idunno.org

Oh I can keep my shiny badge!

Barry Dorrans — Wed, 01 Oct 2008 14:23:29 GMT

"Congratulations! We are pleased to present you with the 2009 Microsoft® MVP Award! This award is given to exceptional technical community leaders who actively share their high quality, real world expertise with others."

Technorati Tags: MVP,Microsoft MVP,Microsoft Most Valued Professional

Look ma! I'm an author.

Barry Dorrans — Tue, 16 Sep 2008 17:33:35 GMT

Well; in a few months anyway.

A month or so ago I saw a tweet flit past asking for someone who has ASP.NET security knowledge; someone pointed the user my way. I assumed it was someone just asking for advice, so I sent off something along the lines of "What do you need to know?". It turns out the recipient was part of Wrox Press and he was after knowledge, on the shape of a book.

So after some pondering and pointing out I thought it had been done to death we both came up with, what I feel, is a new approach for a beginners book on the topic. I ran it past about 20 people who all thought it was a good idea, so I caved in, with some input from my ego and drew up a proposal and outline for a "Beginners" series book. I proposed self contained chapters, dealing with the OWASP top ten vulnerabilities and others; with each chapter based on what a developer wants to do with a web site; use forms, use databases, use cookies and so on; demonstrating the unprotected way, then discussing how it can be exploited and finally fixing it. I hope to have a book that can be both read from beginning to end as well as be pulled off the shelf and used as a reference. After changing the outline to use more active words and adding some things I'd forgotten and other people had pointed out it was presented to Wrox UK and US, and was accepted today. In about 8 months we'll find out if I succeeded or not when "Beginning ASP.NET 3.5 Secure Development" (or something like that) appears ... I wonder if I can chinpose on the cover.

(And yes, Information Cards will make an appearance, if only in an appendix)

Image by Alex Mackay

Technorati Tags: books,asp.net,security,wrox

That MS advert ...

Barry Dorrans — Sun, 07 Sep 2008 21:01:26 GMT

I think Craig has way too much time on his hands; but one thing occurred to me

con·quis·ta·dor

one of the Spanish conquerors of Mexico and Peru in the 16th century.

Dictionary.com Unabridged (v 1.1). Random House, Inc. http://dictionary.reference.com/browse/Conquistador (accessed: September 07, 2008).

So a large country who set out to loot, pillage and wipe out smaller rivals. Really not what MS should be associating with themselves ...

Technorati Tags: Gates,Seinfeld,Microsoft Advert

Encouraging "les auteurs" - we have a winner

Barry Dorrans — Tue, 02 Sep 2008 08:40:58 GMT

Developer Day voting is open and there are a large number of sessions you can choose from. A while back I threw out a challenge to the girl geek community to try to encourage more female speakers and we ended up with three potential speakers from the fairer sex, one from an MVP, Bev Hatchard who we persuaded to speak at DDD Scotland and is now bitten by the presenting bug, one from Chris Hart on virtual worlds and a bunch of submissions from Helen Emerson.

Now the competition was going to end when voting ended; but as Bev is an MVP and already has an MSDN subscription and Chris has a subscription from Dave Sussman that leaves Helen. This isn't a win by default; Helen has been ramping up her talks at usergroups as well, so last night when she spoke at my usergroup I presented her with her prize, a 1 year MSDN Team Suite Subscription; please enjoy it Helen!

From speaking to a few others some potential speakers had considered it but were too nervous to attempt it; this is perfectly understandable - my first speaking engagement was a favour for a friend at work who forgot to tell me it was for a major conference and there could be up to 100 people in the room. Nerves are unfortunately part of it, they never go away and I'm not sure how to address that. If you're one of the nervous folks would a mentor help? I've been thinking about this for a while and popping emails back and forth between a few of us; the community needs more speakers - how can the community help you overcome your nerves or objections and get you up to the front?

If you missed the change to submit for DDD you have another option. With REMIX around the corner on 18/19^th September 2008, once again the community is gearing up to provide its own unique brand of “entertainment while you learn” plus opportunities for all members of the UK Community to take part in events and promote their groups and themselves.

To that end, the REMIX team are organising another Speaking Competition along the lines seen at TechEd and the UK Launch. The community team is offering a fantastic opportunity to do just this by offering the chance to speak at a major event to your user group members. In the process they can get some help in improving their speaking skills plus have a chance to win an Xbox 360! Yes “Ready Steady Speak” is back for REMIX.

For those of you not familiar with it, the format is as follows;

Contestants will present a 5 minute session on a subject of their choice relating to Web Development or Web Design. They will present in front of the REMIX audience and in front of a panel of judges. If there are more than a certain number of contestants (TBD), there will be ‘heats’ earlier in the day with the winners of the heats in a ‘speak-off’ in the evening session. The ‘speak-off’ will take place as stated in the evening of the first day of MIX and the first prize is an XBox 360 and some goodies!

Mandatory Prerequisites:

Speakers must NOT have previously presented ‘full sessions’ at DDD, TechEd, DevWeek, SDN, SQLBITS, VBUG Conference, NxtGenUG FEST or any similar such conferences.
Speakers must create a new session of their own with new material which can be based on existing material but cannot be a simple copy of it.
Speakers must limit their session to as close to 5 minutes as possible (overrunning time will cause the speaker to be marked down.)
Speakers must not have previously won Speaker Idol or “Ready Steady Speak” UK Launch
Speakers must state their desire to enter the competition by no later than COP Monday 15^th September 2008.

Desirable

Speakers should provide if at all possible their own laptop, but one can be provided if necessary. The speaker should notify the organisers of any software prerequisites.
Speakers should have spoken previously at a User Group meeting even if only for a 10 min mini-session or ‘nugget’. This is NOT mandatory.

This is a great starting point for your speaking "career"; all you need is a five minute topic and the feedback you receive will be constructive and helpful, unlike the real Pop Idol. The likes of Scott Guthrie will be there and could be in your audience! If this is tempting then Dave "Swagmeister" McMahon is the person to email.

Technorati Tags: MSDN,Girly Geek,Remix

My Information Card logins don't work any more - .NET 3.5 breaking change

Barry Dorrans — Sat, 30 Aug 2008 14:57:31 GMT

A couple of weeks back I tried to login to signon.com, my preferred OpenID provider. I use signon.com because it accepts Information Cards for authentication, so that's one less password to remember. However it didn't work; which was strange. I noticed that blogs I had used Information Cards on before told me they couldn't recognise my card either.

It appears that someone listened to the problems with SSL and PPIDs I blogged about in February and this has broken the login. The change isn't a bad thing, it removes the dependence on the SSL chain so when you renew your certificate your users will still be able to login, however the lack of warning and no notification of a breaking change in the 3.5 readme is pretty shoddy.

Mike Jones blogged about it a few days ago; but the breaking update has been out for a couple of weeks now so, if anyone was using it in anger, identity providers have had two weeks to ponder what the heck went on and why their users had to register their cards.

Technorati Tags: Information Card,CardSpace,Breaking Change

nxtgenug Oxford: Helen Emerson on JSON

Barry Dorrans — Wed, 27 Aug 2008 10:11:17 GMT

Monday sees Helen Emerson come out to Oxford to present on JSON, her very well received session first deliver at DDD.

The object model in Javascript looks pretty foreign the first time you see it, particularly if you're from mainstream languages like C#, Java or VB.NET. In my talk I'm going to explore the Javascript object model, talk about the bread and butter things you need to know to create classes and objects and show you how to get the most out of some of the more exotic Javascript object features like prototyping.

As ever there will be pizzas and Chris will be doing a nugget on something to do with WCF; probably security related *grin*

If you want to come along then please register on the nxtgen website. Attendance is free, and you can consider joining us and helping pay for the pizza!

What:	It's Javascript Time...
When:	Monday, September 1, 2008 7:00 PM to 9:00 PM
Where:	Research Machins 140 Milton Park Abingdon, Oxfordshire OX14 4SE United Kingdom

Technorati Tags: nxtgenug,json,Helen Emerson

UK SQL user group inaugural meeting

Barry Dorrans — Wed, 27 Aug 2008 09:59:00 GMT

Thursday sees the first meeting of the UK SQL user group in exciting Milton Keynes, home of, errr, concrete cows. It sees Tony Rogerson talking about common table expressions and Simon Sabin talking about new features in SQL 2008.

You can find more details on the sqlserverfaq website.

(If you're thinking of driving beware the M1 and its road works of doom)

Technorati Tags: Usergroups,SQL Server 2008,SQL Server Usergroup

Learn VB.NET with the Open University

Barry Dorrans — Wed, 20 Aug 2008 11:56:18 GMT

My OU degree is almost done; by December of next year I will hopefully have a BSc (Honours) in Computing and Systems Practice. In order to finish the degree I had to accumulate 360 points by choosing courses from an applicable list and 30 points from "free choice".

I had already booked the courses for February next year which made up the last available options from the applicable list and started to look around for courses that would deliver those last 30 points; preferably starting next month so everything would be finished by 2009 (assuming I pass the exams next October of course). The course itself has two Java modules; one of the basics of OO (and it was very basic) and one which starts to explore interconnected systems. It has bugged me for a while that I had to choose Java; I queried it once to be told "We didn't want to be tied to a single vendor", which makes sense, except, of course, the language itself is still (pretty much) under the control of a single vendor.

As I browsed through 30 point courses I had a surprise; MT264 Designing applications with Visual Basic.

This course will teach you how to design and write small applications using Visual Basic Express. You should be a reasonably experienced computer user - a good preparation for this course is M150. Software applications discussed in the course range from a very simple traffic survey application, to more complex applications that are linked to a database. Roughly one third of the course consists of important practical Visual Basic Express programming exercises delivered online. You’ll also use course books that use a design language similar to Visual Basic to teach essential ideas about object-oriented programming.

They are now offering a .NET course; using the Express editions no less. The proviso on course books is interesting, in that it's not a VB book; I wonder what they will send...

Technorati Tags: OU,Open University,Visual Basic,VB

Ugh. Memes. How I Got Started In Software Development.

Barry Dorrans — Sun, 27 Jul 2008 08:23:36 GMT

Damn you MacKay (oh, how very Stargate)

How old were you when you started programming?

You young people today with your 4Gb of memory and your multi-core processors and your fancy disk drives. It’s not like I was when I was young, oh no. My school had an RM 380Z, with a grand 4Kb of memory, 8" floppy drives a fat clunky keyboard and a main CPU box that was the size of 2 Xboxes.

How did you get started in programming?

The computer teacher was our headmaster. He couldn’t really cope. So I grabbed the manual myself and started. Being the precocious little brat that you all know and love soon I was teaching him. But that passed, the 380Z was retired and home computers started to become affordable. I sold off my Scalextric set (much to my dad’s disgust) and begged my parents to make up the rest of the money to buy a computer. I can remember going around the resellers looking at the Dragon 32, the Acorn Atom, the Commodore Vic20 and the ZX Spectrum. The Dragon reseller was working out of his house. Of course all the demo machines had games set up to show off their specifications but I managed to persuade the parents it would be educational. I settled on the Spectrum with its "dead flesh" keyboard. Rubber doesn’t have tactile feedback, well not the type you want anyway. I hooked up the tape drive and away I went. Obviously it was games at first, the joys of Manic Miner still appeal today, but after a while curiosity took hold and I wanted to know how to do it myself. Numerous magazines, retyped BASIC programs and I was hooked.

What was your first language?

Spectrum BASIC. Which was fun because you didn’t type GOTO. Oh no, Spectrum BASIC was strange, you typed the line number (remember those kids?) and a space and then the next keystroke would enter an entire keyword. After that it was hand assembling machine code and using PEEK and POKE.

What was the first real program that you wrote?

I guess that depends what you count as real. I had a competitive thing going with one of my friends, he on his BBC B with its structured BASIC and myself on the Spectrum. Text adventures were all the rage so we both wrote those. You try putting a full English parser in 48k, utterly impossible, but we kept trying. I had code published in a magazine for the BBC Micro which did funky stuff with a Watford Electronics EEPROM board (attempting to emulate the way the BBC Master loaded ROMS). But if real means for money then a QuickBASIC program which polled an IBM mini-computer, pulled down data and printer out bar codes on a laser printer for sticking onto boxes.

What languages have you used since you started programming?

From Spectrum BASIC there was Z80 assembly. Then I got a BBC B and there was 6502 assembly. After that Pascal, COBOL and Modula2 in my brief stint in higher education. Then QuickBASIC under DOS on an original IBM XT (back in the days when IBM had circuit diagrams and a full assembly listing of the BIOS in the reference manuals) and RPGIII on a System/38. Then C, C++, Visual C++ with MFC, Visual Basic, SQL, VBScript (for ASP and WScript) then C# with bits of VB.Net thrown in.

What Was Your First Programming Gig?

My first job started off as a tape monkey for AVX Ceramics, an electronics company. I also ended up supporting all the PC users (the secretaries used to bribe me with chocolate to fix their problems first). I remember crawling under the false floor in the operations room to lay cables and the panic when no-one told me the Halon gas alarm was about to be tested. There was a need to produce bar code labels for shipping and so I ended up producing the "real" program I talked about earlier.

If you knew then what you know now would you have started programming?

What makes you think I know anything now? I don’t know if I’d be good at anything else; I’ve invested a lot of time into getting to where I am today and I enjoy it immensely. It suits my twisted mind set so yes, I’d probably still start down that route. However would I head down it if I were starting today given how developers are commoditised and outsourced and thrown aside? That’s a different matter.

If there is one thing you learned along the way that you would tell new developers what would that be?

If you’re in it for the money you’re doing it wrong. I’m lucky; my hobby is my job and that’s what you should be aiming for. Oh, and despite the best efforts of some its very hard to meet hot babes in programming; so think outside work more than I ever did.

What’s the most fun you’ve ever had ... programming?

Fun? Computing is serious business I’ll have you know. I guess SharpSTS is the most fun I’ve had, simply because it was a challenge, trying to build a system around undocumented, unsupported and mostly unloved standards. There’s always SubText as well, which I shamefully am neglecting these days; not so much for the coding but for the people involved and the learning experience you get from picking Phil and Jon's brains. Speaking at TechEd was pretty special too.

So time to spread the love; Peekachu I choose you. Err. No. Jon, Gary, Mr. Murphy, young Plipster and even younger Baby Ben.

Technorati Tags: Stupid Meme Nonsense

Ask for what you need; not for what you want.

Barry Dorrans — Thu, 17 Jul 2008 09:14:34 GMT

The solution that discloses the least amount of identifying information and best limits its use is the most stable long-term solution.

One of the tenants of the "Laws of Identity" is minimal disclosure; so why are people ignoring this when they implement Information Cards?

There are a three main uses (in my mind) for Information Cards; "form filling" (email address, name, etc.), authentication and authorisation via claims; all important as I try to write the last bit of SharpSTS and start to issue my own demonstration cards. These are separate functions in most web sites, form filling is used in the initial registration process, authentication at login time and authorisation during runtime; but in the information card sites I use (the main one being signon.com; which is an OpenID provider, and Pamela Project backed WordPress blogs, such as Kim’s) "form filling" and authentication happen all the time.

When you design your web site your login page is probably going to ask for two things; a username and a password (and perhaps if the user wants to be remembered). You don’t ask the user for their email address, their first name and their last name every time; that is the function of initial registration; yet when you look at the claims requested by Information Card sites right now you see the following (this is the information that is being requested from Kim’s blog; signon.com requests the same);

During logon the only real claim you require is the PPID - the equivalent of username and password; so why are these sites also asking for name and email address? There’s an argument here that they may not store that information; which certainly isn’t true with signon.com; they save the details as part of the registration process; they shouldn’t need it again unless it changes. You could argue that this way they can detect changes automatically, which makes for a smoother user experience; this is true, but the idea of a web site changing my information without telling me or without more interaction worries me somewhat.

Of course we can extend this; the date of birth claim is a good example. To take Vittorio’s usual example of wine/beer shops; they don’t need to know your date of birth, simply that you are of legal age. This is more complicated as there is not a standard claim for this sort of information; and of course the age varies from country to country; an Over18 claim in the UK would not be valid in the US because there you need to be over 21 (it’s at this point I start to wish for wildcard, standardised claim names so I could create a card which supports AgeOver* instead of creating a card with numerous claims of varying AgeOver claims).

I realise I’m kind of stretching the original minimal disclosure law; but to request all that information every time? That just seems wrong to me.

Technorati Tags: Information Card,CardSpace,Minimal Disclosure