Notes from the New England User Group Leadership Summit

This past Saturday I had the opportunity to attend the 2009 New England User Group Leadership Summit. Hosted by Microsoft and O'Reilly Media it was an event dedicated to helping user group leaders connect, share ideas and experiences. It had nothing to do with the technologies these folks are usually discussing. Rather, we spent time talking about how to build community, publicize events, manage event logistics and things of that nature. Attendees came from all over the northeast - primarily New England but there were also folks from Pennsylvania and New York (which is not part of New England for you folks who don't know better).

The summit was held at the Microsoft New England Research and Development Center (a.k.a. the N.E.R.D. center) in Cambridge, MA. This was a really groovy facility with excellent meeting spaces.

A wiki was set up for all the session notes, available at http://neugsummit2009.pbworks.com/FrontPage/ Take a look. Even if you're not involved in a technical user group many of the topics relate to any community group. I was commenting to Chris Bowen that one reason I was really happy to have attended was in addition to what I learned which I will be able to apply to my involvement in the VT.NET user group much of what we discussed applies to my other community involvement, the Burlington Irish Heritage Festival.

One of the attendees, Rachel Ford James, took lots of photos and has made them available on Flickr. She really took some stunning photos that captured the spirit of the day. As you view the photos you may wonder why there are a number of shots with mixers that appear to be smoking. There was a break between sessions which was conducted as a team building exercise where groups of attendees selected ingredients for an impromtu ice cream flavor. The ice cream was made using mixers and liquid nitrogen. It was great entertainment with lots of noise, visuals and (of course) taste. Being from the land of Ben & Jerry's, though, I was terribly jaded about the results.

Many thanks to O'Reilly and Microsoft for hosting this event.

I don't know what it's called, but I like it

I've recently started using JetBrains' Resharper. Today I was reviewing the code inspection rules and came across a few that had to do with using an operator with which I was unfamiliar. So I took a moment to learn about the ?? operator (link) which must have come out with the .NET 2.0 framework because it has to do with nullable types.

What it does is kind of like the old IsNull method from VB (you remember VB don't you?). Here's an example in two lines:

int? x = null;

int y = (null != x) ? x : -1;

The first line declares a nullable int variable named x which is assigned null.
The second line declares a non-nullable int variable named y. Because it's not nullable we've got to ensure a null value isn't being assigned (otherwise we'll raise an exception). To do this we're using the ternary operator. What the ?? operator does is allow us to write the second line like this:

int y = x ?? -1;

So if x is null y is set to -1. Nice, right? Especially if you replace x and y with more meaningful variable names, such as this:

int? someMeaningfulName = null;

int whatYouReallyWant = someMeaningfulName ?? -1;

Or, more common in my current job, getting values from a web form or querystring:

int desiredFormId = 0;

if (null != Request.Form["Activate_FormId"]) {
desiredFormId = Request.Form["Activate_FormId"];
}

can become:

int desiredFormId = Request.Form["Activate_FormId"] ?? 0;

Now if I could just figure out how to pronouce this operator I can tell people about it.

Mitigating web.config security vulnerabilities through scripting

After reading this post, .Net and Business Intelligence: Application Security Vulnerabilities in Web.config File, what occurred to me was all this could be mitigated by employing a strategy I refer to as composition scripting.

While I've done a bit with build automation I've also created NAnt scripts that I refer to as composition scripts. The purpose of a composition script is to automate all the tasks required to prepare an application for deployment. I've used them to create ClickOnce deployments, but for web applications a composition script generally grabs all the pages and binaries needed. But in addition to that, and this is the relevant bit, I make use of the XmlPeek and XmlPoke tasks to swap out web.config tags to use configuration values appropriate for the environment being composed.

You see, my script accepts a parameter called Target.Environment. The acceptable values for that parameter are QA, UAT, PROD - quality assurance, user acceptance testing and production, respectively. (Where's development, you may ask? Well, that's the default state of the web.config in the source code repository). Along side the web.config I have a few files named web.config.qa, web.config.uat and web.config.prod. These are not repeats of the entire web.config file, though, but rather are the configuration values that need to change from environment to environment. These are the values swapped into the config using XmlPeek and XmlPoke.

Note: I believe a composition script should not recompile the application. It should compose the application deployment using the same pages and binaries as the application progresses from QA testing to UA testing and into production. This ensures the application being deployed is the same application which underwent testing.

So using composition scripts it's easy to mitigate the 10 security risks identified in the article.

Note to self... always read the instructions

I'm in the process of setting up a build machine at work. I firmly believe any shop doing production code with multiple developers needs to have both a source code repository (I like Subversion) and a build machine (sometimes called an integration server). I'm setting our build machine up to use CruiseControl.NET for our integration server. I used it at my last place, it's free and I like it. Since I'm the one doing the set up I get to decide.

It's good to be the king.

Anyway, I didn't install the OS, framework and all that on this box so was getting frustrated that I couldn't get the CC.NET web dashboard working. Turns out if I only read the FAQ I would have seen the first item talks about what to do if IIS gets installed after the .NET framework. Running the aspnet_regiis.exe as that document suggests fixed my problem. That's an hour or so of my life I would like back.

RTFM, indeed.

Ada Lovelace Day: Julie Lerman

Apparently today is Ada Lovelace Day (more information here). It's an opportunity for bloggers to write about women in technology who have inspired us. That makes this the perfect time to write a few sentences about one of the programmers who has been an inspiration and friend for around 5 years now - Julie Lerman.

I originally met Julie because she runs our local .NET user group. She works tirelessly for this group. She ensures the meetings are scheduled, maintains the web site, arranges for speakers, getting little gifts for them and presents her own topics when speakers are hard to come by.

Her technical skills, energy and humor are wonderful. But that's not why I wanted to write about her on this day.

It is Julie's dedication to community which is inspiring. She continually works to foster a real sense of community among the people who attend the user group. There's the usual call for people to raise their hands if they are looking for work or looking to hire (what I call the "Love Connection" portion of the meeting). She encourages people to get up and do their own presentations - both at our meetings but also at regional code camps (we don't have a local one... yet). At our last meeting she took a moment to lead a discussion to brainstorm how we as members of the same community (professional and regional) might support one another in this period of economic uncertainty. Julie is sure to introduce you to people "you've got to meet."

Julie's dedication to community transcends our small state, by the way. She travels the world speaking at conferences and user groups. She participates on "women in technology" panels (perhaps inspiring an upcoming Ada Lovelace). She blogs and has written a book. Julie is one of those people that wants to see others succeed and will do a lot to try and help.

She's a true leader and an inspiration.

Debugging tips from the MSDN Roadshow

Yesterday I attended the VT leg of the MSDN Roadshow. While I was unable to stay for all the presentations I picked up some good tips during Jim O'Neil's overview of debugging with Visual Studio 2008 (with a preview of VS2010 debugging). As is my habit, I'm putting my notes from the session here so I don't lose them and so others might benefit from them.

But if you write bug free code you can stop reading here.

One thing that used to bother me was that if I had a line of code that chained or nested several method calls I would have to step into/out of all the methods until I got into the one I wanted. Apparently Visual Studio supports the ability to step into a specific function. I saw Jim do it yesterday, I can see the web sites describe it, but I can't find it in my environment. So it's something to research.

There is another thing I saw and can read about but can't find in my environment. Apparently there is a setting under Tools | Options | Debugging which allows you to step over property and operator calls by default. Again, something to research.

One thing I do see in my environment, and which I believe I can find use for, is the HitCount property of breakpoints. The breakpoint window displays this property for each breakpoint and should prove useful when trying to identify which iteration within a loop is causing a problem (for example).

Finally, Jim reminded me of the DebuggerDisplay attribute that we can use to decorate our classes to make them more user friendly in the debugger. Here's one overview of that attribute and another from Scott Hanselman.

Love the free training...

I don't care what they say... 6 != 4

When writing a SQL query today (against SQL Server 2005) I came to realize I can't trust the len function. Well, ok, I can trust it but not if the value being evaluated has trailing white space. Take this code:

Declare @value char(10)
Set @value = ' 123  '
Print Len( @value)

Notice I set @value to ' 123 ', that's [space][1][2][3][space][space]. Now even if I count like my 6 year old that's 6 characters. But what does the code above say? 4. Four?!?!? Lies!!!

And it lies to me if I declare @value as char, nchar, varchar and nvarchar data type. I can see varchar because it's a variable length data type. However char is a fixed length data type so I was expecting either a length of 6 (I did, after all, assign a string literal with 6 characters) or 10 because @value was declared as a char(10).

So I don't know what to believe anymore.