Steve Smith's Blog

Books

ssmith — Mon, 26 Jul 2010 21:13:00 GMT

Sadukie tagged me with her books post a couple of weeks ago and I’ve been meaning to respond with a post of my own. I have a post I update periodically that includes some of my most recommended developer books (where I’ve been meaning to add Agile Principles, Patterns, and Practices in C# by Robert and Micah Martin) – if you’re looking for ways to improve yourself as a software developer I would start there.

Currently Reading

Right now I’m reading Disclosure, by Michael Crichton. I’m a fan of his stuff, and in the last year I also read Next, State of Fear, and A Case of Need. I’ve also been reading a lot of James Rollins novels (which Michelle got me started on), which are good light entertaining reads. I’ve read Deep Fathom and Sandstorm and Amazonia, and I think my next one is Map of Bones, which I’ve not yet started. Deep Fathom is a good one to start with if you’re so inclined. The Percy Jackson books, which I read shortly after my then-7-year-old daughter read, were also fun and entertaining.

Digital Reader

My wife got me a Nook for Christmas this past year, and I took it on several trips and loaded it with a few books from the library and PDFs of things I wanted to read later. It worked pretty well at first, but I have to say I’m not very happy with it at the moment. It keeps getting into a state where I can’t turn it on or interact with it. I won’t bore you with the details of all the various rituals I’ve gone through in terms of charging, connecting to AC vs. PC for power, resetting, etc. but suffice to say it’s been rather frustrating (even moreso than trying to get it out of its original packaging, for which there are videos to show you how to do it). In short, I think I would rather try a Kindle, or maybe even an iPad, in lieu of this device. The one thing that it has that’s cool, which I’m not sure the other devices support, is grabbing digital books from the local library. But of course when you can’t get the thing to turn on, the allure of such things fades.

Recommendations

One book I really enjoyed reading last year is Zen and the Art of Motorcycle Maintenance. I’ve been meaning to blog about the book and its relationship to Software Craftsmanship (which, by the way, there’s a group that meets in Hudson Ohio monthly to improve themselves in this regard), and hopefully I’ll get that done soon. However, whether you’re a software developer or not, this is certainly an interesting book to read. There are some great lessons about quality that I think are worthwhile for any reader.

Also, though they’re not books, I highly recommend the web comics XKCD and Calamities of Nature for geeks.

Tag!

So what are you folks reading these days?

Working with Application Pool Identities

ssmith — Fri, 09 Jul 2010 13:16:00 GMT

There a new feature of IIS called Application Pool Identities that was apparently introduced with SP2 of Windows Server 2008. There’s a nice overview of Application Pool Identities here, which is the basis for this post, which is just my notes on the feature.

If you’re setting up new web sites and application pools in IIS on Windows Server 2008, it’s likely they’ll default to ApplicationPoolIdentity, like this:

This is all well and good, and for the most part you don’t need to care about how this works behind the scenes or why it’s different than the other bazillion different esoteric accounts you’ve had to know about over the last 10 years when setting up IIS for ASP.NET (IUSR_MACHINENAME, NETWORKSERVICE, IUSR, etc.). The most recent installment in IIS user best practices, before ApplicationPoolIdentity, was NETWORKSERVICE:

NETWORKSERVICE is a built-in Windows identity. It doesn't require a password and has only user privileges; that is, it is relatively low-privileged. However, a problem arose over time as more and more Windows system services started to run as NETWORKSERVICE. This is because services running as NETWORKSERVICE can tamper with other services that run under the same identity. Because IIS worker processes run third-party code by default (Classic ASP, ASP.NET, PHP code), it was time to isolate IIS worker processes from other Windows system services and run IIS worker processes under unique identities.

Got that? The NETWORKSERVICE account was low-privileged, so it was a best practice to use it. But unfortunately, since so many apps followed this practice, it became likely that NETWORKSERVICE would have too much access to a variety of applications/processes, so something new had to be used.

Enter Application Pool Identities. On IIS7.5 on Windows Server 2008 R2, your application pools will run with their own individual identity, each of which is actually a virtual account created with the same name as your application pool. You may see these accounts in the ACLs for the files in your web site, and you’ll need to know how to reference them yourself if you want to configure security settings for your site correctly (e.g. to allow users to upload files to your web application). They are not actually users or accounts, so they will not show up as a user in the Windows User Management Console.

For example, if you look at the Security settings for a particular filesystem object in your web application, you might see something like this:

Note, though, that if you go looking for these users on the server, you won’t find them. If you choose to change permissions by clicking Edit, then Add, then change the location to your server (if it defaults to a domain), then Advanced, and finally Find Now (yes, that’s a lot of buttons), you WON’T SEE THESE ACCOUNTS:

So where are they and how do you add them?

You have to know the secret, which is to prefix Application Pool Identities with

IIS AppPool\

Thus to grant rights to the DefaultAppPool you need to use

IIS AppPool\DefaultAppPool.

If your application pool is named mywebsite.com, then your identity would be

IIS AppPool\mywebsite.com

When they appear in your ACL list, the IIS AppPool won’t be listed. This is to ensure greater confusion on your part, because you don’t have enough things to try and remember as a web developer and/or server administrator. If you type in the correct value and then click Check Names, it will remove the IIS AppPool\ prefix and underline the account name for you, like so:

Hope this helps! For more info I suggest reading this article on Application Pool Identities.

Also, don’t forget you can follow me via twitter, email, or RSS.

Software Engineering 101 in Cleveland

ssmith — Wed, 07 Jul 2010 19:34:39 GMT

Next week I’ll be one of several speakers at a free one-day event being held at the Microsoft office in Independence, Ohio. The event is designed for Microsoft developers who are seeking to improve their skills in software engineering, including object-oriented design, design patterns, and automated testing. The event is being hosted by Microsoft and organized by the Hudson Software Craftsmanship group and NimblePros consulting services.

Initially there were 50 slots available – I think there are about 15-20 left as of today. The event is scheduled for 16 July 2010 from 830am to 4pm, so if you can get approval to come for some free hands-on training, sign up fast before it’s sold out.

You can register for the event and view the agenda here. If you’re planning on attending the Cleveland Give Camp, there will be a number of folks going to both, and the SWE101 event should wrap up in plenty of time to make it to the GiveCamp.

Set Up Build Agents By Project in TeamCity

ssmith — Wed, 07 Jul 2010 15:22:00 GMT

We’re using TeamCity to manage our continous integration builds for CodeProject.com and LakeQuincy.com. Before TeamCity, I was using CruiseControl.net, and TeamCity is much easier to get working (and requires far less XML manipulation). I do miss CCTray, which I found to be much nicer than the TeamCity tray notifier (which if you click on it never shows anything immediately – it has to go and get it which imposes a delay – it also doesn’t do sounds like CCTray does – but I digress).

Let’s say you have several large projects and you want them to run on the same instance of TeamCity. Let’s further assume that some of these build configurations do a lot of stuff, and thus might take 10 minutes or more to run, while others are for relatively small projects or web sites that might take 30 seconds or less to run. If you were to check in one of these small sites, hoping to quickly see the build server turn green, you would be rather frustrated if your timing were poor and you had to wait 10 minutes for a larger project that was unrelated to your project to finish its build. Beyond the frustration, this causes a very real and negative impact on your productivity.

Options

1) Create another build server. The TeamCity tray notifier can now talk to more than one instance of TeamCity (though I haven’t tried it myself), so this would be one option if you have the hardware available.

2) Add another build agent. The agent does the real work of building your projects, and you can install multiple agents based on your license of TeamCity. These can live on the same server or on different machines. This is the approach I’m demonstrating here.

3) Live with it. This is the default approach, of course, and is listed only to make you think this is an exhaustive list of options.

Installing an Agent

Assuming you already have TeamCity set up and running, installing a new agent is pretty simple. If you click on Administration, you should see a link just below the search bar to Install Build Agents, like this:

Before you do anything, you should read about configuring this new agent!

Specifically, there are some notes on things you need to know about installing multiple agents on the same machine. Read them here.

Assuming you’re on a windows machine, you can go ahead and use the MS Windows Installer.

Make sure you edit the \launcher\conf\wrapper.conf file and change the following properties so they are unique among your agents:

wrapper.console.title
wrapper.ntservice.name
wrapper.ntservice.displayname

If you don’t modify these, then what will happen is your new agent will give your old agent the boot, as it were, and you’ll still have only one agent running on the machine as a service, but it will be pointing at the new folders you told it to use for the second agent.

Also, if you find yourself faced with an error when trying to create or delete a service using the scripts for doing so that are included in the agent folders, try closing the services.msc dialog. I found that it was preventing me from deleting some services (that I was trying to then recreate).

Specify Build Agents for Projects

Having two (or more) build agents is great, but now all that’s going to happen is every project will just get picked up by whichever agent happens to be free. And each agent will need to have a working copy of every project, which multiplies the disk space needed and the traffic with the VCS server. If you have large projects, these can be real concerns. So how do you specify that a particular agent should be associated only with a certain set of projects? Through the use of agent environment variables, as discussed here.

Specifically, in the buildAgent.properties file (in the /conf folder), you can add your own user defined values. Here’s an example of the configuration file for the Lake Quincy build agent:

name=LQ Build Agent

ownPort=9091

serverUrl=http\://localhost\:90

workDir=D\:\\TeamCity\\LQBuildAgent\\Work

tempDir=D\:\\TeamCity\\LQBuildAgent\\Temp

#User defined properties

env.lakequincy=true

env.TEAMCITY_JRE=C\:\\Program Files\\Java\\jre6

Notice the env.lakequincy value. What it’s set to is actually not important, as you’ll see in a moment. You’ll want to add such an environment variable to each agent, designating which kinds of projects it should work on.

Next, in TeamCity’s web interface, go to each of your projects and update their Agent Requirements (configuration step 7). In my case, I’m going to Add requirement for a variable and say that the project’s agent must have an environment variable called env.lakequincy and that it must exist.

Once this is done, you should see the correct build agents listed as Compatible, and all others listed as Incompatible, with the reason listed for the incompatibility:

Summary

It’s pretty easy to get continuous integration working with TeamCity, and very easy to add additional agents to a single server (using unique paths and service names). If you want to dedicate some agents to certain projects or tasks, you can easily do so by using environment variables as shown here.

How Can I Determine The Current Controller or Action in an Html Helper

ssmith — Fri, 02 Jul 2010 18:42:04 GMT

If you’re writing an HTML Helper for ASP.NET MVC you may want to do something different based on whether the page that is to be rendered was arrived at via a particular controller or controller action. I found the following code which does just this in one of the ASP.NET MVC Themes available from the www.asp.net web site (the Dark theme, I believe it’s called).

Note that I’ve already modified this code to work with the new ASP.NET 4 string encoding and the MvcHtmlString type, as I wrote about previously.

public static MvcHtmlString LoginLink(this HtmlHelper helper)

    string currentControllerName =

      (string)helper.ViewContext.RouteData.Values["controller"];

    string currentActionName =

      (string)helper.ViewContext.RouteData.Values["action"];

    bool isAuthenticated =

      helper.ViewContext.HttpContext.Request.IsAuthenticated;

    // more stuff here

As you can see, the HtmlHelper has a ViewContext property, which allows you to access RouteData and ultimately from there determine the controller and/or action that was used for this request. Incidentally, you can also use the ViewContext to get to HttpContext and determine whether the request is authenticated as well.

And that’s it!

You can follow me on twitter here or subscribe to my blog here.

Budding Versus Festering Code

ssmith — Tue, 29 Jun 2010 15:51:42 GMT

This is in response to Michael Feathers’ recent post on Festering Code Bases and Budding Code Bases.

Certainly the default tooling in the Visual Studio space has, until recently, made it dramatically easier to add code to an existing class than to create a new class. However, tools like ReSharper have a large impact on this, and can make it extremely easy to create new classes, put them in their own files, and move those files where they are supposed to go with just a few keystrokes (and VS2010 is coming along in some of these areas as well). So, I think there is a trend in the tooling to make the cost of budding less - it would be interesting to add something to the IDE that would make the cost of festering INCREASE.

Imagine an add-in that would grow more and more annoying as the size of your class increased. Clippy pops up and starts to say “It looks like you’re adding code to a 3000 line class – can I recite the Single Responsibility Principle to you?”

Now we might see something like the virtuous cycle it sounds like Michael Feathers is advocating for, and perhaps with enough added cost to festering codebases, we would see the de facto trend shift toward more budding-style development (and perhaps, as he notes, the problems that this might bring with it).

Disable Hibernation on Servers

ssmith — Mon, 28 Jun 2010 19:33:07 GMT

Here’s a quick tip if you should find several GB of your system drive taken up with hiberfil.sys on a production server machine (as I recently did with a virtual server with a very small C partition) – Disable Hibernation.

Disable Hibernation

1. Open a command prompt as administrator

2. Run this command:

powercfg –h off

3. Done!

The hiberfil.sys file should immediately disappear. This also works on desktop computers that never use hibernate, of course. Thanks to SpearMan for the tip. I’ve only tested this on Windows Server 2008, but I’m pretty sure it will work on most modern versions of Windows (7, Vista, 2008 R2, etc.).

Default Encoding of Strings in ASP.NET MVC 2

ssmith — Thu, 24 Jun 2010 17:36:26 GMT

If you have ASP.NET MVC 1 code you are moving to ASP.NET MVC 2 (and ASP.NET 4) you are likely to encounter a problem in which your application starts displaying encoded HTML on the page rather than the actual results of that HTML (e.g. you see <a href … /> instead of a hyperlink).

One of the greatest features added to ASP.NET 4 is a new way to render content that is encoded by default in your .aspx/.ascx pages/views. This new syntax uses <%: Model.SomeString %> instead of the ever-popular <%= Model.SomeString %> way of doing it. Note the third character is now a : not an =. It actually takes up a tiny bit less horizontal space – isn’t that nice of the ASP.NET team to be looking out for us that way (assuming you don’t use a fixed-width font for your programming/markup, which applies to some tiny percentage of you).

So go forth, and whenever you see <%= in your ASP.NET 4 apps, replace it with <%:, and life will be good. Your apps will be more secure. Cross site scripting attacks will decrease. Hackers will be sad.

But what about your existing code that used to look like this:

and now looks like this:

This happened when you went from this code:

<%= Html.LoginLink() %>

to this code:

<%: Html.LoginLink() %>

MvcHtmlString

The solution to this is MvcHtmlString. It’s a new class that <%: is aware of and if you change your helper to return one of these, you’ll get back the behavior you expect. In effect, if you are returning one of these objects, you’re telling the renderer that you know what you’re doing and you’ll handle any encoding requirements and it should just display whatever you pass in.

This allows you not have to think about whether to use <%= vs. <%: in your views. You can (and should!) always use <%: in your views. I say again, you should always use <%: in your views.

So how to fix LoginLink()? Simply change its signature to return an MvcHtmlString, and create one when you are returning, like so. Here’s the original:

public static String LoginLink(this HtmlHelper helper)

    string currentControllerName = (string)helper.ViewContext.RouteData.Values["controller"];

    string currentActionName = (string)helper.ViewContext.RouteData.Values["action"];

    bool isAuthenticated = helper.ViewContext.HttpContext.Request.IsAuthenticated;

    var sb = new StringBuilder();

    if (isAuthenticated)

        sb.Append("Logged in as <span>");

        sb.Append(helper.Encode(helper.ViewContext.HttpContext.User.Identity.Name));

        sb.Append("</span>");

    sb.Append("<div id=\"loginlink\"");

    if (currentControllerName.Equals("Account", StringComparison.CurrentCultureIgnoreCase) && (currentActionName.Equals("Login", StringComparison.CurrentCultureIgnoreCase) || currentActionName.Equals("Logout", StringComparison.CurrentCultureIgnoreCase)))

        sb.Append(" class=\"selected\">");

    else

        sb.Append(">");

    if (isAuthenticated)

        sb.Append(helper.ActionLink("Logout", "Logout", "Account"));

    else

        sb.Append(helper.ActionLink("Login", "Logon", "Account"));

    sb.Append("</div>");

    return sb.ToString();

Now just change the return type to MvcHtmlString and call MvcHtmlString.Create(“your string”) when you are ready to return, like so:

public static class LoginLinkHelper

    public static MvcHtmlString LoginLink(this HtmlHelper helper)

        string currentControllerName = (string)helper.ViewContext.RouteData.Values["controller"];

        string currentActionName = (string)helper.ViewContext.RouteData.Values["action"];

        bool isAuthenticated = helper.ViewContext.HttpContext.Request.IsAuthenticated;

        var sb = new StringBuilder();

        if (isAuthenticated)

            sb.Append("Logged in as <span>");

            sb.Append(helper.Encode(helper.ViewContext.HttpContext.User.Identity.Name));

            sb.Append("</span>");

        sb.Append("<div id=\"loginlink\"");

        if (currentControllerName.Equals("Account", StringComparison.CurrentCultureIgnoreCase) && (currentActionName.Equals("Login", StringComparison.CurrentCultureIgnoreCase) || currentActionName.Equals("Logout", StringComparison.CurrentCultureIgnoreCase)))

            sb.Append(" class=\"selected\">");

        else

            sb.Append(">");

        if (isAuthenticated)

            sb.Append(helper.ActionLink("Logout", "Logout", "Account"));

        else

            sb.Append(helper.ActionLink("Login", "Logon", "Account"));

        sb.Append("</div>");

        return MvcHtmlString.Create(sb.ToString());

Note above in the LoginLink method that we are calling helper.Encode(…) when displaying the user’s name. It’s possible that a malicious user could register with a name that includes some script tags, and depending on the registration validation or the membership API in place, it might get into our system through those means. If that user then left a comment or did something else that resulted in their username being displayed on the site, it could run some malicious script that might, among other things, redirect all of our site’s users to a malicious site that could try to exploit their machine. That would be bad.

Always encode untrusted user inputs.

Summary

Encoding by default is a good thing. With ASP.NET 4 this is very easy to do if you just enforce the rules that <%= is no longer used, and is replaced everywhere with <%:. This may result in some breaking changes from existing code that is expecting to render plain strings that contain HTML in them. These can easily be fixed through the use of the MvcHtmlString class described above.

Tagging Releases in Source Control

ssmith — Wed, 23 Jun 2010 14:31:00 GMT

A best practice when you’re using source control is to tag your releases. What does this mean, exactly? If you’re following the relatively standard non-distributed source control repository folder structure of having root folders for:

branches
tags
trunk

then it means simply making a copy of the current state of the system when you did your release. Here’s how to do it using Subversion (SVN) and the TortoiseSVN client, both popular free tools for source control management.

Step 1: Test and Deploy Your Application

Do whatever it is you do to deploy your application. Maybe you create an EXE package. Maybe you FTP a web site to production. Whatever it is, get your source code into the final state it needs to be in, and then do your deployment.

If the deployment doesn’t work, don’t go past this step.

Step 2: Tag Your Current Trunk

Assuming that you re deploying from the trunk of your source control repository, and that it’s your working copy (both relatively standard assumptions but certainly not 100% true for all shops) then the following steps should work for you.

First, go to the root of your working copy and select Branch/tag from the TortoiseSVN menu in Windows Explorer. See Figure 1.

Figure 1 – Select Branch/tag…

Next, you want to fill in the dialog like in Figure 2 below. You’re copying from the trunk, which should be the default for the first URL (From WC at URL:). Your To URL you will need to set. It’s a good idea to use a datetime that will sort alphanumerically, like YYYYMMDDSomething. Since we might use tags for things other than deployments, I use YYMMDDDeploy. If you end up having more than one deployment on a given date, you can always add an 01, 02, 03 or something to the end of the string. This is basically just a foldername – you can do whatever you want with it but it’s good to have a standard and stick to it. “Release” is also common.

If your working copy is what you just deployed, it’s best to select that for the Create copy in the repository from: option. However, if you’ve just checked in or done an update and you know your working copy is the same as the latest in the trunk, you could select HEAD revision in the repository. Just be careful if you do this and you work on a team – if someone else does a checkin before you’re done with your tagging operation, you could end up with stuff in your tagged version of the code that didn’t really go into the deployment. Working copy is safer.

Figure 2 – Copy (Branch / Tag) window

If you do end up with a different version in your working copy than what was deployed, you can always use the Specific revision in repository option to select the actual revision number that corresponded to the deployment.

You want to be sure to leave the Switch working copy to new branch/tag checkbox unchecked. Generally tags are meant to be snapshots, not something that you commit work to. If you end up needing to modify stuff in a tag, you should copy it into a branch and do the work there, then merge it into the trunk, then deploy it, and tag the new deployment.

Once you’re ready, click OK and you should see something like this:

Summary

Adding tags is valuable because it lets you identify the exact version of your software that corresponds with a given release or deployment. If bugs occur, you can review the tagged copy of your source to identify the bug, then create a branch in which to fix it (or just fix it in the trunk if it’s simple). Without tags, if any significant work is done between releases, it can be difficult to recreate an environment that corresponds to the one a customer is using when bugs are found.

Great Uses of Using Statement in C#

ssmith — Mon, 21 Jun 2010 13:32:00 GMT

In my last post about testing emails in .NET, I noted the use of the using statement to ensure safe usage of the IDisposable SmtpClient and MailMessage objects. This is the typical usage of the using statement, but you can take advantage of this statement’s behavior for other scenarios as well, resulting in cleaner code.

Consider the scenario where you want to perform some kind of pre- and post- processing around an arbitrary block of code. The simplest scenario I know of is when you want to time some code, using the stopwatch class. If you want to perform basic stopwatch usage, you can write some code like this (borrowed from the stopwatch MSDN docs):

public static void BasicStopWatchUsage()

    Console.WriteLine("Basic StopWatch Used: ");

    var stopWatch = new Stopwatch();

    stopWatch.Start();

    Thread.Sleep(3000);

    stopWatch.Stop();

    TimeSpan ts = stopWatch.Elapsed;

    string elapsedTime = String.Format("{0:00}:{1:00}:{2:00}.{3:00}",

                                       ts.Hours, ts.Minutes, ts.Seconds,

                                       ts.Milliseconds/10);

    Console.WriteLine(elapsedTime, "RunTime");

This works, and of course the Thread.Sleep(3000); is where our actual work would go. If our actual work is a relatively small amount of code, it can easily be lost in the clutter that comprises our stopwatch profiling code. We can rewrite the above code like so if we move our profiling code into an IDisposable class:

private static void UsingStopWatchUsage()

    Console.WriteLine("ConsoleAutoStopWatch Used: ");

    using (new ConsoleAutoStopWatch())

        Thread.Sleep(3000);

And of course, even the Console.WriteLine could be moved into the ConsoleAutoStopWatch class’s constructor if we wished to do so. The ConsoleAutoStopWatch, so named because it’s coupled to the Console (you could easily create similar implementations that use your favorite logging component, or dependency-inject the outputter for the class), is shown here:

public class ConsoleAutoStopWatch : IDisposable

    private readonly Stopwatch _stopWatch;

    public ConsoleAutoStopWatch()

        _stopWatch = new Stopwatch();

        _stopWatch.Start();

    public void Dispose()

        _stopWatch.Stop();

        TimeSpan ts = _stopWatch.Elapsed;

        string elapsedTime = String.Format("{0:00}:{1:00}:{2:00}.{3:00}",

                                           ts.Hours, ts.Minutes, ts.Seconds,

                                           ts.Milliseconds / 10);

        Console.WriteLine(elapsedTime, "RunTime");

Now anywhere you need to profile a small block of code or a method call, you can simply wrap it in a using(new ConsoleAutoStopWatch()) {…} block. Note also that since our code doesn’t require any reference to the ConsoleAutoStopWatch class, we don’t even set it to a variable instance. It’s sufficient to simply new it up within the using().

You can imagine other scenarios where you may have some pre- and post- processing you need to do that is independent of the work being done. In these scenarios, you can clean up your code and separate your concerns effectively through this kind of usage of the IDisposable pattern and the using() statement.

Subscribe to Steve’s blog here; follow Steve at http://twitter.com/ardalis.