A general theory of design

“Design consists of creating things for clients who may not know what they want, until they see what you’ve done, then they know exactly what they want, but it’s not what you did.” – Brian Sooy Read Mr. Sooy’s entire blog post.  I’m not a designer, but having spent most of the past 10 years working with them to build database-driven websites and applications, I definitely agree with him.  My most recent project (an extranet for the nation’s AMBER Alert coordinators) didn’t launch until 6 months after its originally scheduled launch date in large part because of the client’s uncertainty over what they wanted.


Community Server 2.0 Patching

Telligent sent out an e-mail last Friday afternoon about a critical security patch. These were the patch instructions:

Directions for installing the patch:
These are the contents of the readme.txt file:
Steps for installing the Community Server 2.0 SP1 Patch.

1. Make a copy of the CommunityServer.Components.dll found in the bin folder of your web site. 2. Replace the existing CommunityServer.Components.dll with the new one you just downloaded and unzipped.

If you have questions or problems, please email support@telligent.com

We have also included the updated source files. If you have modified any of the code in the Community Server Components project you will need to apply these fixes and redeploy your assemblies.

I wish the readme file had said exactly where the updated source files go. I don't like the idea of having to hunt around files to replace when the patch has to do with security. So here's what the readme file should include:
ComponentsHttpModuleCSHttpModule.cs

ComponentsComponentsHtmlScrubber.cs

ComponentsComponentsTransforms.cs

Telligent has an announcements blog with a post about this security patch.

Paging in Microsoft SQL Server stored procedures

Today I found out that an old boss of mine at Ciena Corporation has a blog (thanks to Plaxo).   I learned a lot about  ASP.NET, C#, and Plumtree through the work he assigned to me.  From looking at the posts he’s got in there so far, if you’re looking to overclock a PC or find out more about Vista, it’s worth checking out. An older post of his has a good example of how to implement paging in a SQL Server stored procedure.


IntelliSense for SQL Query Analyzer

Red Gate Software is giving away a tool called SQL Prompt until September 1, 2006.  If you work with SQL Server at all, definitely visit Red Gate and grab this.


Amazon "1-Click" Patent Challenge

According to this article, Amazon’s patent is being reviewed because it looks like the U.S. Patent & Trademark Office granted a similar one 18 months before Amazon’s filing.  It will be interesting to see what fallout there would be from a decision invalidating Amazon’s patent.

That aside, this brief story does a nice job of pointing out how profoundly broken the patent system is.  The prior patent wasn’t found by a USPTO employee, but an actor from New Zealand who was angry about a slow book delivery and wanted to get back at Amazon.  If Amazon hadn’t made one of their customers upset, who knows if this would have ever been found.  The patent review will probably revisit these requirements:

  • is 1-click new
  • is 1-click useful
  • is 1-click nonobvious
At the time Amazon got the patent, I felt it clearly failed the nonobvious requirement.  The existence of an 18-month-old patent on the same idea only confirms that.

Stored Procedures vs. Ad-hoc SQL

I saw this insightful article on the subject in a “most popular articles” list. The author, Douglas Reilly, acknowledges at the beginning of the article that he uses stored procedures virtually all the time, but still does a great job of describing the pros and cons of each approach.

The most useful thing the article taught me was that as of version 7, SQL Server keeps execution plans for all statements, not just stored procedures. This reduces the advantage of stored procedures for basic CRUD (create, read, update, delete) operations substantially. I’ve certainly touted the superior performance argument in comparing stored procedures to ad-hoc SQL before, so I’m glad I learned the real deal now. That said, I still hold a bias in favor of stored procedures. Once upon a time, I worked for Sybase Professional Services as a DBA, and they were definitely pro-stored procedure. Nearly every shop I’ve worked in since then has been similarly inclined. Anytime an employer has used ad-hoc SQL, it’s been absolute murder to maintain. In my experience, the maintenance advantage of stored procedures over ad-hoc SQL is substantial, not slight (as Reilly concludes).

One issue the article doesn’t bring up that might be interesting is source code control for stored procedures and other database elements (views, user-defined functions, etc). While SQL Server does have backup and restore, it’s not nearly as granular or convenient as the check-in/check-out model of today’s source code control systems. On my projects, I tend to generate a script with just the stored procedures in it and store that in SourceSafe. I’d certainly like a better solution, but haven’t found one yet. I’m curious to see what SQL Server 2005 is like, since it will allow you to write stored procedures in C# or VB.NET.


Apple's business model beating Microsoft's

So says Walt Mossberg, the man with the job I envy most in technology.

I agree with what he says for the most part on the advantages of the end-to-end model versus the component model. One thing I would say that’s slightly different is that Apple is winning not merely because of the tight linkages, but because of the quality of the end product, and their huge market share.

Having lost what Mossberg describes as “the first war” in the personal computing space, Apple took a look at the MP3 player market and delivered a product significantly ahead of the competition in quality and ease of use. Even when connected to a PC (as I did with my first iPod), using MusicMatch for the music software, I liked the experience better than other players I’d considered. Once iTunes came to the PC, it made things even easier.

Part of what helped Apple get its current marketshare in the digital music market is their refusal to inflict the subscription model on their customers. They understood that people want to own music instead of renting it and delivered just that. Between that, their great per-track price point, and the minimum necessary DRM, there are plenty of reasons to choose Apple over the competition.


Removing time from a datetime field in SQL

I’ve got a small project at work that required me to use the date, but not the time in a datetime field for retrieval of certain rows from a table in SQL Server 2000. A bit of Googling revealed a document titled “Remove seconds from datetime SQL”. The title isn’t quite right, as the author’s query removes hours and minutes too, but the result turned out to be just what I wanted.

The query: SELECT Cast(Convert(varchar, GetDate(),105) as datetime) I ended up using code 101 instead of 105 to get my query working, but that was it.


ASP.NET Configuration File Handling

One of things I like the least about working with multiple development, QA, and production environments is messing around with configuration files to make sure the different versions point at the right databases.  Add the use of the Enterprise Library, and there are even more files to manage.

In my last year at Ciena, I worked in a group where they’d put together some code that detected what environment it was in (development, QA, or production) and retrieved the correct settings from web.config.  It was similar to the solution Mike Gunderloy describes in this article on ASP.NET 2.0 productivity.

When I was poking around for more information on config file handling, I came across another article that references Gunderloy’s that talks about a file attribute for the appSettings tag.  I hadn’t come across the existence of that attribute anywhere else before.  I’ll definitely use this on my next project.

Finally, this article provides another option for dealing with configuration files in multiple environments.  The code and examples are well-explained.  My group at Lockheed Martin should integrate something like this into the custom library we’ve been building.


Downside of Certification

According to this eWeek article pay premiums for skills that don’t have a certification grew three times faster than pay premiums for certified skills.

I never really bothered with certifications for any of my skills because I was usually too busy working to set aside the time to study for and pass the exams.  I was more motivated to do that for things like grad school.  I always felt that experience was more valuable than a certification, but the counter-argument of “if you have the experience, certification should be no problem” is still a reasonable one.

Still, I hope the pay premium changes mean employers are choosing experience in favor of those who’ve passed an exam but have little or no hands-on experience.


Amazon.com and A9.com switch to Microsoft Search

I hadn’t noticed this until yesterday, but Google is no longer the guts of A9 & Amazon search. According to this article, A9’s contract with Google expired and they decided to go with Microsoft for the replacement.

I tried “v for vendetta” as a search in both A9.com and Google to see how the results differed (if at all). In my case, the top 6 links from A9 were to the V for Vendetta website by Warner Brothers (hits 1-2), its IMDB entry (hits 3-4), its Wikipedia entry, and its Rotten Tomatoes review. Google gave me the same hits, in almost the same order. The only difference was that the top result returned showtimes for the movie close to my zip code. A9 actually provides that info too, you just have to check the “Movies” option.

It looks like Microsoft’s search has actually improved somewhat since I last tried it. I’ll be curious to see what moves Google and Yahoo make to try and stay top two in market share.

Update:

When I talked to my friend Sandro about the switch and told him what search term I used, he suggested I use a tougher search term to test the relevance of lower-level results. We compared the results of searching for his name “Sandro Fouche” between Google and Live.com. With Google, I had to go to the 50th result to find the first irrelevant result. With Live.com, I got an irrelevant result as early as the 10th result.


Mac OS X gets its first virus

According to this article in MIT Technology Review, the Apple operating system got it’s very first virus this year.  I suppose the “virus-free” label wasn’t going to last forever, but we should still be extremely impressed that it took about five years for a serious vulnerability to be found.

Even with the latest vulnerability announced, I’ve still found the Mac mini I bought last year to be incredibly stable and easy to use when compared to any of the Windows machines I currently use.  The only fallout from this announcement I see is that anti-virus software makers will be able to sell more to Mac users.


.NET Social Security Number Validation

Writing code for work on a Sunday is certainly not my idea of a good time. Especially when our approaching deadline is inspiring panic and all manner of apocalyptic pronouncements about bits of code that aren’t working.

The latest panic compelled me to do a bit of research (i.e. Googling) to find out what constituted a valid Social Security number. Google kindly coughed up this Wikipedia entry. A quick scan through the article yielded this page from the Social Security Administration. Titled Social Security Number Allocations, it lists the valid code ranges for all 50 states, DC, and U.S. territories.

The regular expression you get from Microsoft’s web user control for SSN validation is relatively simple: d{3}-d{2}-d{4}. One of the developers changed things to use this: ^(?!000)([0-6]d{2}|7([0-6]d|7[012]))([ -]?)(?!00)dd3(?!0000)d{4}$

Sure, it’s gold plating. But it works. It would be more trouble to take out than it was worth anyway.


Ether Beta Test

Awhile back, I read a blog entry (probably from Robert Scoble) about a venture called Ether. If memory serves about how he described their goal, they’re trying to be the eBay of services. I figured I’d sign up and see if they’d add me to their beta test list. Today I got their e-mail saying I’d been added.

Here’s the business card I generated after signing up:

Scott Lawrence (IT Advisor)
1-888-MY-ETHER ext. 01568799
A lot of family and friends call me for advice on computer-related things. It seems to come with the territory when you've got a degree in computer science. If I make a little pocket change from this during the beta test, I'll consider the experiment a success.

I’ll post more as the beta test proceeds.


VS.NET 2003 Annoyance

VS.NET really annoyed me today. When I changed my custom page base class to be abstract, the web forms that inherit from it could only be seen in HTML mode. Their HTML editor leaves a lot to be desired. Maybe I’ll have to figure out how to switch to SciTE automatically when the visual designer croaks.

On the other hand, not using the visual designer does get rid of VS.NET’s annoying habit of trying to create new declarations of web user controls in the web form code-behind when you’ve already got them declared in a custom base page class.


Ads coming to iTunes

I came across the article today in Advertising Age (via a Wall Street Journal link).  The article hints that this is the first step toward advertising showing up on iPods.

I’m not surprised.  It was inevitable that advertising would show up on iTunes.  I’d been hearing it in some of the podcasts I listen to already.  I wouldn’t expect Apple to turn down that revenue stream forever.  It’s still a little sad that there’s one more place we can now expect to see ads.


Open Source on the .NET Platform (part 1)

Open source on the .NET platform is a topic I’ve been thinking about for awhile. My current boss has made it a point to try and use open source applications built with .NET whenever possible. This is the first in an occasional series of posts on the topic.

A good definition of the term “open source” comes from Vaskin Kissoyan of Lokion, Inc.. Here’s the software developer aspect of the full definition:

"Open Source Software allows a developer to contribute to an already existing product or application, it also provides a rich set of library code (basic functionality) effectively giving you an almost unlimited amount of blocks upon which to build your applications. The OS community fosters reuse so there is no need to re-invent the wheel - a major problem for all developers before the dawn of Open Source."
How well does this definition apply to some of the software built using .NET since the year 2000? In some respects, it fits quite well. When it comes to library code, Microsoft has provided Application Blocks, then the more robust Enterprise Library. Microsoft has also done a good job of providing reference applications as starting points for future development. This is a practice I first took advantage of during the Windows DNA days when I used the Fitch & Mather Stocks application as the basis for an online recruitment tool I built for Ciena in 2001. Since that time, sample applications like Duwamish Books and a myriad of starter kits have been the basis for many custom development efforts.

The Issue Tracker starter kit was the first open source .NET application our group at Aspen Systems (now Lockheed Martin IT) tried to use. The group lacked a formal, centralized way of tracking bugs in the software we developed, so my manager saw it as a no-cost way to build our skill with C# (it’s also available in VB.NET) and .NET and improve our development process.

Looking back on the experience, we should have answered the following questions before we moved forward with the IssueTracker starter kit:

  1. Is open source the best choice for this application (buy versus build/extend)?
  2. What platform are your developers most skilled at building for?
  3. Is the best open source application on the .NET platform?
  4. Is it our goal to re-sell an application we've extended?
At the time, I could have gone either way on whether an open source application was the best choice for issue/bug tracking. There are tons of commercial, closed-source options with plenty of functionality. One such application is FogBugz. The latest version has great e-mail integration, discussion groups, source code control integration, support for release notes, RSS and more. It can get expensive, but selling custom software for a living should mean that we recoup those costs.

Even if there was no willingness to spend money (and there wasn’t) and open-source was the direction chosen, Bugzilla is used by enough companies and organizations (including Id Software, NASA, and Akamai) that we should have considered it far more strongly than we did.

We were (and still are) primarily a Microsoft shop, so the developers were most familiar with that platform. Unfortunately, too many of them were new enough to ASP.NET that they wrote applications the same way they would have in classic ASP. This was probably why boss felt the application would be a good learning tool. When it comes to open source, the odds that the best solution will be written in .NET are low. None of the open source bug/issue tracking solutions written in .NET that I was able to find came anywhere close to Bugzilla or FogBugz in user interface, functionality, or documentation.

We weren’t going through the trouble of extending Issue Tracker because we wanted to re-sell it. It was (and is) strictly for internal use. From my perspective, the only reason to assign people from revenue-generating projects to extending this app was if we planned to re-sell the resulting application.

At the time, I believed we made the wrong choice in trying to turn Issue Tracker into a production system. The year that has past has only strengthened that belief. The resulting application is regularly changed and updated to accomodate requests from any number of people. It takes development resources we really need for projects that make the company money. It still lacks useful features that can be found in more mature products (both open source and COTS) .

In my next post on this subject, I’ll examine how these four questions apply to a more robust open source .NET application: Community Server.


First bilingual application

In the nearly 11 years I’ve been writing software for real money, I haven’t had any internationalization projects until now. The project I’ve been assigned most recently is an electronic forms application that will allow the spouses of police, fire, and other public safety officers injured or killed on duty to apply for benefits. It certainly isn’t the most cheerful app I’ve ever helped write, but it’s definitely one of the more important ones.

Dealing with resource files has been the biggest pain of the entire project. We lack consistent naming conventions for variable names. We also lack consistent locations for the variable names. This results in the need to pull strings for one form from multiple resource files. Sometimes, variable names and locations have been changed arbitrarily and without warning. This meant that code I’d written one day that displayed the correct text, displayed nothing the next day. A few of those changes cost me half a day of rework (and every bit counts when your deadline won’t move).

When I finally had a chance to look for information on internationalization in .NET, I came across an excellent article at DevX. It’s the first in a 3-part series of articles that ends with a decent checklist of issues to consider in an internationalization project. The sample application is more complex than my assignment because they’re internationalizing database content as well as static content.

So far, I think we would have helped ourselves a lot if we’d thought of the resource files as classes. I’m not sure what the performance implications of more resource files with fewer strings would be versus fewer resource files with more strings, but I think it would improve our speed of development.


We need heroism

These are the words I least want to hear, especially when it comes to my job. I heard them today from one of my bosses because I’ve been writing code for one of his projects. It has the usual immovable launch date and changing requirements. The latter is why I was added to the project. The client decided, in all their wisdom, that an application we were building for them needed to be bilingual (displaying English or Spanish depending on the viewer). This is after changing the platform from Java on Unix to ASP.NET & C# on Windows. All this, one month before the scheduled launch.

Part of me is amused by this situation because I’ve been telling this boss for months that we don’t have enough developers. Because my title is “senior systems analyst”, writing code isn’t supposed to be my primary job. This same boss has said in the past that he didn’t want me to write code. So it’s rather ironic (and annoying) that I’m who he asks to write code when it looks like his project will miss its deadline.

Needing heroism on most of your projects means something is seriously wrong with the process.  It’s particularly discouraging when your employer received a CMMI Level 2 certification within the past six months.  That level is supposed to mean heroism is in the past.  In reality, CMMI Level 2 means a ton of documentation (and a ton of time spent writing it).  It doesn’t fix inaccurate budgets estimates or timelines, clients that keep changing their minds about what they want or a lack of developers to actually build the product.


Akismet Rules

Akismet is a ruthless comment spam killer :-)  Moderating comments is super-easy now (since I’d been getting nothing but comment spam lately).  And there’s no better price than free.