First Look at Shared View

Currently Microsoft's Shared View is free. So if you use Webex or a similar desktop sharing software you should consider Shared View.

But it is not cost that will drive Shared Views success, rather it is the simple and viral way it works and spreads.

Starting with a user with a Microsoft Live account, the user can do a click once install from the web:
http://www.connect.microsoft.com/content/content.aspx?SiteID=94&ContentID=6415

Then after logging in with their Live account they can create a sharing session. A simple way is provided to invite other users. Your email client is invoked with the invitation text, including link to session, already populated. You simply type in the email address.

When the invited party clicks on the link, the shared view comes up if they have it installed. Or if they do not have the Shared View installed, the web page for the click once install is brought up. Microsoft has really nailed the quick once install, it is quick and simple. After the install the shared session is launched.

At this point the original user approve the invitee and the session continues. The controls are both simple and intuitive.

What is interesting is the viral nature of Shared View. The only requirement is the coordinator of a sharing session must have a Microsoft Live ID. All other users will download the software, which is similiar to the Webex experience. This then puts them in the postion of hosting Shared View sessions. Simple, Easy, Viral.

Why Greenfield Development Is Not The Solution To Your Brownfield

Facing a Brownfield project, the obvious solution is to start over. As a general rule this does not work. Which does not mean it cannot work in isolated instances.

Consider those Brownfield projects that are so bad you or your client are willing to abandon everything and start over and do it all again. There must be multiple problems in the Brownfield. These problems have probably reached an unworkable state. Working on one problem creates other problems. One problem prevents working on another problem. Perhaps the source code for a COM component has gone missing. (I do not know what it is about COM but since it's widespread use, every company seems to have a COM component with missing source). Or perhaps knowledge of the inner workings of the system is missing. Perhaps the original perpetrators of the code have fled the scene of the crime.

So the motivation for fixing the Brownfield is the ability to fix the multiple problems. This is also why the Greenfield approach will fail. You have a mandate to fix everything in the Brownfield. But this is too much to be attempted at once.

It is not that you can not fix each of the problems in isolation. It is the combination of problems makes it exponentially more difficult. If lack of knowledge (like missing source code or fled perpetrators) is added to the mix, you will be flying blind. You may think you know what the component is supposed to do but there is tribal knowledge embedded in the source code.

But lets suppose you have jumped off and started the Greenfield to fix your Brownfield. As you solve the problems, the solutions will start to compete with each other and to a certain extent some hard trade offs will emerge. Some of these trade offs are what caused the original nest of problems in the original Brownfield. Thus the Greenfield becomes a Brownfield.

So it then becomes a race. Can you get all of the features implemented in the new Brownfield before being overwhelmed by the toxins being created.

Metropolis Is The Future Of Work

For those who have not seen Metropolis, work in the future is presented as an individual standing in front of a dial and moving two hands to connect the dots indicated by blinking lights. This appears laughable these days as we can clearly see that we would build a machine to automate even that task.

But consider the "Games With A Purpose" movement. A typical game puts two humans in competition to categorize something, like an image of a puppy. At this time, we cannot devise a program that will reliably label images in a way that humans would find useful. So by turning this into a game we can extract these labels as byproduct of humans playing the game.

This dynamic has a precedent, hackers have set up adult themed sites where access is gained by solving CAPTCHA logins. The CAPTCHA logins are used on sites which are trying to prevent automated access.

In both cases the thing which only the human can do is extracted and presented in isolation. All the other work has been automated. It is important to point out that in both cases there is "pay", in the one it is access to a game, in the other it is the adult material.

Now as to Metropolis, of course they got the minor detail wrong, which is the clock dial and the moving of the two arms in response to blinking lights. But as a metaphor it is dead on. Labeling images disembodied from their context. Solving CAPTCHA. The work is dull and lifeless. But what Metropolis tried to capture, it is work that requires the essential human.

Prerequisite Package Location In Visual Studio

In order to use Prerequisite Packages in Visual Studio you must place them in the appropriate Bootstrapper directory.

For Visual Studio 2008 on 32 bit:

%PROGRAMFILES%\Microsoft SDKs\Windows\v6.0A\Bootstrapper\Packages\

For Visual Studio 2008 on 64 bit:

%PROGRAMFILES(X86)%\Microsoft SDKs\Windows\v6.0A\Bootstrapper\Packages\

For Visual Studio 2005 on 32 bit:

%PROGRAMFILES%C:\Microsoft Visual Studio 8\SDK\v2.0\BootStrapper\Packages\

For Visual Studio 2008 on 64 bit:

%PROGRAMFILES(X86)%\Microsoft Visual Studio 8\SDK\v2.0\BootStrapper\Packages\

Buzzword: Greenfield Brownfield

It has become common to refer to new development projects as Greenfield. This obviously conjures images of an untouched patch of land with no previous work impeding progress.

Of late, a new term Brownfield  has become trendy to describe the rest of software development. Here there is the obvious contrast with Greenfield in the sense that the ground has been torn up and there is dirt and mud everywhere. But in addition, Brownfield had a prior meaning in commercial real estate. Brownfield referred to a property contaminated by one or more toxins.

In the case of software development, these toxins are prior decisions or implementations which have gone bad or never worked in the first place.

Device Emulator Manager and Internet Access

Device Emulator Manager and Internet Access

These steps were tested with:
"Pocket PC 2003 SE Emulator"
"USA Windows Mobile 5.0 Pocket PC R2 Square Emulator"

Launch "Device Emulator Manager"

1. Select Emulator From Tree control
2. Right click selection and select "Connect" from context menu
3. After Emulator Launches, Right click selection and select "Cradle"

On Emulator Window

1. Select from Menu: File->Configure…
2. Select Network Tab
3. On Network Tab, check box "Enable NE2000 PCMCIA network adapter..."
4. Click OK

On Window Menu of the mobile device

1. Select "Settings" from menu
2. Select "Connections" tab on Settings screen
3. Select "Connections" icon on "Connections" tab
4. Select "Advanced" tab
5. Select Networks
6. Select "My Work Network" from menu
7. Click "Edit" button below menu
8. Select "Proxy Settings" tab
9. Check box "This network connects to the Internet"
10. Exit all screens and menus with "ok" in upper right corner
11. Browse to google.com

Fixing: Virtual PC 2007 error "Reboot and Select..."

Description: When creating a virtual machine using Virtual PC 2007, the following error occurs on the first use:

"Reboot and Select proper Boot device or Insert Boot Media in selected Boot Device"

Solution: The root problem is the hard drive has been created as an empty hard drive, as such it has no operation system. So you will need to install the OS.

Hail The Reference Implementation, Slayer Of Gurus

If you work in software development, gurus with silver bullet suggestions are around every corner. In a previous post, I mentioned how effectively, asking for a Reference Implementation can resolve the angst caused by these suggestions.

While I did not connect the dots at the time, I experienced this effect first hand in a prior project. I was in a liason role and there was an all powerful consultant (APC) from venerated Vendor (Microsoft, not that it matters all vendors do this). No matter what the problem was the APC always had that combination of Vendor silver bullets would fix the problem.

The scary side of the equation was no one knew what he was talking about and we were not sure if he was brilliant or just making stuff up. At one point, he had convinced us that a critical problem with one part of the Vendors stack could be resolved be a particular combination of silver bullets in other Vendor items.

At the following meeting with my consulting company, I brought up a particular silver bullet festooned boondogle and asked what should I do. Fortunately there was an older and wiser consultant advising us and he said, "Just ask for a simple reference project showing the ideas implemented". This I did.

For a while I waited eagerly for the demo. When it never came, I realized I could ignore the suggestion and what was better, I have been using this management trick ever since.

Buzzword: Hatless

When talking about security there are two well worn buzzwords.

The White Hat is the good guy. He is the security guy who works for the company or it is used to refer to an ethical hacker. He pursues security exploits in order to make systems more secure.

The Black Hat is the evil hacker. Since both can and do use the same practices the terms white and black hat arose.

Now what about the rest of us? We are just the Hatless. (You can say it with the same emphasis you would give to "the great unwashed", only it is shorter.)

Needless to say in the battle between the Hats, white and black, we the Hatless are often the victims.

CORBA Shot To Death With Silver Bullets

The current "Communications of ACM" (2008 08) has two articles that combined are greater than their parts.

In "Software Development Amidst the Whiz of Silver Bullets", Alex Bell explains how we must be ever vigilant against silver bullet solutions. While it is not in the article, I can almost here a paraphrased common wisdom, "if the silver bullet worked, it would be the standard practice."

In "The Rise and Fall of CORBA", Michi Henning provides the Post Mortem Analysis of the CORBA effort. There is a nice auditory illusion that takes place if you read "...Whiz of Silver Bullets" right before reading "...Fall of CORBA", as Henning details the effect of too many specifications, contradictory specifications and unimplementable specifications, you hear the silver bullets whiz followed by the dull thud as they hit and kill developers and companies.

But there is more, Henning provides critical lessons learned. A good Post Mortem is interested in placing blame only to the extent that it allows for the illumination of what could be done to avoid the failure. In the case of the multiple contradictory and perhaps dubious specification one recommendation rings out "PROVIDE A REFERENCE IMPLEMENTATION".

Once again Waterfall and BDUF (Big Design Up Front) take a hit. In the CORBA project, specifications could be approved without anyone having to provide a reference implementation. That is classic Waterfall, all the design at the beginning and no feedback from the experience of having to implement the initial design.

Now if you go back to the first article "...Whiz of Silver Bullets", you have a new tool for dealing with the next silver bullet that is proposed at your company. Simply ask for a Reference Implementation. Often that silver bullet will show it's warts as soon as you get past the boilerplate code.

Donald Knuth Dams Waterfall

Quoting from an interview in "Communications of the ACM" 2008 08 with Donald Knuth:

The setup is Donald had written a complete spec and assigned it to bright students and then did nothing to manage them as they implemented the spec.

"To my amazement, the students, who were outstanding students, did not complete it."

Only later when he tried to implement it, did he find that it was not so easy.

"Because going from my specification, which I thought was complete, they had an impossible task..."

He later goes on to point out that even with the most complete of specifications, questions arise every 5 minutes as you write code.

In effect, his approach was waterfall with a Big Design Upfront. What he found was a cornerstone of Agile practices, you need to implement a portion of the project and then you will learn enough to start asking questions.

Fixing: An error occurred while validating. HRESULT = '80004005'

Fixing: An error occurred while validating. HRESULT = '80004005'

The error was encountered when attempting to build a 'vdproj' setup project under Visual Studio 2008.
The underlying problem was a project with a reference to another project that had been removed.
As such the setup could not find the dependency to include in the setup package.

This was fixed by removing the bogus project reference and adding the correct reference.

Database Deployment Challenge

Getting a database deployed consists of numerous challenges.


One issue is simply getting the database engine deployed and configured. One might add purchasing to the list as well as getting a licensed copy can be challenging in some companies. An obvious workaround is to use an existing database engine. The Registry serves as an excellent database for configuration information. The Event Logging system of windows is an excellent database for logging. Another common workaround is to use flat text files or xml files. You will still need a database engine, it just may not be apparent because you will be writing it in your program.

The next issue is getting the initial database schema in place. With a traditional engine like SQL Server this is challenging. The best solution is to use DataDude (also known at Microsoft Team System For Database Professionals). In the case of using built in engines like the Registry and Event Logging system the schema is in part dictated by the system and in part created as part of your install. The current setup project that Visual Studio creates makes Registry and Event Logging easy to maintain. In the case of flat text files or xml files, the schema is part of the file. Again the unseen trade off is you will be expending some effort in your code enforcing the schema.

The final deployment issue is getting the initial data in place. If you are not using the DataDude by now, you will find your database deployment has reared up and become a project unto itself. In the case of the Registry and Event Logging the initial values are created at the same time as schema is installed. And in the case of the flat text files or xml files, it is part of the file.

When looking across these options, it is easy to see that the flat text files or xml files present the easy path. The downside will occur later when the data must be shared with other programs, or performance issues arise. So the hard thing to do, but the right thing from an architecture view, is to force configuration information to be stored in the Registry, logging must be stored in the Event Logging system. And for other data, a database engine must be deployed and used.

First Look At Cuil

Taking a quick First Look at the new search engine Cuil.

On the surface it would appear to return more results but when looking at quoted phrases it does something unexpected. Quite often Cuil fails to find the quoted phrase. This is disappointing because it is often the way I track down what some obscure cryptic error message means and how I should resolve it.

The increase in research results also does not hold up in searching for obscure terms. In fact for the obscure "Corpen Source" Cuil currently finds nothing. Google on the other hand finds plenty.

Quality of results is a little bit subjective but Cuil appears to have the edge here. Although it may just be the way Cuil presents the results in a panel fashion together with an image that may be the advantage. Either way, Cuil has marginally better results or a much improved layout.

Virtual Machine Sprawl

I've stopped using Virtual Machines because they are too useful. Kind of like Yogi saying of a restaurant, nobody goes there anymore because it is too crowded.

Actually I have just reached limit of the number of Virtual Machines I can track and have stopped creating and using additional virtual machines.

So Virtual Machines have crossed over the point where their own success is the problem. This problem has picked up the name Virtual Machine Sprawl. The sprawl problem creates four problems; space, providence, version control and restoration or setup speed.

Each virtual machine takes megs of space in the most compact form and in most cases after a few software installs they are up to gigs of space. I have found I need VMs for several OSes and for each OS I need a range of software installed and not installed and combinations in between. So before I know it I am up to 100s of gigs of space needed.

Providence refers to the prior history of the VM. Wear refers to this as the Genetic Makeup of the Virtual Machine. What is important here is not just what is installed but often the order it is installed. Every ASP.NET programmer is now familiar with the slight difference between installing IIS first then Visual Studio and installing Visual Studio first and then IIS.

Just like code there must be some mechanism for keeping original untouched copies of the machines. Unlike code, nearly everything you do with a virtual machine starts to change it. A primitive solution is to keep a directory full of copies. Unfortunately this instantly doubles the space requirements and there is nothing to prevent the machines being opened and thus spoiled.

Assuming you have found mechanism to track providence and another to track version you will still need to throw away your current copy and restore it from version control. As gigs are involved, the copying can take a chunk of time.

C++ Hard To Do Security Right Easy To Do Wrong

Whenever possible you should make it easy to do the right thing and hard to do the wrong thing.

From a security point of view C++ may be broken simply because this dynamic is not only missing but reversed.

Take the function "strcpy". It is part of the standard library because C++ lacks a string class and thus it is commonly used. This function comes to mind because I added a huge chunk of existing code to my project. The code base liberally used "strcpy". Now in the "hard to do wrong" fashion the compiler warned on dozens of these and other security obsolete functions.

The security based warnings indicated in good "easy to do right" fashion that one should use "strncpy". The problem is that it often hard to determine the size of string at compile time, which the "n" in "strncpy" requires.

So you can see my dilemma either I retrofit size checking code in all of this imported code or live with the numerous security warnings and the reality they represent in terms of security holes.

Two recommendations from the community raised more concerns than comfort. One was to disable the warning. One poster included the amusing joke that starts with "Doctor it hurts when I do this.." Another disturbing recommendation was to replace the function call to "strcpy" with a hand coded replacement that had the same Stack Overflow problem.

So the effect was the practitioners in this space did not do right and in fact did wrong. Why? Because the language C++ makes it easy to do wrong. In this case the direct memory access. This is because it is hard to do right due to the lack of a standard string class that manages the memory access.

XML Literals As Database

Deploying the database has bedeviled development.

Data store and Engine are both issues. MSDE and SQL Express both represented attempts at getting an engine and data store on the machine. They worked well but presence of other applications using MSDE or SQL Express could complicate the deployment.

Standalone XML files, which is common for configuration, is a viable way to solve deploying the data store. Dot Net Framework embraced this common problem and a common solution now involves shipping an XML file to server as the initial data store.

With the XML Literals now part of VB.NET a better solution is possible. And the defect of using a separate language may even serve a purpose. On the one hand the XML literals are nothing more than the equivalent of the standalone files. But since they will be compiled into the executable and this will both create and hide access components the result will be faster and more reliable.

As to the language issue, this feature is only available in VB.Net. So to use this strategy from C# you would need to have a separate executable to house the VB.Net assembly dedicated to the XML Literal. But you could look at this defect as a feature in that it would encourage the separation of concerns.

Does Security Make C++ Obsolete

Stephen Gould said every species is extinct, they just do not know it.

From a security point of view C++ may be obsolete and we just do not know it yet. Increasing C++ is justified based on performance factors and legacy code. The performance increase that still remains is due primarily to the direct access to memory. This is when comparing to a language that handles memory management like Java or C# or VB.Net.

The security implications of direct memory access becomes apparent when examining lists of top security threats. At the top of the list are Buffer Overflows and Stack Overflows. Both are possible only because of direct memory access.

Since C# is memory managed except when you explicitly tell it not to be, you could say that it is "Secure By Default". This is in contrast to C++ which is "Unsecure By Default."

Testing for Endianess

A colleague is studying for a Microsoft Interview.
One of the questions is to write code to test for Endian.
The answer Microsoft likes involves bit twiddling, but one wonders why they would not prefer calling their own framework:
using System;


using System.Collections.Generic;

using System.Linq;

using System.Text;

namespace ConsoleApplication1

{
class Program
{
static void Main(string[] args)
{
Console.WriteLine("BitConverter.IsLittleEndian " + BitConverter.IsLittleEndian.ToString());
Console.ReadLine();
}
}
}

Five Things That Come First

In reading "Writing Secure Code" I was heartened to find the author state "Security is a top priority". The statement as whole is not surprising for the book but the use of "a" as in "a top priority" instead of "the" as in "the top priority" was the comforting part.

Reading Roger Session's blog on code complexity, Roger implies that complexity is more important than security. As in if the code is complex it can never be secured. So that would imply Complexity (or reducing it comes first).

The Test Driven Development movement preaches Test First. It should be noted, code is not testable by default. You will always need to do something to make it testable.

Any book on Scalable Architectures will tell you, you must design from the start for scalability. So add Scalability to the list of things to be done before anything else.

I myself have learned the hard way to do the install first. But having an installer does not guarantee that your software will be deployable. So but Deployable on the list as well.

Thus you end up with Five Things That Come First before you even write your first line of code.

Security
Scalability
Testable
Deployable
Complexity