James Kovacs' Weblog

Michael Howard, co-author of Writing Secure Code*, has an excellent blog post on how static code analysis tools are only one weapon in your arsenal when writing secure code. I would highly recommend reading it. A quick summary… Unless you understand the threats, know how to architect secure applications, know how to write secure code, know how to test for security vulnerabilities, and then backstop it all with a static analysis tool, you’re doomed to write insecure code.

* Fantastic book. Everyone developing software, whether on the Microsoft platform or not, should read this book.

The INETA Community Launch Event is coming to Calgary on Wednesday, February 8, 2006 from 11am to 2pm at the Metropolitan Centre! The event is being co-hosted by the Calgary .NET User Group and the Alberta .NET User Group. This 3-hour session will feature two action-packed presentations.

Representing the Calgary .NET User Group, Daniel Carbajal and I will be presenting Building Cutting-Edge Web Solutions with Visual Studio 2005 and ASP.NET 2.0.

Jason Wingfield and Greg Lancaster of the AB.NET UG will be presenting Smart Client Application Development & Deployment.

You can sign up here. (After joining the user group, click on Events… CommLaunch… Add Attendee…) Hope to see you at the event!

Lutz Roeder just released Reflector 4.2. (For those of you who haven’t heard me blither about Reflector I’ll say it again… Reflector is one of the best .NET utilities available. It gets installed shortly after Visual Studio after I build a dev box.) Lutz lists off the list of fixes as “Web Proxy support, String search, Fonts, Generics fixes.” (No, I’m not paraphrasing. This is the complete change log.) You can get the latest by launching Reflector and then selecting Help… Check for Updates. You can also grab it from here.

WARNING!!! If you use any cool Reflector add-ins*, such as Diff, FileDisassembler, or SQL2005Browser, you’ll have to wait until the respective authors re-compile for Reflector 4.2 because they will fail to load. (Breaking changes were made to Reflector’s object model in Reflector 4.2.) Unfortunately you can’t roll back a Reflector upgrade unless you squirreled the old installer away somewhere (which of course I didn’t because I’ve been upgrading via Help… Check for Updates). Oh well. Some folks, such as Herve Chapalain, author of Reflector.CodeSearch, already have a version of their add-in that is compatible with Reflector 4.2.

* Lutz maintains a list of Reflector add-ins here. Reflector SDK for building add-ins can be found here.

UPDATE: Diff v0.75 was just recompiled to work with Reflector 4.2.

Enterprise Library for .NET Framework 2.0 just hit the download servers. It has gone through a major update for .NET 2.0. This isn’t a simple re-compile. For instance, Enterprise Library is a heavy user of configuration and had its own configuration mechanism. .NET 2.0 ships System.Configuration, which the new release leverages. So if you’re developing enterprise applications using .NET 2.0, this new release is a must-have.

The January 2006 CTP for the WinFX Runtime has just arrived and with it, a Go-Live license for both Windows Communication Foundation (aka WCF or Indigo) and Windows Workflow Foundation (aka WF). (Windows Presentation Foundation, aka WPF or Avalon, also ships in the WinFX CTP, but the bits are identical to the December 2005 CTP. Details here. No Go-Live for WPF yet.)

Community websites for the technologies have launched, which promise to be similar to ASP.NET and WindowsForms.net:

• WindowsCommunication.net
• WindowsWorkflow.net
• WindowsPresentation.net*

• Microsoft WinFX Runtime Components – January 2006 CTP
• ReadMe file
• Windows SDK – English
• VS 2005 Extensions for Windows Communication Foundation (WCF)
• VS 2005 Extensions for Windows Workflow Foundation (WF)

We’ve all had it happen. You’re running out of space on your precious C-drive and you start to madly uninstall unneeded programs. Sometimes you even resort to uninstalling programs from C:\Program Files just so you can move them to D:\Program Files. (Chris Sells mentioned doing this dance recently, which is why I’m writing this blog entry.) STOP THE INSANITY. You can save a ton of time by following these simple steps:

1. Download Junction from sysinternals.com.
   
2. On another hard drive, create a D:\Program Files or whatever you want to call the directory. The name doesn’t matter.
   
3. Move C:\Program Files\AppThatIWantToMove to D:\Program Files\AppThatIWantToMove. Note that once you’ve done this, the program will no longer work properly (yet) because everything in your registry that makes file extensions, COM objects, etc. work is still pointing to the application at C:\Program Files\AppThatIWantToMove.
   
4. Run the following command: junction “C:\Program Files\AppThatIWantToMove” “D:\Program Files\AppThatIWantToMove”


5. Launch explorer and go to “C:\Program Files\AppThatIWantToMove”. The app appears to be on your C-drive again, but its actually stored on D-drive. Your application works just like it did before, but you’ve freed up space on your C-drive and you didn’t have to go through the uninstall/reinstall dance.

1. Delete the junction using: junction -d “C:\Program Files\AppThatIWantToMove”


2. Move D:\Program Files\AppThatIWantToMove back to C:\Program Files\AppThatIWantToMove.
   
3. Everything is back to the way it was, including your C-Drive being overly full again.

The Calgary .NET User Group will be hosting Joel Semuniuk, Regional Director, MVP, and VSTS Blackbelt* on Wednesday, January 25, 2006 from 5 to 8pm where he will be talking about… drum roll please… VSTS. (Bet you guessed that, didn’t you?) The event is generously being sponsored by Allstream. Pre-registration is required and available on the Calgary .NET User Group website. Hope to see you there!

* OK, I made the last one up, but seriously, Joel is the most knowledgeable VSTS guy around outside Redmond.

Rico Mariani, performance guru extraordinaire, turns out to be an amateur lyracist too. For all those geeks out there, here is Rico’s version of Bonnie Tyler’s Holding Out For A [Coding] Hero. (You can listen to a clip of the original version here, compliments of Amazon.) Enjoy!