I’m going to talk about how the extension mechanism works. It uses the Managed Extension Framework (MEF), which you can read about here: http://www.codeplex.com/MEF. You don’t need to know a lot about MEF to write an extension – in fact you can get away without knowing anything apart from how to download it and which attribute to use on your extension class.

To create a custom graph processor, you’ll need to create a new Class Library project in Visual Studio. This project needs to reference Quickgraph.Graphviz.dll, System.ComponentModel.Composition, and DependencyViewer.Common.dll. The first two you can get from the lib directory in the Dependency Viewer project, and the Common dll you can get by building the DependencyViewer.Common project. Once you’ve got your project up and running, create a new class that implements DependencyViewer.Common.Interfaces.IGraphProcessor.

The IGraphProcessor interface is pretty basic so far. These are the important methods:

• PreProcessGraph
  • This method lets you change formatting options on the graph before the other graph elements are processed. You could use this to set the size, background colour, etc.
• ProcessEdge
  • This method lets you change formatting options on a dependency connection after the defaults have been set (there aren’t any defaults yet though).
• ProcessVertex
  • This method lets you change formatting options on a project node after the defaults have been set. By default the Name is set to the name of the project and the shape is set to Ellipse.

You can have blank implementations of any methods you don’t need.

To get the main application to find your custom graph processor, you just have to register it as an implementation of IGraphProcessor by adding the Export attribute to your implementation. So in this case, you’d put [Export(typeof(IGraphProcessor))] on your class.

Once you’ve done that, build your project, copy the dll into the directory where you are running the main application, and then the magic happens. MEF will automatically pick up your implementation when you next render your solution.

There is an example implementation in the Dependency Viewer project called TestProjectProcessor. It finds non unit testing projects that reference NHibernate and colours them a different colour, so that you can see what projects refer to your data projects. I got the idea from Melle Koning’s blog post on the subject here.

Remembering I had seen some argument over whether using a generic repository was a good idea or not, I started searching around and found quite a few blogs saying it was a bad idea. They made sense, and one blog had a great solution: Create a Repository<T, U> abstract class for common CRUD style operations, inherit your specific Repository from that, and only expose meaningful methods in your interface to client code. The benefits of this approach are many – your client code can only see methods that are applicable to each model class, you don’t have to duplicate your common CRUD operations for each model class, and it is easy as pie to unit test.

This last point is the one worth mentioning in my books. The great thing about separation of concerns is it should make things easier to pull apart for unit testing. Because my Repository methods have meaningful names, and are pretty fine grained, my mocking setup looks almost readable. It is immediately obvious from reading my tests that TaskController.List(5) should call ITaskRepository.GetLatestTasks(5). Not only that, but most of the Controller actions have been reduced to “Get this from Repository, return to View” or “Save this thing to the Repository”. They are small, obvious methods, and that makes them easier to test, and easier to maintain.

If you have multiple monitors, using the mouse it doesn’t let you dock to the side connected to the other screen. So you can only dock to the far left and far right with the mouse. Not so with the keyboard. Each time you hit the keyboard combo, it will move it to the next dock position in that direction. That means you can have windows docked all over your extended desktop, like so:

I’ve got two windows on each screen (as you can see, the right hand screen has the task bar, so you should be able to see where the screens split).

This is pretty useful at home. Having huge screens is great, being able to have 4 docked windows without fiddling around with the mouse is fantastic.

I thought it would be pretty easy to develop for as Python is interpreted, I thought I could just edit text files on the phone and run them to test them out. Turns out you can’t do that (not easily anyway), you need to package them on your computer, then upload the package to the phone, then install it, then run it. That killed that idea.

I looked at the Symbian emulator, and the PyS60 team have a mod for it that installs the python runtime so you can just run script files on the emulated phone. “This is great!” I think, before actually trying it.

For starters, the python runtime doesn’t work in the emulator when the emulator is running on Windows 7 x64 – damn. I have a VPC image with Windows XP on it though, so I fire that up, install everything, then try run it. The emulator crashes after about 15 seconds of loading.

After browsing the Nokia forums for a while, I find out the problem. VPC is actually connecting to the virtual machine over RDP, and so the audio drivers are the RDP Remote Audio drivers.

What do audio drivers have to do with a phone emulator I hear you ask? Good question, but it is one the Nokia forum dwellers have no answer for. Many people have complained that the Symbian Emulator does not work when connecting to the machine hosting it via RDP. There are other issues with particular sound card drivers or applications also causing it to crash. This is a prime example of bad error handling. Why, if the audio part of the emulator cannot work with some drivers, does it crash instead of continuing without audio?

So that brought down my plans for making millions of dollars from fart applications for Symbian based phones.

I did happen to stumble upon a StackOverflow question (here) where a different problem was outlined, however this answer reminded me of an issue Scott Hanselman had with an app he was doing a demo with, so I thought I would give it the fix a shot. Strangely enough, I think it has fixed it, although I am not sure why (it seems unrelated). Anyway, here is the fix, just in case anyone else has a similar problem:

Fix:
Disable checking of Publisher’s Certificate Revocation

1. Go to Internet Options in Internet Explorer or Control Panel
2. Then go the Security Tab, scroll towards the bottom
3. Uncheck the ‘Check for Publisher’s Certificate Revocation’ checkbox
4. Click OK.

My New Desk Arrangement

Once I got used to the larger monitor I had a pretty productive day though. The T240 is a decent monitor for developing on, judging from one day’s usage. Text is clear, and after a little tweaking the colour looked about right, enough for my purposes anyway. Not to mention it is a nice looking monitor. All in all, it was well worth the money I/the business spent on it.

I got the idea from Ayende’s blog, kindof. His blog is quite interesting to watch, because it is made up of lots of small updates. It almost seems like more of a note taking system than a blog sometimes, in a good way. For myself, I tend not to write blog posts because they take a little longer than I’m willing to give during the day to write, so Twitter’s 140 character limit could work for me. It’s just a trial anyway, if it doesn’t work out I’ll dump it.

So how I think I’ll work now is: Post short messages to Twitter like reminders, helpful hints, and status updates, and post longer information like information about side projects and interesting topics on my blog.

If anyone wants to follow me on twitter, here’s my page: http://twitter.com/jamiepenney. Be aware that there will be a bit more personal stuff there, my blog so far has just been technical but I’ll probably use Twitter for personal and work messages.

Enough talk, here’s the GitHub project: http://github.com/jamiepenney/ook-sharp

You’ll need the latest F# CTP installed to open this project in Visual Studio 2008.

My tool takes a visual studio solution, and produces a PNG image showing the dependencies between the projects in that solution. Pretty basic stuff, but it involves:

1. Parsing a Visual Studio .sln file.
2. Parsing the .csproj files referenced in the .sln file. (I don’t think it is C# specific but have not tested it on other project types).
3. Creating an in memory representation of the solution structure.
4. Creating a graph in QuickGraph to represent that structure.
5. Creating a dot file for GraphViz from that graph.
6. Pass that file to GraphViz and display the output.

This results in something like this:

The source code is here.

Updated: I’ve put this project on GitHub, and added Melle’s changes to it. You can find it here.

Feel free to do what you like with it, it only took me about 3-4 hours to get it all working. However if you actually use it as part of another project, please leave a comment.

You’ll need the latest version of GraphViz, which can be downloaded from here: http://graphviz.org/Download_windows.php. I’ve been using the development snapshot, but the stable release should be fine. When my tool first runs, it’ll ask you for the location of graphviz. You need to specify the location of dot.exe, which by default is in %Program Files%\GraphViz 2.21\bin.

Standard disclaimer: I’m not responsible for anything that goes wrong when using this thing. You have the source, you should check it out before running it. If it wipes your system and kills your firstborn child feel free to let me know, but don’t expect me to do anything about it.

• History of developing for windows clients
  • Win16/Win32 – Procedural style (message loops)
  • ActiveX/Visual Basic – Limited OO style, events + components
  • Windows Forms – Component oriented style
  • Common themes
    • Write code to copy data from model to control
    • Write code to detect changes in control data
    • Write code to copy data from control to model
    • Detect changes in model data or use gatekeeper
• What is better about WPF/Silverlight?
  • Enhanced component model encapsulates common plumbing.
  • Designer-developer workflow needs a declarative programming style to work well.
  • Hard to write robust OO/procedural code against a lookless model.
• Reactive programming is like binding values together. Think like how you can create formula’s in Excel – changing the value of one of the cells in a formula updates the result of the formula, and it keeps doing it.
• Benefits
  • Remove plumbing code, no need to track changes in model and controls and copy data between
  • View/model relationship expressed in view instead of in controller/presenter code. Express the what, not the how.
  • Works well with the lookless approach – view reacts to model change, rather than the model manipulating the view.
• .Net works on a notification system (INotifyPropertyChanged) – when something changes, dependent values re-evaluate themselves.
• Issues
  • We need to react to changes to derived data -> use converters for this.
  • A reactive expression may produce unacceptable values (user input?). Solution is to use validation.

Bindable LINQ

• How do you query an ObservableCollection? How do you observably query an ObservableCollection?
• LINQ queries don’t provide change notification!
• Bindable LINQ is a community project to enable reactive controls to back easily onto LINQ queries
• Key API : AsBindable() – extension method on IEnumerable<T>

SEC201: Do These Ten Things or Get Own3d – Steve Riley

1. Use precise terminology

• Vulnerability – The problem
  • Code
  • Configuration
  • Circumvention – Security rules that are so draconian that they encourage people to actively try to get around it.
• Threat – The person that carries out the attack
  • External
  • Internal
• Exploit – the code that exploits the vulnerability
• Exposure – The cost of the attack being carried out.
• Risk

2. Accept that no one will like you

3. Think like a bad guy

People will not like you for this either.

4. Understand the science

• Identity is not Authentication.
• Encryption is not Integrity
• Inspection is not Intent – Can’t tell intent by looking at someone’s stuff.
• Secrecy is not Trust – just because you can make something a secret, doesn’t mean you can trust it.
• People are not Technology – All the technology in the world will not solve your technology problem.
• "Defence in depth" = "I am a parrot"
• Stupidity is not Malice
• Usability and Security are a tradeoff.

5. Protect your gear

• Patch your stuff.
• Use the firewall.
• Don’t run as admin, or reduce number of admins.
• Install anti-malware, or scan fileshares.
• Don’t tweak.
• Rebuild, don’t disinfect.

6. Swallow your pride

• Read up
  • Microsoft
  • www.sans.org
  • www.securityfocus.com
  • http://searchsecurity.techtarget.com

7. Reconsidering the laws

• Law 1: If a bad guy can persuade you to run his program on your computer, it is not yours anymore.
• Law 2: If a bad guy can alter the operating system on your computer, it’s not yours anymore.
• Law 3: If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore.
• Law 4: If you allow a bad guy to upload programs to your website, it’s not your website anymore.
• Law 5: Weak passwords trump strong security.
• Law 6: A computer is only as secure as the administrator is trustworthy.
• Law 7: Encrypted data is only as secure as the decryption key.
• Law 8: An out of date is only marginally better worse than no virus scanner at all.
• Law 9: Absolute anonymity isn’t practical, in real life or on the web.
• Law 10: Technology is not a panacea.

8. Classify, and classify again.

• Access
  • Principle of least privilege – others and yourself. If this principle interferes with your business process and is part of the OS, email Steve.
• Data
  • Confidentiality, retention, recovery.
• Trust
  • Functions, directions.

9. Don’t let your guard down.

• People are always trying to sell you silver bullets/snake oil.
• Trustworthy people will discuss the downsides of their software

10. Protection, not restriction.