An Excellent Post About JQuery Selectors and ASP.NET

I had to share this blog post by Dave Ward about optimizing performance when trying to get jQuery to select the correct element as you work with ASP.NET.

I'm So Excited (and I just can't hide it)

I'm one of a handful of people trying to launch a code camp in the Burlington, VT area. We just received confirmation on the venue and can now start asking people to hold the date. It's going to be on Saturday, Sept. 12, at the UVM Business School.

There's still a lot of work to make it happen but I can't tell you how thrilled I am that we have a venue and date.

Small reminder for JavaScript development

Sometimes we need reminders about the basics. In reviewing some JavaScript code this morning I came across a function that builds some html on the fly by concatenating values together. What people have to remember is the smaller the JS file is the faster it will download. So rather than doing this:

scratch = scratch + "<a href....";

you need to use the built in += operator, thusly:

scratch += "<a href....";

The function in question had the first approach 12 times. Using the built in += operator I was able to reduce each statement by 9 characters. That reduces the function by 108 characters overall.

So the lesson is use built in functionality because little things can add up.

Notes from the New England User Group Leadership Summit

This past Saturday I had the opportunity to attend the 2009 New England User Group Leadership Summit. Hosted by Microsoft and O'Reilly Media it was an event dedicated to helping user group leaders connect, share ideas and experiences. It had nothing to do with the technologies these folks are usually discussing. Rather, we spent time talking about how to build community, publicize events, manage event logistics and things of that nature. Attendees came from all over the northeast - primarily New England but there were also folks from Pennsylvania and New York (which is not part of New England for you folks who don't know better).

The summit was held at the Microsoft New England Research and Development Center (a.k.a. the N.E.R.D. center) in Cambridge, MA. This was a really groovy facility with excellent meeting spaces.

A wiki was set up for all the session notes, available at http://neugsummit2009.pbworks.com/FrontPage/ Take a look. Even if you're not involved in a technical user group many of the topics relate to any community group. I was commenting to Chris Bowen that one reason I was really happy to have attended was in addition to what I learned which I will be able to apply to my involvement in the VT.NET user group much of what we discussed applies to my other community involvement, the Burlington Irish Heritage Festival.

One of the attendees, Rachel Ford James, took lots of photos and has made them available on Flickr. She really took some stunning photos that captured the spirit of the day. As you view the photos you may wonder why there are a number of shots with mixers that appear to be smoking. There was a break between sessions which was conducted as a team building exercise where groups of attendees selected ingredients for an impromtu ice cream flavor. The ice cream was made using mixers and liquid nitrogen. It was great entertainment with lots of noise, visuals and (of course) taste. Being from the land of Ben & Jerry's, though, I was terribly jaded about the results.

Many thanks to O'Reilly and Microsoft for hosting this event.

I don't know what it's called, but I like it

I've recently started using JetBrains' Resharper. Today I was reviewing the code inspection rules and came across a few that had to do with using an operator with which I was unfamiliar. So I took a moment to learn about the ?? operator (link) which must have come out with the .NET 2.0 framework because it has to do with nullable types.

What it does is kind of like the old IsNull method from VB (you remember VB don't you?). Here's an example in two lines:

int? x = null;

int y = (null != x) ? x : -1;

The first line declares a nullable int variable named x which is assigned null.
The second line declares a non-nullable int variable named y. Because it's not nullable we've got to ensure a null value isn't being assigned (otherwise we'll raise an exception). To do this we're using the ternary operator. What the ?? operator does is allow us to write the second line like this:

int y = x ?? -1;

So if x is null y is set to -1. Nice, right? Especially if you replace x and y with more meaningful variable names, such as this:

int? someMeaningfulName = null;

int whatYouReallyWant = someMeaningfulName ?? -1;

Or, more common in my current job, getting values from a web form or querystring:

int desiredFormId = 0;

if (null != Request.Form["Activate_FormId"]) {
desiredFormId = Request.Form["Activate_FormId"];
}

can become:

int desiredFormId = Request.Form["Activate_FormId"] ?? 0;

Now if I could just figure out how to pronouce this operator I can tell people about it.

Mitigating web.config security vulnerabilities through scripting

After reading this post, .Net and Business Intelligence: Application Security Vulnerabilities in Web.config File, what occurred to me was all this could be mitigated by employing a strategy I refer to as composition scripting.

While I've done a bit with build automation I've also created NAnt scripts that I refer to as composition scripts. The purpose of a composition script is to automate all the tasks required to prepare an application for deployment. I've used them to create ClickOnce deployments, but for web applications a composition script generally grabs all the pages and binaries needed. But in addition to that, and this is the relevant bit, I make use of the XmlPeek and XmlPoke tasks to swap out web.config tags to use configuration values appropriate for the environment being composed.

You see, my script accepts a parameter called Target.Environment. The acceptable values for that parameter are QA, UAT, PROD - quality assurance, user acceptance testing and production, respectively. (Where's development, you may ask? Well, that's the default state of the web.config in the source code repository). Along side the web.config I have a few files named web.config.qa, web.config.uat and web.config.prod. These are not repeats of the entire web.config file, though, but rather are the configuration values that need to change from environment to environment. These are the values swapped into the config using XmlPeek and XmlPoke.

Note: I believe a composition script should not recompile the application. It should compose the application deployment using the same pages and binaries as the application progresses from QA testing to UA testing and into production. This ensures the application being deployed is the same application which underwent testing.

So using composition scripts it's easy to mitigate the 10 security risks identified in the article.

Note to self... always read the instructions

I'm in the process of setting up a build machine at work. I firmly believe any shop doing production code with multiple developers needs to have both a source code repository (I like Subversion) and a build machine (sometimes called an integration server). I'm setting our build machine up to use CruiseControl.NET for our integration server. I used it at my last place, it's free and I like it. Since I'm the one doing the set up I get to decide.

It's good to be the king.

Anyway, I didn't install the OS, framework and all that on this box so was getting frustrated that I couldn't get the CC.NET web dashboard working. Turns out if I only read the FAQ I would have seen the first item talks about what to do if IIS gets installed after the .NET framework. Running the aspnet_regiis.exe as that document suggests fixed my problem. That's an hour or so of my life I would like back.

RTFM, indeed.