotte, sign up! We'll be teaching about the .NET Compact Framework 3.5 and using VS2008 to develop Windows Mobile SmartClient Applications. There will be great take-home resources like books and DVDs, as well as some bigger giveaways (Windows Mobile 6 devices, anyone?)

Overview
This session is geared towards familiarizing the attendee with developing smart clients using the .NET Compact Framework 3.5 on Windows Mobile 6.x. Labs will be by demo only (not hands on), and will be available for download after the class.
Lunch will be provided. Class times: 9:00 AM–12:00 PM, 1:00 PM–5:00 PM. Click the links below to register

Charlotte - June 18, 2008

Atlanta (Alpharetta) - June 24, 2008 (originally scheduled on May 27)

Heading to Asheville!

Brian Hitney — Mon, 12 May 2008 21:09:00 GMT

Heading to Asheville!Tomorrow, 5/13, I'll be heading out to Asheville, NC, for the first meeting of the Western North Carolina .NET User Group! Check out their home page here: http://wncdotnet.com/

It's great to have a new user group out west. It's the first time I've been out that way, and I'm looking forward to it. I'll be presenting on new web development features in Visual Studio 2008, focusing mostly on AJAX and some of the new language features in .NET 3.5 like LINQ. If you're in the area, stop by!

WorldMaps Goodness

Brian Hitney — Thu, 24 Apr 2008 10:32:00 GMT

WorldMaps GoodnessI think I finally got Peter hooked on WorldMaps. My latest victim. And of course, it wouldn't be possible with the official WorldMaps evangelist, G. Andrew Duthie . Thanks guys!

A few questions came up on Twitter, so I thought I'd take the time to expound on them here. The first question was: who are the top WorldMap users? Here's the top 10 at a glance:

Site	Hits
http://dancesportinfo.net	5,137,942
http://blogs.technet.com/askperf	722,489
http://www.structuretoobig.com	427,112
http://www.irritatedVowel.com	309,104
http://www.wynapse.com	243,283
http://blogs.technet.com/benhunter	155,276
http://timheuer.com/blog/	147,714
http://blogs.msdn.com/gduthie/	121,912
http://blogs.technet.com/davidcervigon	113,178
http://sharepoint.microsoft.com/blogs/GetThePoint/	109,067

So there you have it. I'm going to build a "live" top 50 page soon that include links so you can view the data breakdown a bit more thoroughly.

One question that came up is how my stats (currently #3) are gathered -- for example, do I get a hit for everyone else's hit? A fair question since I'm using my own service.

Looking at the data above, the answer is obviously "no," traffic from other sites doesn't affect my numbers. The sum of all hits is around 8.5 million compared to my ~400k (see an all-user mashup here ). Indirectly, much of the traffic *is* driven from folks clicking through to my site.

One way to measure this is by looking at the Global Domination and Unique Domination statistics on the maps (bottom right corner). Global Domination shows how many unique locations you've hit in contrast to all known unique locations. Remember, though, that this number is relative. For example, as far as I can tell, all locations in Manhattan are considered 1 location. So while you may have thousands or even millions of users visiting from Manhattan, it's resolved as only 1 unique location. Unique Domination is how many of those locations belong _only_ to your map -- locations you are hitting that no one else has. The cool thing about this number (at least I think it's cool) is that it will continually grow smaller. Before long, having ANY unique domination above zero will be a prized value.

Another question is: How is rank determined? First, it's completely possible for some users to be lower in rank yet have stunning World/Unique Domination. Look at Andrew's stats . The poor guy just fell to #8 ... but holy cow, look at the global/unique domination stats. He's schooling me and just about everyone else.

Quite simply, rank is determined by the sum of all hits. And I'm thinking it's time for a change. The question on the table that I ask everyone who uses it is, what is the fair equation for determining rank? Total hits as it stands today? Hits/day average? Unique IPs? Global Domination? Or a mix of all of them?

As for my stats personally, I have an edge. I was using the system months before it was available to the public, and even then, users were very slow to sign up. While my hits/day is lower than many in the top 10, my time on the field has been longer, and has carried me a bit. I admit that. :)

But then, I do only use it on my home page nav, not on every page. For example, I could use the tracking pixel version on my master page so it shows up on every page on my site, and then just display the map on my home page. The end result would be that my Global/Unique Domination and Unique IPs would remain unaffected, however, total hits and hits per day would skyrocket. So you see, there are many ways to interpret the stats and hard to treat it as a strict comparison.

So what's on my to-do list?

1. Top 10/25/50 page, with links.
2. Web services for data portability.
3. Silverlight integration (somehow ... anyone want to help with that?)
4. 1:many accounts or subaccounts.
5. A "no user" page. (If you visit the "all user " page, this would be the opposite of that -- what locations have no one hit yet? Where the all user page has high Global Domination and zero Unique Domination, this page would be the opposite -- zero Global Domination and high Unique Domination.)

geekSpeak Today!

Brian Hitney — Wed, 23 Apr 2008 07:41:00 GMT

geekSpeak Today!Later on today at 3pm, I'll be joining my colleague Glen Gordon on geekSpeak, where we'll be hosting a talk with Karl Shifflet . I'd have to sum up Karl's year as ... "insane." I admit, I barely knew Karl a year ago and now he's everywhere!

Today he'll be talking about the Mole Visualizer tool he has been developing. For more information or to join, go here:

http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032374735&Culture=en-US

Raleigh Launch Event

Brian Hitney — Mon, 21 Apr 2008 09:14:00 GMT

Raleigh Launch EventI'll be presenting at the { Heroes Happen Here } event in Raleigh on May 2nd. It looks like the tracks are all full, but check back at the site if you're waiting to get in! (And hey, if you've registered and don't think you're going to attend, be sure to de-register.) To be honest with you, the content at our launch events is fairly lightweight, so while I'd love to see the room jam-packed, if you're looking for deeper and varied content, keep your eyes out for more info on the Charlotte Code Camp coming in a couple of weeks.

In the meantime, Dug Wilson (newly appointed president of the Triangle .NET User Group ) had a great idea -- a "Heroes" after-event (dinner and a movie). Since Iron Man debuts the same day as the Heroes event, why not check it out on the same day?

See you then!

My Eyes, My Eyes!

Brian Hitney — Mon, 14 Apr 2008 16:49:00 GMT

My Eyes, My Eyes!I came across this today while redeeming an online coupon. Let's just get right to it without the preamble (click for larger version):

Oh, how this pains me. To protect the innocent I blocked off what would otherwise be incriminating, but suffice it to say this came from a large retailer. And sadly, this is one I've been to -- I don't mean I've been there shopping (though I have), but I mean I've been to their offices, though as far as I know this is outsourced and hosted elsewhere. Let's look over this...

First and perhaps least important, scrambleId is a bigInt or others long numeric field based on the querystring (not visible in the picture, but take my word for it). Yet, its data type is a string (inferred based on Request.QueryString) and it gets passed into the query as a string. But it's not a string. Now you might be thinking: the database column uniqueID may be a varchar or some other string-esque data field, making this "ok." It might be -- but then, not a very good choice for either a primary key or, as labeled, a unique identifier. Design-wise, this is just broken. At the very least, it's confusing. Since I'm picking on it, let's get nitty-gritty and say I'm not a big fan of a column named barcode in a table named barcode.

Second and mildly broken: never output details like this to the client. (OK, this is something I'm guilty of at times -- but then, there's a world of difference between a personal site on a shared host with no information of value in the database vs. an e-commerce site collecting PII.) Handle and log errors, but disable this kind of output via the web.config, especially in a production environment.

Last and obviously the "meat" of the problem: HUGE SQL Injection opportunity! There is NO data validation on scambleID, and it's just handed over to the SqlCommand object. Because another page takes data and presumably writes it to the database, I'm going to make the assumption that this user (based on the connection string -- likely the same one) has write and possibly dbo permissions. I imagine it would be trivial to cause major havoc by dropping tables, updating values, compromising data, etc.

So how is this problem eliminated? Don't execute direct SQL. Abstract that into a stored procedure, and pass in the scrambleID as a parameter. Change the permissions to allow this user execute only permissions on the sproc, not direct table access. If possible, correct the data types. I suspect there may be reasons in play for it being all-numeric (for example: a cash register that may only take numeric values). A bigint can handle over 9,000,000,000,000,000,000 values, so that ought to be big enough. Maybe it is a bigint, and SQL is casting it -- can't really tell. But the nice thing is, if the value must be numeric, it's super-easy to check. Frankly, even if you must use dynamic SQL like this, it would be easy to check the parameters. An Int64.TryParse() or Regex would be easy to implement.

Anyway, this goes to show that these kinds of problems are very real in the world, and it's critical to evaluate them. Peer code reviews, threat modeling, and security education can prevent these!

Geek Happy Hour and Launch Event!

Brian Hitney — Sat, 05 Apr 2008 06:18:00 GMT

Geek Happy Hour and Launch Event!It's going to be a busy week! In Raleigh on Monday evening? Join Brad Abrams and me at the Carolina Ale House at Brier Creek. We should be over there by 5:00pm. If you'd like to meet Brad and say hello, stop on over! We're keeping things casual, but fear not: Brad will back in action on Wednesday when he presents at TRINUG .

Sandwiched between the two is the VS2008/WS2008/SQL2008 launch event in Charlotte! Check it out here:

http://www.microsoft.com/heroeshappenhere/events/Charlotte/default.mspx

I'll be presenting on Web Development with VS2008, the first session in the developer track. Most of the event has sold out, but if you're in the area and would like to come, register anyway and come on out. Room just might open up.

Screen Clippings...

Brian Hitney — Fri, 04 Apr 2008 16:05:00 GMT

Screen Clippings...Some interesting screen clippings I came across.

The first is of the winning bid in the Charter High Speed Internet auction. The auction, I imagine, took on a life of its own and the winning bid:

Wow! The nice news is that Charter donated the proceeds to charity. As some have pointed out, though, that wasn't announced until last minute, so most of the bids were done not knowing this. Still a good cause, but can't believe the auction got that high. Not sure how high I'd go to get internet for life -- but boy, that's in another league.

Next, this one on the weather.com site and the chance of rain April 5th:

Let me explain this one a little. It might have been Jerry Seinfeld who said something to the effect of disliking the "50% chance of rain" forecast -- "basically you're saying 'maybe it will rain, or then again, maybe it won't.'" But, I don't know if I've ever seen 100% chance of rain. Cool -- we need it. I just don't know if I'm ever 100% sure about anything ... I applaud their certainty. There's just that cynic in me that imagines some weatherman saying, "No matter what happens, it will positively, absolutely rain tomorrow."

Raleigh Silverlight Group

Brian Hitney — Mon, 31 Mar 2008 19:39:00 GMT

Raleigh Silverlight GroupVery cool news from Rob Zelt . The web applications SIG of TRINUG will be doing some Silverlight-focused content. He'll be speaking this Wednesday (4/2). From Rob's blog:

I've been talking with a number of people about starting a Silverlight focused group here in the Raleigh/Durham/Chapel Hill area. If you're interested, se if you can come out to the presentation I'm giving for the Triangle .Net User Group Web Applications SIG on Wednesday and we can maybe chat afterwards as well about setting another meeting up later in April. I'm thinking maybe April 22nd, 24th, or 29th?

If you're interested in Silverlight, be sure to come out.

TechEd: Birds of a Feather Sessions

Brian Hitney — Thu, 28 Feb 2008 19:18:00 GMT

TechEd: Birds of a Feather SessionsVia Rob Zelt !

INETA and Culminis are helping to organize the Birds of a Feather (BoF) sessions at TechEd coming this year in June. If you've never attended a BoF session at a large conference, you really have to go. Some of the best networking opportunities happen at these sessions, so if you'd like to submit suggestions or volunteer to help, check out Rob's post on the subject.

BoF submissions and voting closes on March 19th!

VS 2008 Install Fests! Register Now!

Brian Hitney — Thu, 21 Feb 2008 10:02:00 GMT

VS 2008 Install Fests! Register Now!We had a fantastic run of events with the Visual Studio 2008 Install Fests December and January!

Just a reminder, the registration site for the free copies goes offline tomorrow, February 22nd! If you received a copy of VS 2008 at one of the Install Fests, and haven't registered it yet, please do by EOD tomorrow! (A little birdie told me the site may stay online over the weekend, but still, get it in as soon as possible!)

New Regional Director for the Carolinas

Brian Hitney — Mon, 18 Feb 2008 09:23:00 GMT

New Regional Director for the CarolinasOver the weekend, the Raleigh User Group hosted their third code camp! What a great event. I just returned from TechReady 6 in Seattle (more on that later) and the big news is: Jim Duffy is now a Microsoft Regional Director for the Carolinas! Congrats Jim! See his post here .

As we frequently get asked, just what is a Microsoft Regional Director?

I like Richard Campbell's answer: "We're not a Microsoft employee, we don't necessarily have specific regions, and we don't direct people. But otherwise the name works." To be honest, the "region" part is one of the big factors we added another RD to the area. Many RDs do a significant amount of travel and are effective in their roles from a global perspective, but as a local evangelist, my main concern is the local ecosystem.

But, back to the question. Jonathan Goodyear has a post about it here . I like this summary:

The role of an RD is to act as an unbiased third-party evangelist of Microsoft products and services and to work with software developers to ensure successful project engagements. We act as the glue between Microsoft and the developer community.

Sounds like my job, doesn't it? Except, I'm not an unbiased third-party. I'm a completely biased first party :) ... seriously, one of the biggest assets these guys and gals bring to the role is their perspective. We (as evangelists) partner very closely with the RDs as much of what we're trying to do is equivalent. The good news is,

Jim has been a fantastic resource locally, and we've partnered on a number of events. He's been a long time MVP, and he's also a friend of mine, so I'm pleased to have the opportunity to work with him! Once again, congrats Jim!