thinking-out-loud

D'oh

I should know better by now. Search first, post second. Search first, post second. But really, what fun would that be? Don Box shows that I get what I want in Whidbey.

Delegate syntax

I don't get delegate constructors. Why do we need them? We ought to be able to do:

public delegate void F();
public class A{ 
public void B() {}  
public void C(F f) {}  
}

F f = new A().B;

new A().C(new A().B);

No constructor necessary.

Clue wanted

I have blogged about this in the past, but this time I am looking for specific advice.

So someone please, please clue me in.

I am trying to use System.ComponentModel in the manner specified in Daniel Cazzulino's article on DI. I want to get rid of a number of singletons in several of the web applications in my client, and so I am trying to plug into the the ComponentModel framework. But none of the standard components, e.g. Global or Page subclasses seem to be "Sited," i.e. Site returns null. A little reflectoring seems to suggest that the ASP.NET framework doesn't respect the ComponentModel's Container protocol other than to load some elements into the HttpContext. I could build my own container, dump it into application state or a [grrr] singleton, and be done, I suppose, but I am hoping for an epiphany that will bring with it enlightenment. I am not, however, holding my breath.

Any help? Thanks in advance.

XmlDevCon - Reloaded

non-tech

I love the in-between time. Just after something fades from popularity until about a decade later, when it is recycled into popular culture as 'retro.' But not retro-bad, retro-good. I LOVE retro-bad. Like Matrix references among geeks. Apparently, matrix references are old and stale now, and least at sell's XmlDevCons. In my mind, now is a great time to *start* using them. Red pill, Blue pill. Red pill, Blue pill. If you can keep it up for the next decade or two, when it comes back around, then you suddenly are SOOOO hip. "Man, that guy is visionary. He's been saying 'red pill/blue pill' for the last TEN YEARS!" All it takes is a little patience. Another great side-effect of this approach is that it alienates you from society even more than just generally being a dork does alone -- "Doesn't he know that matrix references aren't cool anymore???" -- leaving ample time for coding.

The SellsCon was a nice, little vacation. Rory Blythe has a nice, personal recap of the conference that is far more interesting. You might want to read it instead. The location, as he so much more interestingly mentions, is gorgeous. And not just in the "OH MY LORD THAT IS BEAUTIFUL" sense. Which it is. But also in the "MAN OH MAN THAT IS A BIG GORGE" sense. The Columbia River Gorge (CRG) is a National Scenic Area (NSA). And it is also a severe driving hazard. Man, all those curves and stuff. And then they have the audacity of placing distracting waterfalls near the curves. Talk about a recipe for disaster. They outlaw curves in Texas. But they sprinkle them liberally over I-84 and the old columbia river gorge highway. Both are beautiful, but the former inspires you to go fast fast, while the latter inspires you to go slow slow. Yeah, that's nice. Pull on over, or better yet, just stop in the road there. I am sure that people will understand. Don't forget to take off the lens cap.

I missed most of the socializing at the conference for a couple of reasons. First, I am a little shy. Now, once I get a little lubricated with tasty adult malt beverages, the odds are better that I'll get to know you, but I have been trying to avoid the stuff lately, because, quite frankly, I become useless [for doing things productive toward running a business/maintaining a household] after a beer or two. Regardless, I did have a beer or two on the trip, and stuck to the locals, all of which were good. I don't recall the names right now, but I highly recommend that you hop on a plane, book a reservation at the Dolce Skamania Lodge, and try them out, though not necessarily in that order. Oh, if you are close enough, go ahead and drive. I won't mind.

The second reason that I didn't socialize much is that my wife and daughter were around, and I wanted to spend some time with them, since we were trying to conflate family vacation and dork time. I am sure that you would have love to meet them, maybe even me, and likewise, I am sure, but when the conversations devolve into tekspeek, as they always do, Aimee's eyes glaze over and she starts to feel a bit left out.

The third reason -- I know I said a couple, but come on, give me a break -- was that the two hour time difference was wreaking havoc on the old body, not to mention making beautiful little Eva a bit of a challenge to deal with, scheduling-wise. Normally, things are roughly clockwork, and that's how we like it. But that meant that breakfast for her was 5:30. Throw on top of that the fact that she appears to be cutting some new teeth, ... yikes. I feel sorry for those of you who were above/next to our room -- 113 on the first couple of nights. She was in pain and inconsolable for long enough that you might now hate us though you know us not. At this point, it seems like a good time to show you a picture of her:

Now, isn't that better?

On the flight up, somewhere over the Rockies, we hit some pretty serious turbulence, and Eva decided to impersonate Stan seeing Wendy Testaburger.

And it was A LOT. A LLLLLLLLLLOOOOOOOOOT. And it stank. It smelled a lot like, um, well, vomit. Remarkably so -- in the sense that I am remarking about it now. And we did not get to the barf bags in time, because, well, one flight attendant stole ours about 30 minutes prior for someone else. We did catch most of it in one of those fleecy airplane blankets. The other flight attendant was a largely unhelpful douche bag. "Here, here's a trash bag or two, now I am going to run to the back of the plane and hide like a pansy." Not that there's anything wrong with that. The lady directly behind Eva's seat lost a sweatshirt. We apologized profusely and offered to buy her a new one, but she kept refusing. I hate that. I wish she would have just taken the money so that we could atone for some of the guilt. The guy directly in front of Eva leaned forward with his head in his hands for the next 30-45 minutes, ostensibly due to the smell. It would have been funny, if it just plain so decidedly WASN'T.

Now, as I said before, the CRG is gorgeous. As I also said before, that is a double-entendre. And normally, when Aimee and I leave Texas and particularly Dallas for any period of time and go ALMOST ANYWHERE, we return saying "Now, why the hell do we live here again?" And the same would be true of Portland and the CRG, were it not for the constant overcast-ed-ness. I am most decidedly addicted to sunlight. I honestly don't know how people make it in the greater Oregon/Washington area. I would probably fall into the statistically significant group of people who choose to end it all because life is soooooo dreary. Not really [well, yeah, really about the 'dreary' part, just not about the 'ending-it-all' part] , but man, it was getting me down. We were so glad to get back to Texas, sunlight, and (gulp) 90 degree weather. I was even somewhat happy to mow the lawn. Lawn mowing season appears to be winding down, btw. Maybe one or two more mowings, and then we can call it a year.

Another depressing thing about the trip was having to pass the "Leaving the Columbia River Gorge National Scenic Area" sign. Each time we did, we let out an audible "Daaaaaarrrrrrrnnnn." And each time we saw the complementary "Entering" sign, we said "Ahhhhhhhhhhhhh." And then swerved to avoid wrecking into whatever it was that we were about to hit because of the waterfalls.

Look for the Matrix -- and ME -- to make a BIG come back in 2012.

XmlDevCon - Keith Brown

"One man's feature is another man's exploit."

Who should be responsible for security?
"Us"
"Them"
"Vendors"

Fraser: A group of people - the people making the risk vs. cost decisions, regulatory oversight, etc.

"Don't assume the infrastructure will save you."

Tip 1: Less is more.
Don: CAS is so complex.
Less surface area.
Less open ports.
Less functionality.
TimE: Less "open content models"
KB: Less priveledge.
It is hard to write for least priviledge, largely because the tools suck.
Try running as non-admin.
Less custom security code.
Less secrets. (Secrets make us insecure).

Tip 2: Newer is often not better.
Subscribe to Bruce Schneier's cryptogram.
Use SSL when you can. It's simpler, more widely deployed.
KB Likes passing multiple security tokens, maybe to pass multiple tokens along for traceability, but allow middle tier to run as itself.

Tip 3: Trust no input.

PurchaseOrder | format c:\ < 'y'

%d%d%n - %n lets you write back on to the stack

256 drop table users - sql injection

Filter the input
Sandbox the input (separate control channel from data channel), keep the attacker in the data channel
strong types - parameterized query or sprocs
A lot of the data access tools make it far easier to do string concatenation than parameterized queries
Filter via, for example, regex
KB would prefer you remove the ' from the string
"Attackers like to give you finely crafted garbage"

secret.txt. - OS helpfully strips of the trailing .

secret.txt::$DATA - ntfs default data stream

Tip 4: You can't authenticate remote software.

Tip 5: What your program knows, your attacker can discover.

- avoid trusted subsystems (i.e. impersonate)
- affects connection pooling

Countermeasures (from B. Schneier's Secrets and Lies)

Protection
Detection
Reaction

Tip 6: Understand trust.
"How many of you are developing a federated identity solution?"

Tip 7: Wetware is unreliable.
What do you do with UserNameToken in WS-Security.
maybe concatenate password with epr/uri (uri kind of acts as a server-wide 'salt')

Tip 8: You probably need a longer key.
What is the current size: 2048. Lenstra and Verheul - Selecting Cryptographic Key Sizes
J. Cryptology, Aug 2001
Symmetric Keys - a practical length - 256
WS SCT - uses derived keys

Tip 9: Availability is the third pillar.
CIA - confidentiality, integrity, availability
Would love to see a .NET

Tip 10: Find the weakest link.

All we are saying, is give SOAP a cha-a-a-a-a-a-nce.

OK, so [WHAT- hey now stop that!]

a few things I've been mulling over

These are some placeholders for more coherent conversations later.

There has been a lot of banter back and forth on O/R mappings in the past few months. Ted Neward made the Vietnam comment and that has stuck with me for a number of reasons. I think that the major reason it has stuck with me is that the statement could only, in my estimation, really apply to the notion of objects at all in an integration world, rather than to O/R. I think the reason for that, in my mind, is that when Ted et al. talk about O/R, they are talking about a *product.* When I talk about O/R, I am talking about *techniques.* My take is simple: if you are persisting your data in a relational database, AND you are reifying that data at runtime in objects, then you HAVE an object-relational mapping problem. That means you have to come up with an object-relational mapping solution. I think the real question is more along the lines of Ted's comment about Hibernate, i.e. at what point do you declare victory and move on. The solution space for O/R is quite broad, and the solutions range from ad-hoc/unaware to generative to fully metadata driven, reflective solutions. I will post a bit more on O/R at some point, because it is something I just need to get off my chest (out of my head).

I think the more interesting question is whether it makes sense to use objects in the middle anymore at all. I think the answer is "sure, why not?" But at the same time, I think that there are a lot of compelling xml related technologies that are making that middle less and less compelling. My good friend chris talks about how things seem to be getting turned inside out again, which is to say, maybe our data and its associated behavior don't co-habitate, but they at least live in the same apartment complex or whatever. I think that schematron does a good job of externalizing lightweight business rules about the instances, and it optionally scales up to support document-oriented workflow.

I had a discussion with Stuart Celarier of Fern Creek after Daniel Cazzulino's schematron talk, and Stuart was particularly not inspired by schematron in general and the notion of a document that is passed and grown between different services participating in a workflow in particular. His point seemed to be that each of the interactions in the workflow should be a separate document, each allowed to have its own schema. (Sorry if I misrepresent your points, Stuart.) He also didn't seem to inspired by Daniel's statement about not needing multiple schemas. I think that the many-worlds aspect of schemas relative to infosets makes what Stuart was going after a compelling argument. In Enterprise Integration Patterns (again, I think one of the best books on service orientation on the planet today), they talk about three distinct message patterns, command, event, and document. I get the impression that what Stuart believes is necessary and sufficient is the command message, but I tend to buy into the notion that there are different reasons for different types of messages.

To me, a document-oriented approach has a number of tasty attributes, architecturally speaking. First, the conversational state accumulates and gets carried along as the document grows from message to message. This, of course, allows for fewer stateful operation, and statefulness often has a correlation to scalability. Allowing the data to float around in the overall workflow, and split and merge, will let you develop interesting peer-peer architectures. Second, the notion of the document is relevant in the sense that we as people think of documents as legally binding, and that can help provide guidance on what goes into the document. The information that you pass between services is the stuff that all of the services participating in the workflow at the same level can see. This forms a canonical, shared schema between the parties - a mini (gulp) ontology of sorts. [Don't say the 'O' word. It's not PC] The validation requirements change over time, and so something like schematron phases can be pretty powerful, especially because it is extremely simple and leverages xpath, allowing for a flexible in memory processing model. It also has detractors, like the conversation getting fatter and fatter with time.

This type of approach has been useful in the entity aggregation work I have been a part of at my client. They don't know it yet, but the new and improved version is going to be schematron just above the wire, and then shove the xml straight into database. Nothing else in the middle. This is pretty different for me, because I have been involved primarily in OLTP systems or operational data stores as web interfaces to legacy systems, and I haven't really dealt much with data warehousing, but in the sense that we're aggregating entities from lines of business and we absolutely don't want to understand all of the business "logic," having an object model in the middle just doesn't make much sense, but the validation does. XML Schema as it exists in .NET today definitely doesn't cut it. The validation error messages tend to not be useful, and so we have to do some level of home grown validation. The simplest thing was to have boolean xpath assertions and associated validation error messages, and the implementation started looking a lot like a trivial schematron, e.g. pattern down, or maybe even just rule down.

It's been a pretty good day of talks so far.

(I modified this entry slightly to fix some grammatical problems that were highlighted elsewhere. Oops. Gracias.)

XmlDevCon - Blair Schneider McKay

EDI 2 XML

I ain't typing this one, so feel free to see the slides Slides

XmlDevCon - Neetu Pajpal

Xml in vs2k5

paranthetical: I used to work with a lady (though it seems strange to call her 'lady", not in a "she's so not a lady" sense, but more in a "that seems far too formal" sense) named Aradhana who named her baby girl "Neetu." I wonder how common that name is in [presumably] Indian families.
Hi, Aradhana.

new features in system.xml

v1 design goals: standards compliance, extensibility, ado.net integration
v2. usability, performance, improved schema support, security, sql 2005 integration (xml datatype)

v1 stack
xml reader/writer

v2 i/o scenarios
- typed accessors
- static create methods
- pipelining and layering (nice, good, about time)
- security - preventing DOS and unauthorized access

Writing - typed, untyped
wellformedness checking

Tim Bray "Can you ask for canonical output?"
[Thinking...] "Um, No."
Tim Bray "That would be nice"

ReadSubTree()
ReadToFollowing(string name)
ReadToDescendant(string name)
ReadToNextSibling(string name)
(xpath 1.0)

Does a v1 vs. v2 demo of parsing an xml doc. Walking doms makes me want to run back to sweet, sweet xpath. This whole demo should be the moral equiv of sum( (foreach ./PurchaseOrder/Items/Item return (./quantity * ./price) as totalprice) )

Fraser ?: "Are the new functions Namespace-aware?" - They functions are overloaded to take a reader and a writer.

Sam Ruby reminds me of psteph (sort of). He reminds me of someone else whose face I cannot pin in memory right now.

XmlSchemaSet and Inference

Paul Dougherty: "Can you specify relaxed or restricted?"

Don Box "If I have a bunch of instance docs in a file ala Sam Ruby/Tim Bray, can I infer a schema?"
Neetu: "Yes"
Don Box "What does the schema look like"
Neetu: "It would be verbose"

v1 - can't validate XmlDocument - the squish to string, validate pattern
v2 can.

Compiled XSLT in 2.0 is 4x faster - generates bytecode ala Reflection.Emit

XSLT 2.0/XPath 2.0 support? MS is sticking with 1.0 - No plans for XSLT 2.0 at this point.

Don asks for show of hands "XSLT 2.0 or XQuery [1.0]?" Results about 1/3 xslt, 1/3 xquery, 1/3 pussy.

In situ wellformedness checking and guidance w/ the xml editor. Also throws problems into the todo list

Red squigglies are wellformedness, blue are schema validation. Also have a go to definition context menu option for assoc. schemas, as well as tooltips.

F<long>a</long>ncy-Schm<long>a</long>ncy, as we say in Texas.

Don "UPA in action. Let's see your relax NG tools do that, Tim"

Can't do multiple document schema inference in the UI.

Can you turn off red and blue squiggly lines? Yes.

Interruption about changes to XML Serialization.. yes, big changes. Fielded by dbox, douglasp. Poke fun at Tim E along the way.
Tim Bray asks about canonicalization, falls on deaf ears (due to the adjacent mouths moving at the time).

OK, back to this talk.

Demos XSLT debugging - pretty cool. I ask "can you watch xpath expressions or does it have to be a variable?" Beta 1 no, Beta 2 yes.
Can you edit and continue? No
Are there any hooks into the debugger? [missed the answer]
Why this versus Sonic Studio or oxygen? Well, first it is free.

Do we have an xpath editor? Not for 2005, but later...

Will the editor help me in developing wsdl -

yukon still has a limited set of xquery for querying against xml data.

XmlDevCon - Jeff Barr

Amazon Web Services

Entrepeneurship blah blah blah

Most of this is available via Jeff's blog

Used to work at MS on the VS team.
Amazon 42 million active customer accounts. 7 different countries.

Technology provider, 700K 3rd party sellers
65K amazon web service developers
large associates network

aws- amazon web services product line
ecs - amazon e-commerce service
asin - standard item number

[obligatory sub slides]

'what is a web service' slide

web services let us build "programmable web sites"

decouple data and presentations

creation of a platform to attract software developers
unlock creativity
leverage tech investment

possible for the average developer to control amazon's huge infrastructure to MAKE $$$...
Services provide
product info
seller info
customer created content
shopping cart
etc

Rory asks "When I first looked at this, there were limits to, e.g. the number of comments I could get back. Has this changed?"

Jeff: "... Yes ..."

"If you think what we've done so far is cool, stay tuned."

Spring 2002 - first aws beta
July 2002 - soap and rest service, sdk, basic merchandising [think minimal marketable features]
November 2002 - amazon marketplace support
Quick click support
April 2003 - v3 Seller apis, remote shopping cart, UK site support
July 2003 - Germany and Japan, customized checkout
Spring 2004 - 50K dev
Oct 2004 - ECS 4.0 (no 1, 2, or 3, though)
AWIS 1.0 Beta - alexa web service
Browse Node api - FIRST public announcement of this feature, according to Jeff

Why AWS? Partners want data!!

The screen scrapers were putting a lot of load on the site, and every time the site changed, they broke. [I used that that performance sell in the past - Seems obvious now, but I had to sell it then -- I will try to type it up later]

[slide of marketecture of amazon]
mentions another "you heard it first here" service - the management service

fork off requests in parallel to a host of services, in the best case, all of the services return

SLAs aren't as important in this model, retries may be necessary.

A single url can make a query, take the xml, and style it into a web page.

ECS Data Types and Functions

Based on customer browse and purchase behavior - similarity lookup
Customer content lookup by email address - in the nominal case, no more than you would get on the web page

Segmented data into response groups

multi-operations and batch operations

self describing help

echo back http headers (useful for debugging)

Shows some demos:

Multi-dimensional computer search - Cool MD search with an almost treemap like display with popup display
wwwinkazon - select text on a page and do an amazon search -- Todd, you'd probably like this, think gurunet

some sellers use amazon's pricing & seller info and build algorithms to try to ensure they are on the first page

my pluck - pearches (persistent searches) "Submarines, the official underwater vehicle of the conference"

will create persistent searches and will track individual request differences for the same search to let you know when the results change

Musicplasma - search for any band that we like - flash application written by some french guys (not "natural cut" guys)

cool similarity graph of music (kind of hyperbolic, though I am sure it doesn't violate and Xerox PARC patents :)

Alexa AWIS 1.0 highlights
- access to 100TB of Alexa crawl data
- 4 Billion pages - adding (gulp) 16B more

links pointing in, links pointing out

url info - contact info, physical address, site load speed, adult content flag, etc, etc.

I wonder whether casey chesnut will train his spider to use awis adult content flag (the perv)

10,000/day per subscription

a9.com - aggregate web services from amazon, imdb, google, gurunet, etc.

Management Service: returns information about other service (meta meta !)
Can get my call stats for individual service calls

browse node api
give browse node id, uses the amazon taxonomy

Developer Site has a "scratch pad" that you can try out.

0525e2pq81dd72twt - first part of Jeff's developer subscription id... heh.

amazon marketplace seller - find books at cheap prices and sell them on amazon

scoutpal.com - barcode scanner on a phone, and will tell whether the book is worth buying or not it is a good book scout book scout

Ted Neward was stuck with bad weather in LA -- TimE - There's weather in LA? - so no last talk

XmlDevCon - NSSOC

Lunch was !Pan Asian Cuisine!

Sat with several people, Chris Anderson (mr. avalon), Adam Kinney of Xamlon, and a few others whose names I did not get. Chatted a bit about XAML, CSS, data driven UIs. I mentioned my thoughts on Don's use of his presentation format, and he mentioned that he had read that on my blog (gulp), which made me second guess somewhat my enforcing my thinking-out-loud policy of minimal abridgement of thought. I'll leave it at that. Anyway, Douglasp mentioned that today is his birthday, to a rousing "Happy Birthday" sing-a-long. Yesterday was my birthday, in case you were wondering. 33. (also in case you were wondering).

Also, ChrisAn mentioned Beyond Bullets, a ppt and presentation focused site, for those who are interested in presenting.