Thanks to those user group members and Xero partners that came along to our talk today.

We covered the two vulnerabilities released last week, the workarounds, and the patches that were released this morning.

Here are the slides: KirkJackson-PaddingOracle.pdf (641.14 KB)

All ASP.NET applications are affected. The best thing to do is install the patches released this morning.

Problem & bulletins:

Security bulletin MS10-070

Useful info on ScottGu's blog

Forum about the security vulnerability

Video of a site exploit, even with the workarounds applied

Patch:

Scott Gu's writeup of the patch

Post-mortem of the patch - Marc Brooks

How to configure the new patched features

Research:

Juliano Rizzo and Thai Duong and their POET tool

Padbuster tool (including a great writeup of Padding Oracles)

Visual Studio 2010 will have better support for a multi-monitor setup, but it's possible to get part of the way in 2008 already.

Toolbars and property windows (e.g. Solution Explorer, Class View) can be dragged into separate windows (2010 will add the ability to drag documents into separate windows too):

Window positioning gets a bit weird when you switch from one monitor to another, or change resolutions - a common occurrence when you're a laptop user docking and un-docking.

You can create two settings files, one for your single monitor layout, and one for your multi-monitor layout, and use them when starting Visual Studio 2008:

1. Arrange your windows the way you like them
2. Go to Tools > Import and Export Settings > Export selected environment settings
3. You get a great tree-view of every possible setting category in Visual Studio. Click the top node to deselect everything, and scroll down and select only General Settings > Window Layouts:
   
4. Save your settings file somewhere handy (e.g. d:\multimon.vssettings)
5. Repeat for each layout you like

Now you have two or more settings files, you just need to create a shortcut icon for each one somewhere in your start menu.

Edit the target, and add the parameter /resetsettings D:\multimon.vssettings to the end (replace the path with each settings file path).

Now when you launch your new shortcut, it will start Visual Studio 2008 with the correct window layout. Because you only exported and imported the Window Layouts, all the other settings stay the same.

You may also want to make these changes to your shortcut:

• Add the /nosplash parameter to your Target, to avoid the "Visual Studio" splash screen and make it slightly faster to start (perception is everything!)
• Check the Run as administrator option, which is useful if you often need to restart Visual Studio to connect to the ASP.NET worker process when developing under IIS.

Cheers,

Kirk

Previous VS2008 Tips:

• Visual Studio Tips n Tricks (DEV313)
• Visual Studio - Copy references
• Turn off outlining / regions in Visual Studio
• Visual Studio 2008 tip of the day - relive the series
• Explore files from Visual Studio
• Snippet Designer released
• Ctrl + . -- Bring up that annoying smart tag menu
• Temporary Projects - You don't have to save them
• Christchurch - Visual Studio Tips'n'Tricks
• Visual Studio - Regedit your tab ordering and add a column guide

Code Camp is less than two weeks away!

If you want to catch some free sessions on the state-of-the-art in .NET development, SQL Server and developer security then sign up for Code Camp Auckland 2009 now.

Code Camps are non-profit, and organised by members of the local developer community. This year the Auckland Code Camp is the day before TechEd (Sunday 13 September), so we've managed to nab a few great speakers on their day off to present to us.

It's the biggest Code Camp ever - over 14 hours of sessions across 3 streams from 10am till 5pm:

Development...

• What's Happening in .NET Languages and Why Should You Care?
• .NET on the iPhone and Beyond
• Behaviour Driven Development
• Domain Specific Languages
• C# 4.0 new features
• Silverlight with Prism
• Becoming Certified
• Lightning Talks
• and more!

The latest and greatest in development topics, by the people that know!

SQL Server?

• SQL Server Virtualisation Best Practices and Recommendations
• SQL Server Analysis Services and Gemini
• Query Optimization and Query Tuning
• Understanding SQL Server Indexing
• SQL Server Maintenance

Training and guidance from the best SQL trainers in the industry!

Security!

• Secure Development Lifecycle and Threat Modelling workshop
• Secure Coding Practices

We are lucky to have Michael Howard, author of Writing Secure Code and 24 Deadly Sins of Software Security giving a free workshop for developers, architects and team leads on Threat Modelling and the Secure Development Lifecycle. This will be followed by a session on how to write secure .NET code.

Auckland has never seen such an awesome free event!

Presenters that are offering their time include Greg Low, Nicholas Dritsas and Auckland's Alex Henderson of Architecture Chat fame.

To cover the costs of the event, we have the help of our generous sponsors: Microsoft, Datacom, Intergen, INETA and Xero.

All that's left for you to do is to visit the website for more details, and sign up now!

See you there on Sunday 13 September,

Kirk

Today at the Wellington .NET User Group, Kevin presented a talk on "Windows Mobile 6.5 Widgets".

Kevin has kindly provided his slides and samples for download:

I found this interesting. I haven't developed any applications for Windows Mobile, though I have played around a bit with the emulator and deploying code from within Visual Studio.

Widgets seem like a lot simpler application development model than native or compact framework applications. The application development model is similar to Vista sidebar gadgets, as there is a packaged zip file containing the application inside - and the application is 'simply' Javascript and HTML. Widgets can use XHR or DOM manipulation, and have access to a small amount of local storage to store preference information.

Windows Mobile 6.5 treats widgets as first-class application citizens within the OS - they have icons on the revamped start screen, and appear in the uninstall screen. As far as the user knows, they are the same as a native application.

Where the process is currently let down is in deployment and debugging. Currently a widget can only be deployed through the Windows Mobile marketplace, after the developer has signed up and the application has been reviewed (I think!). Debugging from Visual Studio seems non-existent, meaning that development is through trial and error.

I could see an enterprising person (like Kevin) building a Javascript library that simulated the API provided by the widget infrastructure, so that widgets could be developed and tested on a desktop before being deployed on a device. Kevin, am I right that all that is needed is the Widget object and some fake ActiveX controls?

All up, an interesting session.

Cheers!

Kirk

Today I went to Nelson for lunch, and presented on Caching to the Nelson .NET User Group.

The talk was a repeat of my Wellington and Auckland talk from a few months ago, and covered various places you typically cache data in a .NET app, motivating the discussion of memcached and Velocity.

It was nice to get down to Nelson to briefly soak up the sun and meet a few new people.

View my previous post on Caching for further info.

Thanks for having me Daniel!

Kirk

When is it not safe to load an XML file into an XmlDocument object?

Any time the source is untrusted, it turns out:

Tom Hollander: Protecting against XML Entity Expansion attacks

That's one I haven't heard of before, and shows why every input from an untrusted source should be treated with care.

It reminds me of the zip expansion attacks that used to break mail servers 8 or so years ago:

Zip expansion attack. A large uniform file (for example 1 Gbyte of Zeros) is zipped and e-mail. AV or content filtering products attempt to unzip the attachment for checking, but are unable to do so because of lack of disc space. [ecommnet]

The old expanding file trick. What will they think of next?

Kirk

I presented a talk at the Wellington and Auckland .NET user groups this month titled "Best Practices -  Caching". The goal of the talk was to discuss why we might need to add caching to our applications, and the way that we typically add it to each layer:

• Client-side: reducing data flowing to the server, enable caching through expiry etc
• ASP.NET: stashing data; page-level, fragment, IIS caching
• Business layer: cache objects to avoid computation
• Data layer: cache raw data from the database; identity maps
• Database: reduce hits on disk

The difficult part when caching at any layer is invalidating the redundant data that is stored in the cache when the source data changes. It's easier depending on the type of the data:

• Reference - shared reads (e.g. Catalog)
• Easy to cache and distribute
• Activity - exclusive write (e.g. Cart)
• Can cache each user's data separately
• Resource - shared, concurrency read/write, large number of transactions (e.g. Auction bid)
• Caching is hard
• DB is best source of data, with careful caching

The second half of the talk we looked at two caching technologies - memcached and Velocity.

The presentation: Caching.pdf 

Some links:

• Microsoft Project code named Velocity
• Steve Souders - High performance web sites
• YSlow

Kirk

Jeff Moser writes How .NET Regular Expressions Really Work.

I've got a soft spot for regular expressions (programming Perl can do that to you), and while I understand backtracking and greedy / lazy matching, I've never actually read the source code for a regex library before.

If you haven't either, and want to benefit from someone else's description of the 14,000 lines of .NET regular expression library, you'll enjoy this post.

Kirk

I've got the afternoon off work this Wednesday 11 Feb, and am popping over to Nelson to present on web security (details below).

I hope to see you there!

Kirk

Daniel Ballinger wrote:
> Hi All,
>
> Kirk Jackson from the Wellington .NET user group will be in town on
> Wednesday the 11th of February and is giving a presentation.
>
> Title:
> Overcoming your web insecurity
>
> Abstract:

> As an ASP.NET developer, there are many things to think about while
> developing your web application. Come along to understand the
> fundamentals of developing a secure web application, and learn how to
> protect your site against the dangers of cross-site scripting, cross
> domain request forging and click-jacking.
>
> This session will be suitable for all levels of experience, and
> developers who use other web development platforms such as PHP or Java.
>

> Presenter:
> Kirk Jackson
>
> Useful links:
> http://pageofwords.com - Kirk's blog
>
> http://mscommunities.net.nz/ - The home of Microsoft communities in New Zealand
>
> When:
> Wednesday 11th February 2009
> Gather at 2:50 pm, starting at 3:00 pm.
>
> Approximately 1 hour 15 minutes plus pizza afterward.
>
> Where:
> FuseIT Ltd,
> Ground Floor,
> 7 Forests Rd,
> Stoke,
> Nelson
>
> (Off Nayland Rd and behind Carters)
> http://local.live.com/default.aspx?v=2&cp=-41.299774~173.236231&style=r&lvl=16&alt=-1000
> or
> http://maps.google.com/?ie=UTF8&om=1&z=17&ll=-41.299774,173.236231&spn=0.005239,0.010042&t=h
>
> If you are parking on site, please use the parks marked FuseIT that
> are at the back of the site.
>
> Giveaways:
> A single copy Microsoft Office 2007 Professional
>
> Catering: Pizza & Drinks
>
> Door Charge: Free
>
>
> RSVP to me if you are going to attend so I can guesstimate the food
> and drink requirements.
>
> However, feel free to turn up on the day though if you can't commit at
> the moment.
>
> Please feel free to invite anyone who may be interested in attending.
>
>
> Cheers,
> Daniel
>
> Daniel Ballinger
> Developer
> FuseIT ™

http://www.fishofprey.com/

Very cool. Mindscape have updated LightSpeed so that you can store your data in Amazon SimpleDB: What’s coming in 2009 from Mindscape?

Kirk

That trip turned out to be a bit of a whirlwind. Sorry I had to dash straight after the presentation!

The talk was an introduction to cross-site scripting (XSS), cross domain request forgery (CDRF) and clickjacking, and used a common theme of "never trust users" to show how trusting GET, POST, Cookies, Headers or other user supplied data could be your downfall.

I've already posted the slides to this talk from back when I presented at the Christchurch Code Camp: Overcoming your web insecurity

• Subscribe to my blog: http://pageofwords.com
• The Classifieds web site starter kit
• The Microsoft Anti-XSS Library (use instead of HttpUtility.Encode)
• Which ASP.NET Controls Automatically Encode?
• Clickjacking video
• Framebusting:
  http://pageofwords.com/blog/2008/10/06/FrameBustingInJavascript.aspx
• Security Runtime Engine (coming, will help with ASP.NET controls)
• OWASP – The Open Web Application Security Project – http://www.owasp.org

There's a new beta of the Anti-XSS library that you should check out when encoding your user-supplied data for use in HTML or attributes. At the same link is the new CAT.NET tool that analyses your code for weaknesses.

The Anti-XSS library now includes the Security Runtime Engine, which will help when encoding ASP.NET controls. I'll be posting about it here soon, so subscribe to my RSS feed :)

I had fun presenting on ASP.NET security tonight at the .NET Users Group. It was a bit of a whirlwind tour through some common security issues that you might come across when developing and deploying an ASP.NET application.

I've already posted the slides to this talk from back when I presented at the Christchurch Code Camp: Overcoming your web insecurity

Well that's good news: Server Core changes in Windows Server 2008 R2

Server Core will soon allow ASP.NET and PowerShell to be installed as options. They've partitioned the .NET framework and only install those parts that are needed (presumably to remove those parts that depend on the UI). I haven't seen any details, but I expect that things in the System.Drawing space may not be there either.

This is good news for people with a farm of web servers, and also for those that want better management of their server core installs.

Kirk

Hi,

Many thanks to those who came along to our PDC Fireworks session last night. I hope you had an interesting time hearing about what's coming on the horizon, and that your families enjoyed meeting your geek friends!
A huge thank you to our speakers who presented on such a wide range of topics in a limited time. If you want to find out more or watch any sessions from the PDC, you could visit the Channel 9 PDC site, or visit the blogs of the presenters:

• Chris Auld
• James Newton-King
• James Hippolite
• Mark Orange
• Chan Kulathilake
• Owen Evans
• Kirk Jackson

Also, a big thanks to those who helped set up and tidy up the room. Great job!

The .NET user group meets once or twice monthly, usually on the first and third Wednesday of the month. If you'd like to go on my mailing list for upcoming user group presentations, please email me.

If you're interested in the Wellington Sharepoint User Group, or the Wellington SQL User Group, make sure you follow the links to sign up to them.

Upcoming Sessions:

Wed 19 Nov, 6pm - Microsoft .NET Services with Chaks Chandran [.NET User Group]

Microsoft .Net Services is a part of the recently announced Microsoft Azure Platform. What does Microsoft .Net Services provide ?

Microsoft .Net Services consists of three main components:

1. Service Bus
2. Access Control
3. Workflow Services

They provide a hosting platform where you can develop connected, peer to peer applications that can speak to each other without considering the other complexities such as firewall rules and NAT etc,.

Venue: Xero, Level 1, 98 Customhouse Quay, Wellington

Please RSVP to kirkj@paradise.net.nz

Thurs 13 Nov, 1:10-5pm - MSDN Unplugged [Microsoft]

Sat 6 & Sun 7 Dec - SQL Pass Community Connection [NZ User Groups]

Wed 3 Dec, 6pm - Overcoming your web insecurity [.NET User Group]

In this hour-long session, I'll be introducing you to some of the threats your ASP.NET website will face, and give you ideas on how to protect your users, company and yourself. This applies to public facing and internal (intranet) applications.

RSVP details will be sent out to the announcement list closer to the date.

Thanks for reading this far!

Kirk

Reading about how dynamic is implemented in C# 4.0 over on Sam Ng's blog: Dynamic in C#

How did they implement the new dynamic 'keyword' in C# 4.0? Using the DLR, of course!

Very cool to see that the C# version of dynamic dispatch is implemented over the same mechanisms for call actions, dynamic objects and binders to generate expression trees, with some C# specifics in the binder to implement C#'s rules for dispatch etc.

It's interesting to see the flow-on effects of using a dynamic type in an expression and how the 'dynamism' then flows on to subsequent expressions or invocations involving the resulting object.

Quite a nice bit of work, and well explained by Sam. He's going to post more in the series, so worth subscribing to his blog.

Kirk

As linked to by the C# Futures site, here are the four main groups of C# 4.0 proposed features:

Dynamic lookup

Dynamic lookup allows you to write method, operator and indexer calls, property and field accesses, and even object invocations which bypass the C# static type checking and instead gets resolved at runtime.

Named and optional parameters

Parameters in C# can now be specified as optional by providing a default value for them in a member declaration. When the member is invoked, optional arguments can be omitted. Furthermore, any argument can be passed by parameter name instead of position.

COM specific interop features

Dynamic lookup as well as named and optional parameters both help making programming against COM less painful than today. On top of that, however, we are adding a number of other small features that further improve the interop experience.

Variance

It used to be that an IEnumerable<string> wasn’t an IEnumerable<object>. Now it is – C# embraces type safe “co-and contravariance” and common BCL types are updated to take advantage of that.

Most of these features are similar in spirit to what was shown at the Lang.NET symposium, but with a few details worked out.

The Dynamic features are going to be great when dealing with objects from DLR languages or COM. Named parameters sounds kind-of nice, but not world-changing. Variance support when assigning collections is going to be very handy, so is probably my favourite of the four feature groups.

Read more at the C# Futures site.

Kirk

A common scenario is wanting to delete an item while iterating over a collection using foreach:

Unfortunately, this will give the dreaded InvalidOperationException:

Collection was modified; enumeration operation may not execute.

This is because modifying the state of a collection invalidates the enumerator that foreach uses behind the scenes to loop over the collection.

A common work-around is to convert the foreach to a for loop:

You'll notice that the for loop goes backwards from the end of the list (position: Count - 1) back to the start (position: 0), so that when an item is removed, our current index i is still a valid position in the list.

How do you do it?

Kirk

Source (such that it is) Program.txt

Cool to see that Amazon will be offering Windows pay-as-you-go EC2 instances:

Coming soon: Amazon EC2 with Windows

It will be good to have another option for running SQL and ASP.NET solutions out in the cloud.

Sara Ford points to the release of Snippet Designer by Matthew Manela.

Snippets are a remarkably cool productivity tool within Visual Studio. I say "remarkable", because many people don't even know they exist!

It's great to have a UI over the top of the snippet XML files, which are a little painful to edit by hand. Snippet Designer lets you select a section of code, and export it to the designer to create a snippet:

(I had to cheat to get the screenshot of the menu... anyone know how to do that?)

Then you're dropped into the Snippet Explorer's designer surface, where you have three or four simple steps:

1. Right-click a symbol and create a replacement (above, I turned the 'argument' variable into a replacement). A replacement is text that the user can edit when using your snippet.
2. Edit the details of the replacement, including the default value and tooltip text.
3. Add a shortcut to your snippet.
4. (Optionally) Enter $selected$ $end$ where you'd like the cursor to appear after the snippet is finished. This is imported for SurroundsWith snippets, as the text you're surrounding will be replaced here.

Then simply save the snippet into your snippets directory inside My Documents (the default location is probably right), and now you can use your snippet when editing code.

Type the shortcut string (mine was 'fow'):

Press "Tab" "Tab":

And you end up in the first replacement variable, with the default value entered. Over-write the text with what it should be, and press Tab to jump to the next replacement. Continue pressing tab until everything is correct, and press Enter. You'll jump to the middle of the replacement text:

The snippet file is just XML, so you can edit it directly, or copy it to other computers easily.

There are a lot of snippets installed out of the box, you can browse them using the old Code Snippets Manager (under the Tools menu), or using the new Snippets Explorer installed by the Snippets Designer (under View -> Other Windows).

I'll be showing off the Snippets support in future Visual Studio tips n tricks talks. If you're interested in more tips, I have a Visual Studio 2008 series on this blog, or you can visit Sara Ford's blog.

Previous:

• Visual Studio Tips n Tricks (DEV313)
• Visual Studio - Copy references
• Turn off outlining / regions in Visual Studio
• Visual Studio 2008 tip of the day - relive the series
• Explore files from Visual Studio

Last month the guys from Mindscape released a Visual Studio File Explorer Addin. This is really useful if you don't have good source control integration within Visual Studio, or you want access to the full goodness available from an explorer window, but within Visual Studio.

The feature list:

• Fully Shell Enabled – So shell extensions like TortoiseSVN work just fine.
• Command Prompt Here – Opens a command prompt at the current folder.
• Snap to Solution – Sets the root folder to the current solution’s folder.
• Split View – Windows Explorer style.
• Open Item – Either in Visual Studio or the registered application.
• Options Dialog – For configuring the add-in.

And a screenshot:

It's good at twice the price! Download for free from the Mindscape site: Visual Studio File Explorer Addin

Kirk

Sara Ford has been publishing a great series of Visual Studio 2008 tips of the day, since July 2007.

I have given a couple of Visual Studio tips'n'tricks talks lately, and have recommended to the audience that they should go back to the beginning of the series and read her tips from the start.

If the thought of reading over a years worth of daily posts in a web browser scares you, I have assembled a Yahoo Pipe that grabs posts from 410 days ago and sends them out in an RSS feed, just like it was July 2007:

http://pipes.yahoo.com/cpkirk/saraford410

Each day you'll get the most recent posts from 410 days ago showing up in your feed reader.

Click the above link, and choose one of the options to add it to your feed reader, or you can even subscribe to email alerts each time there is new content (well, actually it's 410 day old content masquerading as new content).

Yahoo Pipes

Yahoo Pipes are pretty cool, they let you do transformations on a bunch of different types of data sources, and then re-expose them as a new feed.

In this case I have used an RSS feed from a Google blog search, as they allow you to search for posts on a given site and return all the results Google has cached. In Sara's case, Google will return 368 posts whereas her own feed only gives the most recent 15.

The pipe just builds up the right query string for Google, and then passes the url to the feed fetcher. The source is visible when you visit the pipe, although I have to admit that it's pretty simple and you could probably figure it out yourself :)

Blog series

It's interesting when you try to join part-way through a long running series on someone's blog.

The newest post at the top of their site (and your feed reader) is halfway through the series, so you have to scroll or read through the archives to get the earlier posts.

I often find when I stumble across "Part 7 of 11" blog posts that entering late puts me off subscribing to that blog, because of the weight of having to read so much to catch up so I can join the conversation.

Perhaps having a "Subscribe to this series from the beginning" link using a similar trickle fed time shifted approach would help people overcome that?

Irony

It did feel a little like having 10,000 spoons when all I needed was a knife to use a Yahoo beta product to pull data from a Google search to send people to a Microsoft employee's blog posts. Ain't the internet great!

Many thanks to Sara for the great series.

Kirk

I got asked this last night in Christchurch: "How do you make it so regions are always expanded?"

There's a couple of different ways to do this:

• You can turn off outlining altogether, in the Advanced Settings under C#:
  
• You can learn the keyboard shortcuts for expanding and contracting outlines: Did you know how to collapse and expand code - Sara Fords blog
• Or, you could reduce your use of regions (I've found they're often used to hide code, when really it should be refactored).

Kirk

• The second edition of Framework Design Guidelines is in the works, and may be out by the end of the year.
• The Framework Design Guidelines Digest v2 is available for download in PDF format.
• How to Design Exception Hierarchies gives good advice on when to create new exception types, and when to reuse existing types.

I've been reading Charlie Calvert's blog, and his list of LINQ providers, and watching both the Lightspeed and LLBLGen Pro LINQ beta's with interest.

There's an available product that you can buy - the CHI69 "Computer Human Interface" - I have written a LINQ provider over the API provided within the supplied SDK.

Download the beta LINQ to Spouse provider here.

Connect to the CHI69 device, and read in the environment:

// Open environmental interface

Environment environment = CHIConnector .Connect< Environment >();

Build the representation of the user:

// Open self-representation

Husband me = CHIConnector .Self< Husband >();

The device allows querying the local environment for objects of different types using LINQ: 

// Search all available for a girlfriend

var prospects = CHIConnector .AllAvailable< Girlfriend >();

Girlfriend

girlfriend =

(
from prospect in prospects
where
(prospect.Husband == null || prospect.MaritalStatus == MaritalStatus .Rocky)
&&
prospect.IsCompatibleWith(me)
select prospect
).First();

Peform some realistic actions with returned objects:

Thread

.Sleep(69);

The library exposes a rich interface:

// Test marriage criteria

if

(me.Mood == Mood .Romantic &&
    environment.Lighting <= Lighting .Flattering &&
    girlfriend.Emotions.Contains( Emotion .Desperate))
{

// Note the downcast. Some functionality will become unavailable
me.Wife = ( Wife )girlfriend;

}

So go ahead and test the library and provider. I'm interested in any feedback you can give.

Some notes:

• Wife inherits from Husband (by definition, the functionality is a superset)
• Version 69 of the CHI device only allows for monogamous relationships. Due to demand, apparently this requirement will be removed in an upcoming release
• As an optimisation, some inherited properties are implemented or cached in the class library, rather than querying the real-world object (e.g. wife.IsRight does not require a remote call as the result is deterministic)
• The default device communication protocol is messy. Using SOAP would clean it up.
• Setting me.Salary = 0 will throw an OutOfLuck exception, terminating the program.
• High intensity emotions (e.g. wife.Emotion.Intensity >= Intensity.Danger) result in unpredictible behaviour.

Videos/1-00 - Keynote - Jason Zander

Videos/1-01 - CSharp3 - Anders Hejlsberg

Videos/1-05 - Lively Kernel - Dan Ingalls - Sun

Videos/1-06 - JScript - Pratap Lakshman

Videos/1-07 - Irony and ERP Language Challenges - Roman Ivantsov

Videos/2-00 - Democratizing the Cloud with Volta - Erik Meijer

Videos/2-01 - Newspeak - Gilad Braha - Cadence

Videos/2-02 - Resolver One - Giles Thomas - Resolver

Videos/2-03 - Retargeting DLR - Seo Sanghyeon

Videos/2-04 - Visual Basic - Paul Vick

Videos/2-06 - PHP - Wez Furlong

Videos/2-07 - Phalanger - Tomas Petricek

Videos/2-08 - Pex - Peli de Halleux

Videos/2-09 - Numerical Computing with the CLR - Jeffrey Sax - Extreme Optimization

Videos/2-10 - remotion Mixins - Stefan Wenig and Fabian Schmied - rubicon

Videos/2-11 - CodeIt - Serge Baranovsky - submain

Videos/3-00 - IronRuby - John Lam

Videos/3-01 - Ruby.NET - Wayne Kelly

Videos/3-02 - FSharp - Luke Hoban

Videos/3-03 - Parsing Expression Grammars in FSharp - Harry Pierson

Videos/3-04 - NStatic - Wesner Moise - SoftPerson

Videos/3-05 - Moonlight and Mono - Miguel de Icaza

Videos/3-06 - Visual Studio Shell - Aaron Marten

Videos/3-07 - Modeling and Languages - Don Box

Videos/3-07 - Modeling and Languages - Don Box_1

Videos/3-08 - Cobra - Chuck Esterbrook

Videos/3-09 - Intentional - Magnus Christerson

• Google's new Android phone platform translates from Java bytecode to its own virtual machine -- which is not a JVM (via Miguel and Stefano)
• IKVM.NET, a runtime and set of libraries that convert Java bytecode to .NET MSIL
• Jython, a version of the python language that compiles to the JVM

• No database roundtrips to get the next integer ID
• Easy merging, mirroring and deletion of erroneous merges
• Ability to wire up relationships in memory before saving

• Reference the System.Concurrency.dll assembly during compilation.
• Wrap your data source in an IParallelEnumerable<T> with a call to the System.Linq.ParallelEnumerable.AsParallel extension method.
• i.e. var q = from x in data.AsParallel() ...
• Optional: choose your pipelining model: pipelined, stop and go, inverted enumeration. You choose this when processing the results.
• Don't rely on LINQ's default ordering of results. Explicitly order results if it's important to your program.
  
• Change the way you handle exceptions. Multiple exceptions may be thrown in the course of one query, and with PLINQ will be wrapped into a MultipleFailuresException.
• Avoid modifying data in your where clause, or otherwise mutating shared state during the course of your LINQ query. You may open yourself to race conditions.

Want to transfer your cheezburger skillz to the command prompt? Navigate your files using lolshell.

Download lolshell.ps1 [Requires PowerShell 1.0]

To give you a taste of the awesome powers of lolshell, here's a transcript. My favourite function is WTF.

          1>
          . ./lolshell.ps1 |\_/|
(. .) =w= (\ / ^ \// (|| ||) ,""_""_ . IM IN UR SHEL FIDLNG UR BITS 2>IM
IN UR C DRIVE KTHX 3>IM
WATCHN YR VIDEOS VIDEOS WATCHN U 4>WARE
AM I? LOL. I CAN SEEZ U HRE: C:\Users\kirk\Videos 5>GIMMEH
ALL MI FILZ Directory: Microsoft.PowerShell.Core\FileSystem::C:\Users\kirk\Vi
deos Mode LastWriteTime Length Name ---- ------------- ------ ---- -a--- 28/02/2007
12:40 a.m. 14882401 Vista_0001.wmv -a--- 28/02/2007 11:10 p.m. 14816631 Vista_0002.wmv 6>IM
WATCHN YR Vista_0001.wmv [Video opens in Media Player] 7>WARE
AM I? LOL. I CAN SEEZ U HRE: C:\Users\kirk\Videos 8>IM
WATCHN YR MOMMA U GO 'WAY 9>WARE
AM I? LOL. I CAN SEEZ U HRE: C:\Users\kirk 10>IM
IN UR Z DRIVE OMGWTF?! 11>WTF
JUST HAPND? WTF? LOL. HAPND JUST lolshell :) Cannot find drive. A drive with
name 'Z' does not exist. 12>HOW
DUZ I PRINT? NAME Out-Printer SYNOPSIS Sends output to a printer. ... [More
help prints here] 13>OKTHXBYE

Over the last few months we've been working to enable Silverlight support on Linux, and today we are announcing a formal partnership with Novell to provide a great Silverlight implementation for Linux.  Microsoft will be delivering Silverlight Media Codecs for Linux, and Novell will be building a 100% compatible Silverlight runtime implementation called "Moonlight".

• Scott Hanselman, of Computer Zen,Hanselminutes, Bathrooming with Rory fame has just signed with Microsoft in ScottGu's team.
• Alex James, inventor of Base4.net and NZ user grouper and MVP announced he's off to Seattle, and joining the Data Programmability team.

• Many questions aren't satisfactorily answered (46%)
  
• Helpers give up after a few attempts
• Beginner users have fundamental gaps in knowledge, and need direction to other documentation sources

• 15 recent threads from the NZ dotnet mailing list where a specific question was asked
• I measured similar statistics on the effectiveness and time to resolution, although for some of the threads where the orginal poster didn't reply with thanks, I defined "resolution" subjectively as whether I thought a satisfactory answer had been given
• A count of the number of messages in each thread, the number of helpful / on topic messages, off-topic, irrelevant and unhelpful messages

• 80% of questions received a satisfactory reply!
• There were no off-topic, irrelevant or unhelpful messages!
• Median time to resolution was 20 minutes!
• Longest time to resolution was 2hrs 34mins.
• Best response times are early-mid morning, and mid-afternoon. Slower responses over lunch time.

• The list is an extension of the user groups, and many people know each other in person
  
• Everyone is in the same timezone and industry, which means the responses are fast, and usually at the same time of day that you need help
  
• Off-topic conversation is kept to a seperate off-topic mailing list
• The list subscribers have a wide spread of knowledge and experience, with some members having very deep .NET knowledge
• Timaru is discussed monthly :)

Miguel de Icaza has written a progress report on their Mono port of Silverlight, called Moonlight.

It's a pretty impressive account of what they have accomplished in the first 21 days of developing Moonlight. It's interesting to see what a team with deep knowledge of a domain can produce in an intense session of hacking.

It will be especially interesting to see what core Silverlight features the Mono team can develop by the time Silverlight 1.1 releases, so we can target our Silverlight applications to the common denominator.

Also, I wonder which will release first: Silverlight 1.1 or Moonlight 1.1?