Tin Isles

WordPress, it's what the cool kids are doing

2010-07-17T23:09:00.003+10:00

About time my blog "grew up" a bit, and moved to its own domain: blog.tinisles.com. I've splashed out and set-up a WordPress blog at DreamHost.

Expect an article on the new blog detailing my geek adventures setting up WordPress and tranferring the articles over!

Should you trust lastpass.com?

2010-01-10T23:39:00.008+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2010/01/should-you-trust-lastpass-com/

lastpass.com looks like a handy online service for storing all your website passwords. Browser extensions are available to make the whole process easier. If you use the web from several PCs it does sound nice to have all your passwords available and synced between your PCs.

First thought was wether I should hand over my passwords to the 3rd party, hopefully they are storing them with some serious crypto. Perusing their FAQ I found some info on this:

We only support keeping the encryption done on your computer so LastPass can't see your sensitive data

...your sensitive data is always encrypted and decrypted locally on your computer before being synchronized. Your master password never leaves your computer and your key never leaves your computer. No one at LastPass (or anywhere else) can decrypt your data without you giving up your password (we will never ask you for it). Your key is created by taking a SHA-256 hash of your password. When you login, we make a hash of your username concatenated with your password, and that hash is what's sent to verify if you can download your encrypted data.

So they are encrypting everything with a key derived from your password - plus they don't know your password - so they CANNOT access any of your passwords. Nice. But why stop there? Let's fire up fiddler to make sure they definitely don't have my passwords.

I've created a junk account on lastpass username: russell.sayers.junk@gmail.com, password: test1234 (the account will be gone by the time you read this!). The first form I see submitted to the server is when I create my account:

username	russell.sayers.junk@gmail.com
hash	53c81a859a3f3d4dc3762d3a47bab07fad7ad3f2673724deb20fb420e8bdc03a
password	********
password2	********
password_hint	testing
timezone2	+10:00,1
language2	en-US
agree	on
agreeupload	on
loglogins	on
improve	on
json	1

I don't see my password going to their servers in the clear. I can confirm that the hash getting sent is geniune by creating the same hash elsewhere via an online SHA256 generator, or writing some code myself. Try it yourself, the hash created is SHA256(SHA256(username + password) + password) - everything checks out. All the C# code to verify the encryption/hashing is at the end of the article.

The login form:

method	web
hash	53c81a859a3f3d4dc3762d3a47bab07fad7ad3f2673724deb20fb420e8bdc03a
username	russell.sayers.junk@gmail.com
encrypted_username	T2tBleI3PxuLOoNEwNkv5PZ/rYr5dDIoYZS+We4vER4=
otp
gridresponse
trustlabel
uuid
sesameotp
email	russell.sayers.junk@gmail.com
password

Again the same hash is being used to verify me when I login. I can see an encrypted username is being sent (although I'm not sure why?), rooting around in the javascript I can see the key being used for encyption is SHA(username+password). Importantly this is different to the hash being used to authenticate me - as we don't want the server to be able to decypt anything encypted by the client, i.e. they would have to know my password to derive the same key on their side.

The form to add a new website:

hasplugin	0
extjs	1
search
purgeext	0
deleteext
undeleteext	0
ajax	1
ob
basic_auth	0
isbookmark	0
openid_url
aid	0
useurid	0
fromwebsite	1
name	pyJlY+AX0Aoczlx50hwlHg==
grouping
origurl
url	66616365626f6f6b2e636f6d
username	ICkGIGAn7SIk16iKNkl3DA==
password	dl78FYUSIdsxxSdkBuBWEA==
extra	faESoIpzmCQg5PeHpXN0GQ==

We can see here the client is sending encyrypted versions of name, username, password, and the extra info. Again this is encrypted with a key we only have on our client - no one at lastpass could have this key. For some reason the URL is being sent in a HEX representation of the string - not sure why they aren't just sending the string?

So when I log back into lastpass, I can drill down into this entry and see it again. Let's make sure everything looks okay here. The HTML that renders this screen is available in fiddler:

<tr>
  <td class='col1'>Name</td>
  <td><input name='name' id='name' type='text' value='pyJlY+AX0Aoczlx50hwlHg==' style='width: 250px'></td>
</tr>
...
<tr>
  <td class='col1'>Username</td>
  <td><input name='username' id='idusername' type='text' value='SgVkuVKH4MjkP+Saz64UhA=='> </td>
</tr>
...
<tr>
  <td class='col1'>Notes</td>
  <td><textarea name='extra' id='extra' rows='6' cols='35'>1rZ3sSuggtdavyCu446GZA==</textarea></td>
</tr>

The server is sending down our encrypted details, and relying on the client to decrypt everything.

So, yes - you CAN trust lastpass.com with your passwords! Don't just take my word for it; fire up Fiddler, and compare the hashed/encrypted values with what you expect.

Lastly the c# code to confirm the AES encrypted strings above are geniune.

static void Main(string[] args)
{
    string username = "russell.sayers.junk@gmail.com";
    string password = "test1234";
    string hash_auth = ByteArrayToHexString(SHA256(ByteArrayToHexString(SHA256(username+password)) + password));
    byte[] hash_key = SHA256(username + password);

    Console.WriteLine("hash for authentication => " + hash_auth);
    Console.WriteLine("hash for encryption => " +  ByteArrayToHexString(hash_key));
    Console.WriteLine("'{0}' encrypted => {1}", username, Encrypt(username, hash_key, ""));
    Console.WriteLine("'{0}' encrypted => {1}", "facebook", Encrypt("facebook", hash_key, ""));
    Console.WriteLine("'{0}' encrypted => {1}", "cryptolearner", Encrypt("cryptolearner", hash_key, ""));
    Console.WriteLine("'{0}' encrypted => {1}", "password", Encrypt("password", hash_key, ""));
    Console.WriteLine("'{0}' encrypted => {1}", "no notes", Encrypt("no notes", hash_key, ""));
}

static byte[] SHA256(string data)
{
    byte[] indata = Encoding.UTF8.GetBytes(data);
    SHA256 shaM = new SHA256Managed();
    return shaM.ComputeHash(indata);
}

/// <remarks>From http://social.msdn.microsoft.com/Forums/en-US/csharpgeneral/thread/3928b8cb-3703-4672-8ccd-33718148d1e3</remarks>
static string ByteArrayToHexString(byte[] data)
{
    StringBuilder sb = new StringBuilder(data.Length * 2);
    foreach (byte b in data)
    {
        sb.AppendFormat("{0:x2}", b);
    }
    return sb.ToString();
}

/// <remarks>From http://stackoverflow.com/questions/1079131/c-aes-256-encryption</remarks>
static public string Encrypt(string plaintext, byte[] KeyBytes, string InitialVector)
{
    byte[] PlainTextBytes = Encoding.UTF8.GetBytes(plaintext);
    byte[] InitialVectorBytes = Encoding.ASCII.GetBytes(InitialVector);
    RijndaelManaged SymmetricKey = new RijndaelManaged();
    SymmetricKey.Mode = CipherMode.ECB;
    SymmetricKey.Padding = PaddingMode.PKCS7;
    ICryptoTransform Encryptor = SymmetricKey.CreateEncryptor(KeyBytes, InitialVectorBytes);
    MemoryStream MemStream = new MemoryStream();
    CryptoStream CryptoStream = new CryptoStream(MemStream, Encryptor, CryptoStreamMode.Write);
    CryptoStream.Write(PlainTextBytes, 0, PlainTextBytes.Length);
    CryptoStream.FlushFinalBlock();
    byte[] CipherTextBytes = MemStream.ToArray();
    MemStream.Close();
    CryptoStream.Close();
    return Convert.ToBase64String(CipherTextBytes);
}

Expanding on Josh Smith's WPF MVVM app

2010-01-05T23:31:00.002+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2010/01/expanding-on-josh-smiths-wpf-mvvm-app/

Over the holidays I've got a start on a new project idea. I decided to do the simple UI of the project as an MVVM WPF app. First thing to do was to google up some sample MVVM WPF app. There are some very good example apps out there, some honourable mentions: Sonic, Karl Shifflett's Cipher, and Josh Smith's MVVM Demo App (some good comments on the accompanying blog post: My MVVM article in MSDN Magazine)

Josh's demo app is simple enough for me to quickly get my head around some WPF and MVVM concepts. But the article includes a challenge :) :

The application does not have support for deleting or editing an existing customer, but that functionality, and many other features similar to it, are easy to implement by building on top of the existing application architecture.

The following is a quick summary on how I added editing to the demo app. This is TOTALLY up for debate. I'm interested to know if I could've taken an easier approach. In summary, I've added a RelayCommand '_editCommand' up in MainWindowViewModel to display the edit tab. I pass this command down to CustomerViewModel so I can bind it to a new button on AllCustomersView. Am I creating ViewModel's that are too tightly coupled?

MainWindowViewModel.cs
- added a private field:
  ICommand _editCommand;
- in the constructor this is pointed to a method in MainWindowViewModel:
  _editCommand = new RelayCommand(cust => EditCustomer(cust as CustomerViewModel));
- constructors for CustomerViewModel and AllCustomersViewModel are now passed _editCommand
- added method EditCustomer to display the workspace:
```
void EditCustomer(CustomerViewModel workspace)
{
    WorkspaceViewModel exisitingModel = Workspaces.FirstOrDefault(cust => cust is CustomerViewModel && (cust as CustomerViewModel) ==  workspace);
    if (exisitingModel == null)
    {
        this.Workspaces.Add(workspace);
    }
    this.SetActiveWorkspace(workspace);
}
```
AllCustomersViewModel.cs
- added a private field:
  ICommand _editCommand;
- _editCommand is set by a new parameter in the constructor (passed in by MainWindowViewModel)
- _editCommand is passed to the CustomerViewModel constructor in OnCustomerAddedToRepository and CreateAllCustomers.

CustomerViewModel.cs

added a private field:
ICommand _editCommand;
_editCommand is set by a new parameter in the constructor

fixed the _CustomerType defaulting to 'not specified':

_customerType = (this.IsNewCustomer) ? Strings.CustomerViewModel_CustomerTypeOption_NotSpecified :
    (_customer.IsCompany) ? Strings.CustomerViewModel_CustomerTypeOption_Company : 
    Strings.CustomerViewModel_CustomerTypeOption_Person;

exposed _EditCustomer as a public property: EditCustomer

AllCustomersView.xaml - bound a new 'Edit' button to the EditCommand

<GridViewColumn Header="Action">
    <GridViewColumn.CellTemplate>
        <DataTemplate>
            <StackPanel>
                <Button Content="Edit" 
                        Command="{Binding EditCustomer}" 
                        CommandParameter="{Binding}"/>
            </StackPanel>
        </DataTemplate>
    </GridViewColumn.CellTemplate>
</GridViewColumn>

Wifi Geolocation

2009-12-01T22:47:00.002+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2009/12/wifi-geolocation/

Playing around with Google Latitude I was VERY surprised to see Latitude work out my exact location. How are they doing this? I don't have a GPS in my netbook?

Turns out they use wifi location to do this. When Latitude determines your location it gathers up a list of all the nearby Wifi SSIDs / MAC addresses and sends this to Google. Google have a database of Wifi access point locations created by driving cars around. This database, in combination with the nearby Wifi details, is used to determine your location. Pretty amazing that this actually works! Skyhook wireless is the first company I heard about building a Wifi database.

Always curious to see this stuff in action I fired up Fiddler to see exactly what is being sent to determine my location.

Request:

POST /loc/json HTTP/1.1

{
  "access_token": "2:Fv--0aj9-Vr4_3ir:8uFyciMoILwtrXry", 
  "host": "lfkq9vbe9u4sg98ip8rfvf00l7atcn3d.ig.ig.gmodules.com", 
  "radio_type": "unknown", 
  "request_address": false, 
  "version": "1.1.0", 
  "wifi_towers": [
    {
      "mac_address": "00-0b-6b-81-7b-14", 
      "signal_strength": -72, 
      "ssid": "OA0509-0077-1-M"
    }, 
    {
      "mac_address": "00-0b-6b-81-7d-0d", 
      "signal_strength": -78, 
      "ssid": "OA0509-0096-1-1"
    }, 
    {
      "mac_address": "00-0b-6b-81-7d-0f", 
      "signal_strength": -85, 
      "ssid": "OA0509-0052-2-1"
    }, 
    {
      "mac_address": "00-0b-6b-81-7d-29", 
      "signal_strength": -80, 
      "ssid": "OA0509-0096-2-1"
    }, 
    {
      "mac_address": "00-0b-6b-81-7d-8a", 
      "signal_strength": -82, 
      "ssid": "OA0509-0101-1-1"
    }, 
    {
      "mac_address": "00-0b-6b-81-7e-bd", 
      "signal_strength": -79, 
      "ssid": "OA0509-0052-1-1"
    }, 
    {
      "mac_address": "00-22-3f-9b-f1-a4", 
      "signal_strength": -61, 
      "ssid": "2/107"
    }
  ]
}

Response:

{
  "location": {
    "accuracy": 165.0, 
    "latitude": -33.874097499999998, 
    "longitude": 151.20640280000001
  }
}

Want to add geolocation to your own web application? Check out the Google Gears Geolocation API, or the Firefox's geolocation object

Sending a DKIM Signed Email from C#

2009-09-20T00:09:00.003+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2009/09/sending-a-dkim-signed-email-from-c/

First off this code is intended to be instructional only! Yes it is possible to send a DKIM email from .net's SmtpClient. But there are a few hacks/warnings to go with the following code. I'm pretty sure DKIM is designed for signatures to be added by the STMP server. All the emails I've seen with DKIM signatures sign headers that would only be available to the server, e.g: Message-ID and Received. What does the RFC 4871 have to say about this:

Note that verifiers may treat unsigned header fields with extreme skepticism, including refusing to display them to the end user or even ignoring the signature if it does not cover certain header fields. For this reason, signing fields present in the message such as Date, Subject, Reply-To, Sender, and all MIME header fields are highly advised.

Second: We need to sign the message body exactly as SmtpClient is going to deliver it to the SMTP server. Unfortunately MailMessage doesn't give us access to this. I've found some code to do the Quoted-printable encoding here: Nice Clean C# Generate Quoted-Printable. Still we couldn't guarantee we are going to hash the body exactly as SmtpClient is going to send. In this example I'm just replacing the carriage returns for an extremely simple sample email.

Let's get started. First use OpenSSL to generate your public and private keys: DomainKeys Public/Private Key-pair Generation. Now add the public key to the relevant TXT record on the domain you intend to send email from. I bought a cheap .info domain for this demo, and pointed the registrar to ZoneEdit. I had no trouble adding to TXT record to my domain via ZoneEdit.

...and now the code: (again I'm using Bouncy Castle Crypto APIs to create the signature)

string smtp = "~~ YOUR STMP SERVER HERE ~~";
string from = "russ@dkimtester.info";
string subject = "dkim test email";
string to = "check-auth@verifier.port25.com";
string body = "This is the body of the message." + Environment.NewLine + "This is the second line";
string base64privatekey = @"-----BEGIN RSA PRIVATE KEY-----
~~ YOUR PRIVATE KEY HERE ~~
-----END RSA PRIVATE KEY-----";

HashAlgorithm hash = new SHA256Managed();
// HACK!! simulate the quoted-printable encoding SmtpClient will use
string hashBody = body.Replace(Environment.NewLine, "=0D=0A") + Environment.NewLine;
byte[] bodyBytes = Encoding.ASCII.GetBytes(hashBody);
string hashout = Convert.ToBase64String(hash.ComputeHash(bodyBytes));
// timestamp  - seconds since 00:00:00 on January 1, 1970 UTC
TimeSpan t = DateTime.Now.ToUniversalTime() - DateTime.SpecifyKind(DateTime.Parse("00:00:00 January 1, 1970"), DateTimeKind.Utc);

string signatureHeader = "v=1; " +
 "a=rsa-sha256; " +
 "c=relaxed/relaxed; " +
 "d=dkimtester.info; " +
 "s=p; " +
 "t=" + Convert.ToInt64(t.TotalSeconds) + "; " +
 "bh=" + hashout + "; " +     
 "h=From:To:Subject:Content-Type:Content-Transfer-Encoding; " +
 "b="; 

string canonicalizedHeaders =
"from:" + from + Environment.NewLine +
"to:" + to + Environment.NewLine +
"subject:" + subject + Environment.NewLine +
@"content-type:text/plain; charset=us-ascii
content-transfer-encoding:quoted-printable
dkim-signature:" + signatureHeader;

TextReader reader = new StringReader(base64privatekey);
Org.BouncyCastle.OpenSsl.PemReader r = new Org.BouncyCastle.OpenSsl.PemReader(reader);
AsymmetricCipherKeyPair o = r.ReadObject() as AsymmetricCipherKeyPair;
byte[] plaintext = Encoding.ASCII.GetBytes(canonicalizedHeaders);
ISigner sig = SignerUtilities.GetSigner("SHA256WithRSAEncryption");
sig.Init(true, o.Private);
sig.BlockUpdate(plaintext, 0, plaintext.Length);
byte[] signature = sig.GenerateSignature();
signatureHeader += Convert.ToBase64String(signature);

MailMessage message = new MailMessage();
message.From = new MailAddress(from);
message.To.Add(new MailAddress(to));
message.Subject = subject;
message.Body = body;

message.Headers.Add("DKIM-Signature", signatureHeader);
SmtpClient client = new SmtpClient(smtp);
client.Send(message);
Console.Write("sent to: " + to);

An email sent to gmail gets the cool "signed-by" info:

Verifying a DKIM signature in C#

2009-08-30T23:44:00.008+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2009/08/verifying-a-dkim-signature-in-c/

Quick background: DomainKeys Identified Mail (DKIM) is a digital signature and hash which are placed on your emails to verify they are coming from the domain they claim to be. One step in the defence against SPAM and phishing emails.

What does the signature look like. Here's a signature grabbed from an email sent from Yahoo mail:

DKIM-Signature: 
 v=1; 
 a=rsa-sha256; 
 c=relaxed/relaxed; 
 d=yahoo.com.au; 
 s=s1024; 
 t=1250214285; 
 bh=cHSvmWBBhlnc7HYJ0cXdBZfzQDwcJskaGayavbFvzSY=; 
 h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; 
 b=gsz2P/9h3SL8PwBIU8g9dMGnHI+mwfSqjDhrkJljG3HNCbL0I4/DZJBGHnuqRwgpP4Rq0K3E/1z2Zwez4OhMI+naVzGg0P0ePG75GOwfXvl0XBvN8x8j1pgIOS8KQS24E1+6RogWIKJR2mht+KwiFK5uq3BYc9+nC9XMWsIE1fw=

Verifying a signature is going to require a public key. The public key is grabbed from a TXT record on the sender's the domain. The domain name is built with the "s" and "d" tags above. "s" + "._domainkey." + d = "s1024._domainkey.yahoo.com.au".

Using nslookup from the command prompt give us:

C:\>nslookup
Default Server:  DD-WRT
Address:  192.168.1.1

> set type=TXT
> s1024._domainkey.yahoo.com.au
Server:  DD-WRT
Address:  192.168.1.1

Non-authoritative answer:
s1024._domainkey.yahoo.com.au   text =

        "k=rsa; t=y; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDrEee0Ri4Juz+QfiWYui/E9UGSXau/2P8LjnTD8V4Unn+2FAZVGE3kL23bzeoULYv4Pel
eB3gfm"
        "JiDJOKU3Ns5L4KJAUUHjFwDebt0NP+sBK0VKeTATL2Yr/S3bT/xhy+1xtj4RkdV7fVxTn56Lb4udUnwuxK4V5b5PdOKj/+XcwIDAQAB; n=A 1024 bit key
;"

The "b=" tag in DKIM-Signature is a signature of the canonicalized headers. The canonicalization process is done to make sure the signature is resilient to header modifications by mail servers. In this example we are using the 'relaxed' canonicalization algorithm. (Much more details about canonicalization in the RFC4871).

The original headers:

Message-ID: <88014.32082.qm@web112514.mail.gq1.yahoo.com>
X-YMail-OSG: aJFcCYUVM1mfioaf5zF7Pv_aQQ27DjD57ShG_QdRO6jTz5SGM4lVBkiJ1SD0tZmtvLEHhR4YtNFpTpI26b3VFERE44rlTAN3nP7a9.snzPvxcIIVOy6d0XWg1fvWS5bpOInMbv7M0bltJc6ml3gWPn8S3tT6U.Wz4OXu22meLo5VrikBRKeSGItA5Kw5Asn20GT84javGzv9_3znhG0HMejyHxpDjDbn.C_9OpKMVheG6HmBpgFVYmsW9q2IKc4r08YZvyADKNKnjN066fNhCNaYKWu3PEpHpbV4pZf66cFChegx94phIMQCI0cScc8ZQ5BLRj7qwV2F85C2ib22DWbZvTY-
Received: from [114.76.223.211] by web112514.mail.gq1.yahoo.com via HTTP; Thu, 13 Aug 2009 18:44:43 PDT
X-Mailer: YahooMailRC/1358.27 YahooMailWebService/0.7.338.2
Date: Thu, 13 Aug 2009 18:44:43 -0700 (PDT)
From: Russell Sayers 
Subject: from yahoo
To: diagnostic@smtp2web.com
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1193717202-1250214283=:32082"

After relaxed canonicalization:

message-id:<88014.32082.qm@web112514.mail.gq1.yahoo.com>
x-ymail-osg:aJFcCYUVM1mfioaf5zF7Pv_aQQ27DjD57ShG_QdRO6jTz5SGM4lVBkiJ1SD0tZmtvLEHhR4YtNFpTpI26b3VFERE44rlTAN3nP7a9.snzPvxcIIVOy6d0XWg1fvWS5bpOInMbv7M0bltJc6ml3gWPn8S3tT6U.Wz4OXu22meLo5VrikBRKeSGItA5Kw5Asn20GT84javGzv9_3znhG0HMejyHxpDjDbn.C_9OpKMVheG6HmBpgFVYmsW9q2IKc4r08YZvyADKNKnjN066fNhCNaYKWu3PEpHpbV4pZf66cFChegx94phIMQCI0cScc8ZQ5BLRj7qwV2F85C2ib22DWbZvTY-
received:from [114.76.223.211] by web112514.mail.gq1.yahoo.com via HTTP; Thu, 13 Aug 2009 18:44:43 PDT
x-mailer:YahooMailRC/1358.27 YahooMailWebService/0.7.338.2
date:Thu, 13 Aug 2009 18:44:43 -0700 (PDT)
from:Russell Sayers 
subject:from yahoo
to:diagnostic@smtp2web.com
mime-version:1.0
content-type:multipart/alternative; boundary="0-1193717202-1250214283=:32082"

Now the canonicalized signature, minus the "b=" value. is placed after the headers. This had me scratching my head for a bit until I read this from the RFC:

The header field MUST be presented to the hash algorithm after the body of the message rather than with the rest of the header fields and MUST be canonicalized as specified in the "c=" (canonicalization) tag. The DKIM-Signature header field MUST NOT be included in its own h= tag..

We now have everything we need to verify the signature on the email using Bouncy Castle Crypto APIs

string base64pubkey = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDrEee0Ri4Juz+QfiWYui/E9UGSXau/2P8LjnTD8V4Unn+2FAZVGE3kL23bzeoULYv4PeleB3gfmJiDJOKU3Ns5L4KJAUUHjFwDebt0NP+sBK0VKeTATL2Yr/S3bT/xhy+1xtj4RkdV7fVxTn56Lb4udUnwuxK4V5b5PdOKj/+XcwIDAQAB";
RsaKeyParameters pubKey = PublicKeyFactory.CreateKey(Convert.FromBase64String(base64pubkey)) as RsaKeyParameters;
byte[] signature = Convert.FromBase64String("gsz2P/9h3SL8PwBIU8g9dMGnHI+mwfSqjDhrkJljG3HNCbL0I4/DZJBGHnuqRwgpP4Rq0K3E/1z2Zwez4OhMI+naVzGg0P0ePG75GOwfXvl0XBvN8x8j1pgIOS8KQS24E1+6RogWIKJR2mht+KwiFK5uq3BYc9+nC9XMWsIE1fw=");

string canonicalized =
@"message-id:<88014.32082.qm@web112514.mail.gq1.yahoo.com>
x-ymail-osg:aJFcCYUVM1mfioaf5zF7Pv_aQQ27DjD57ShG_QdRO6jTz5SGM4lVBkiJ1SD0tZmtvLEHhR4YtNFpTpI26b3VFERE44rlTAN3nP7a9.snzPvxcIIVOy6d0XWg1fvWS5bpOInMbv7M0bltJc6ml3gWPn8S3tT6U.Wz4OXu22meLo5VrikBRKeSGItA5Kw5Asn20GT84javGzv9_3znhG0HMejyHxpDjDbn.C_9OpKMVheG6HmBpgFVYmsW9q2IKc4r08YZvyADKNKnjN066fNhCNaYKWu3PEpHpbV4pZf66cFChegx94phIMQCI0cScc8ZQ5BLRj7qwV2F85C2ib22DWbZvTY-
received:from [114.76.223.211] by web112514.mail.gq1.yahoo.com via HTTP; Thu, 13 Aug 2009 18:44:43 PDT
x-mailer:YahooMailRC/1358.27 YahooMailWebService/0.7.338.2
date:Thu, 13 Aug 2009 18:44:43 -0700 (PDT)
from:Russell Sayers &lt;russell_sayers@yahoo.com.au&gt;
subject:from yahoo
to:diagnostic@smtp2web.com
mime-version:1.0
content-type:multipart/alternative; boundary=""0-1193717202-1250214283=:32082""
dkim-signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com.au; s=s1024; t=1250214285; bh=cHSvmWBBhlnc7HYJ0cXdBZfzQDwcJskaGayavbFvzSY=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; b=";
byte[] message = Encoding.ASCII.GetBytes(canonicalized);


ISigner sig = SignerUtilities.GetSigner("SHA256WithRSAEncryption");
sig.Init(false, pubKey);
sig.BlockUpdate(message, 0, message.Length);
if (sig.VerifySignature(signature))
{
    Console.WriteLine("all good!");
}

Windows Azure - SlashView

2009-04-05T17:30:00.002+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2009/04/windows-azure-slashview/

Update (18-Sept-2009): Hot off twitter: Introducing the Windows Azure Service Management API - my wish (below) has been granted. :)

Here's my first attempt playing around with Azure: SlashView

The idea behind the site is pretty simple - I've got a worker process scraping all the comments off Slashdot every 10 minutes. I get all the stats off the comments, and display the results in a Silverlight graph.

The learning curve for Azure isn't too steep if you are already an ASP.NET developer. The only new technology I've had come up to speed with is the deployment process, and the table/blog storage services.

Some indispensable resources I've discovered along the way:

Azure Storage Explorer - From the codeplex description: "Azure Storage Explorer is a useful GUI tool for inspecting the data in your Azure cloud storage projects including the logs of your cloud-hosted applications. All three types of cloud storage can be viewed: blobs, queues, and tables."
Windows Azure Walkthrough: Blob Storage Sample - good introduction to blob storage
Azure Storage Services Test Harness: Table Services 1 – Introduction and Overview - contains some info on paging table storage data (which I'm yet to implement)
REST API Reference for Windows Azure Storage Service - rather than totally relying on the StorageClient library that comes with all the samples.
Interesting tidbit - all the azure domains appear to have unique IPs. I just assumed everything would be going thru host headers. This makes it possible to use your own domain for an Azure app: Custom Domain Names in Windows Azure.
I would assume this also makes it possible to add an SSL cert to as Azure app (Enabling SSL Connections on Windows Azure). The MSDN article is a bit light on details, it sounds like you go thru the CSR/purchase cert process away from Azure. Then ensure you can export the cert to have to included in a deploy?

Wish list: an automated deploy. It can take a long while to 'Suspend', 'Delete', 'Deploy' from the developer portal..

Windows Azure - Getting Started

2009-03-01T10:04:00.007+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2009/02/windows-azure-getting-started/

Windows Azure - so where do you get started? Some links:

Dare Obasanjo's Windows Azure from a Developer's Perspective - cuts though all the info that is out there and spells out exactly what a developer can expect from Azure.
Katrien De Graeve Windows Azure – installing SDK, tools and creating a first cloud project - has the link to request a evaluation token. Two days after after filling out the survey I got an "Invitation Code to Microsoft .NET Services and Microsoft SQL Services", a day after this I got an "Invitation Code to Windows Azure". Katrien's article also contains links to the SDK and Visual Studio tools you will need to get started.
Maarten Balliauw's - CarTrackr on Windows Azure.
First road block - trying to run an Azure project in Visual Studio requires 'elevated privileges'. So (at least in Vista) you'll need do a right-click 'run as administrator' when you fire up Visual Studio. The issue is described in : Microsoft Virtual Earth on Windows Azure
Getting Table Storage to work: Windows Azure Walkthrough: Simple Table Storage

I've done articles on Amazon's EC2 and Google's AppEngine - so I guess I'm obligated to do an Azure article, right? :)

I do have an Azure idea in the works. It's not very exciting to write an app that is barely different to something I could do on my cheap ASP.NET hosting. Something that cheap hosting doesn't offer is an easy way to write a background processing application such as the Azure worker role. So I've revived a 'shelved' screen scraping application. The idea is to pull down all the comments on Slashdot articles, and generate some visualization of the comments growing over time.

Silverlight 2: MVVM, Databinding & Cascading ComboBoxes - Part 2

2009-02-18T20:05:00.003+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2009/02/silverlight-2-mvvm-databinding-cascading-comboboxes-part-2/

So I've finally got a fix for this issue. The solution does feel like a bit of a hack - but I can understand why I need to go down this path. Hopefully one of the people who read this post will be inspired to come up with a more elegant solution!

See a demo of 'cascading ComboBoxes in Silverlight 2', and get the source here: CitiesVisited_step3.zip.

I finished the last post with two possible solutions. The first option was to bind the 'cities' ComboBox to a collection containing a union of all the possible cities - and toggling a visibility property as the country changes. I attempted to code this, but it had two strange side effects. The text part of the drop down, e.g. just where it has 'Melbourne', became unresponsive to mouse clicks. And the ComboBoxListItems with Visibility toggles to collapsed still appeared in the ComboBox empty and a few pixels tall.

The second option was two combine the previous/new lists of cities just at the time when Visit.City is being databound, then removed all previous cities. This approach I did get to work!

The PageViewModel gets two new properties BindCity and BindableCities bound to the cities ComboBox. BindCity is just a wrapper for _SelectedVisit.City, this exists so I can control when the UI is notified about the city change.

public City BindCity
{
    get { return _SelectedVisit.City; }
    set
    {
        _SelectedVisit.City = value;
        OnPropertyChanged("BindCity");
    }
}


public ObservableCollection<City> BindableCities
{
    get { return _BindableCities; }
}

<ComboBox 
    ItemsSource="{Binding BindableCities}" 
    SelectedItem="{Binding BindCity, Mode=TwoWay}" 
    DisplayMemberPath="Name"/>

The SelectedVisit setter is now doing a lot more. There are two scenarios where I need to update the BindableCities collection: when the SelectedVisit is changed (by clicking on a left-hand visit), and when the Country ComboBox is changed. When a new SelectedVisit is set by the databinding, the SwitchBindableCities method populates the BindableCities with the combination of cities. Here I'm also attaching to the PropertyChanged event of the SelectedVisit - to populate the BindableCities when the Country ComboBox changes.

public Visit SelectedVisit
{
    get { return _SelectedVisit; }
    set
    {
        if (_SelectedVisit != null)
        {
            _SelectedVisit.PropertyChanged -= new PropertyChangedEventHandler(_SelectedVisit_PropertyChanged);
        }
        _SelectedVisit = value;
        _SelectedVisit.PropertyChanged += new PropertyChangedEventHandler(_SelectedVisit_PropertyChanged);

        SwitchBindableCities(true);
        OnPropertyChanged("SelectedVisit");
    }
}

void _SelectedVisit_PropertyChanged(object sender, PropertyChangedEventArgs e)
{
    // the country property of the visit has changed
    // update the bindable cities
    if (e.PropertyName == "Country")
    {
        SwitchBindableCities(false);
    }
}

Where it all happens. The SwitchBindableCities method:

First 'if': we've arrived here from someone changing a Country drop down, set the _SelectedVisit.City to null. E.g someone changing from Australia/Melbourne to United States. The City=Melbourne gets set to null.
Second 'if': we've arrived here from someone toggling between Visits. If the BindableCities collection already contains what we want - it is save to allow the data binding to happen, then we can exit with the BindableCities untouched.
The remainder of the method changes the list of cities. First it stores the list of cities presently in BindableCities. Adds the 'new' cities to the collection. Then raises the property changed on BindCity. The UI now does the binding when the BindableCities collection contains the UNION of cities. Now its safe to remove the original list of cities from BindableCities.

private void SwitchBindableCities(bool visitChanged)
{
    if (!visitChanged)
    {
        // changed the country, and the visit city isn't in that
        // country - so set the city to null
        _SelectedVisit.City = null;
    }

    if (visitChanged && _BindableCities.Contains(_SelectedVisit.City))
    {
        // the selected vist city IS in the selected country
        // and already in the bindable cities
        OnPropertyChanged("BindCity");
        return;
    }

    List<City> toBeRemoved = _BindableCities.ToList();
    foreach (City c in _SelectedVisit.Country.Cities)
    {
        _BindableCities.Add(c);
    }

    // tell the UI that the bind city has changed
    OnPropertyChanged("BindCity");

    foreach (City c in toBeRemoved)
    {
        _BindableCities.Remove(c);
    }
}

Silverlight 2: MVVM, Databinding & Cascading ComboBoxes - Part 1

2009-02-17T23:33:00.003+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2009/02/silverlight-2-mvvm-databinding-cascading-comboboxes-part-1/

Update: see follow up post to see how I got the cascading ComboBoxes to work: I did mange to get a 'working' solution for cascading ComboBoxes - see the solution here: Silverlight 2: MVVM, Databinding & Cascading ComboBoxes - Part 2

I'm presently working on a Silverlight 2 application at work, and really enjoying the getting into the new technology. Hitting a few issues along the way that are going to make good blog articles when I find the time. This article intends to be the first in a series to demonstrate some of the issues I'm discovering.

Issue no. 1: Databinding Cascading ComboBoxes to a ViewModel.

If you've been following Silverlight 2 developer blogs you'll notice Model-View-ViewModel (MVVM) is a popular separation pattern for UI. Luckily Craig of ConceptDev has already pulled together a good list of links for those wanting to read up on MVVM: Silverlight + Model-View-ViewModel (MVVM). My first introduction to MVVM was the Divelog app from Jonas Follesø. The Divelog app is a good introduction to several concepts: silverlight unit tests, dependency injection, command pattern and MVVM

The actual problem. Let's say we are building an app of all the cities you've visited around the world. The Model classes involved: A Country class contains a collection of Cities, and a Visit class contains references to a Country and a City. The PageViewModel contains: Countries collection of all countries, Visits collection of all visit, and a SelectedVisit property.

The databinding seems simple...

...but clicking on the 2nd visit causes the city on the first option to disappear. See a demo of the issue: here.

Anything related to databinding issues is best understood by attaching some 'do nothing' Converter classes. Inside the Converter I've added debugging statements to try work out what order things are happening. The debugging output from the Converters looks like this:

The statements after the red line were created after the second option was clicked. This is how I interpreted the output after the red line:

The ItemSelected property of the countries ComboBox is set to 'United States'
The ItemSource property of the cities ComboBox is populated with the cities belonging to the 'United States'
The interesting bit: ConvertBack is telling us that the city selected in the first option (previously Melbourne) is now null!

My theory: in step number 2 we are changing the contents of a ComboBox still bound to the 'Melbourne' visit. The databinding between the ComboBox and Visit.City fires, cannot find a city in the Visit.Country.Cities and interprets this as null.

The fix.... comes in my next blog post. I've experimented with two approaches for the issue. Approach 1: binding the city ComboBox to a different collection which is temporarily populated with the ALL the possible cities when the PageViewModel.SelectedVisit changes. Approach 2: again populate the city ComboBox will all possible cities - and use databinding to modify the city's visibility.

Grab the source code for this demo: CitiesVisited_step1.zip

Google App Engine - Tetris Challenge

2008-12-02T22:51:00.000+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2008/12/google-app-engine-tetris-challenge/

Here's my attempt to learn Google App Engine / python: The Tetris code challenge, you write a tetris playing algorithm, and the app challenges your algorithm.

Anyone can write an auto-player algorithm in anything that can do cgi: php, asp.net, jsp, etc. I've provided a sample client that can easily be hosted on App Engine itself.

Check it out here: http://tetrisapp.appspot.com/ - it will default to my sample algorithm.. You'll need a gmail/google account to log in.

Read more on how to write your own algorithm here: http://tetrisapp.appspot.com/static/howto.html

Its a bit rough at the moment.. If you struggle with any of the details let me know - I really need to get the documentation a bit more readable. I've got more features to add, depending on how popular it is..

IIS, SSL and Host-Headers

2008-11-24T21:31:00.007+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2008/11/iis-ssl-and-host-headers/

Update (3-Aug-2010): Multiple SSL domains on a single IP are now possible using Unified Communications UC SSL Certificates (Subject Alternative Name) - see my follow up article: Subject Alternative Names for SSL

Here's a knowledge base article I use to explain why an SSL site needs its own IP address: HTTP 1.1 host headers are not supported when you use SSL. Host headers allow a web server to host several websites on the same IP address. When a browser makes a request the domain name of the website is passed in the request host header. The server uses this to check against the list of websites it is serving. When this is combined with SSL the server needs to know which website's private certificate to establish the secure session - which is impossible as the session is established before any HTTP headers are sent.

Yet the article says: "Beginning in Windows Server 2003 Service Pack 1 (SP1) and IIS 6.0, Secure Sockets Layer (SSL) host headers are supported in IIS.", and points you to the article: Configuring SSL Host Headers (IIS 6.0). So we are all covered now? Well, no. The issue of SSL session being established before the host header still exists. IIS 6 only supports host headers where all the sites being served use the same wildcard SSL certificate; e.g. *.mydomain.com.au. The server doesn't need to know the host header when establishing the session, as there is only one certificate to choose from.

Why not include the the host header when we establish SSL? That is the plan of Server Name Indication - this does mean web browsers and servers all need to be updated to support the new standard. So it will be a while before SNI is well supported on the web.

Amazon EC2 - Now with Windows Server 2003!

2008-10-25T13:48:00.007+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2008/10/amazon-ec2-now-with-windows-server-2003/

Amazon EC2 now supports Windows Server 2003 based virtual machines: Amazon Elastic Compute Cloud (EC2) Running Microsoft Windows Server and SQL Server. Grab a Windows virtual machine for $USD0.125 an hour.

Quick recap: EC2 is akin to virtual private server hosting, where you pay by the hour. EC2 is administered via a service that allows you instantly create any number of virtual machines, and manage firewall rules.

I was going to write up a quick guide on firing up a Windows box - but this has already been covered well in the Getting Started Guide

Some lessons learned along the way: I had to download the new EC2 API tools - extracted into a new folder the 'ec2-describe-keypairs' knew about keys I'd created previously. Where do the keys actually get stored? ec-add-keypair explains what is happening - your public key is sent to Amazon's servers. Your private key you save to a file - in the Linux world you use this private key in Putty to connect to your server. In the Windows world you pass your private key file to ec2-get-password to get your server password from Amazon.

Playing with JQuery and ASP.NET MVC

2008-10-06T17:16:00.004+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2008/10/playing-with-jquery-and-asp-net-mvc/

UPDATE: Thanks for the comment Chris. I guess after years of wrestling with Javascript I didn't think of reading in the UI elements to set the cookie. If the cookie was storing something like timezones, I could stick the timezone key into an expando property of the div - nice!

I've updated the source code zip, and the demo.

jQuery and ASP.NET MVC have both caught my eye as interesting web technologies. ASP.NET MVC is a Model-View-Controller approach to web development in .net. I've heard it described as Microsoft thinking up another way they could've upgraded from ASP Classic to ASP.NET. jQuery is a very handy javascript library which abstracts a lot of standard client-side functionality into a cross-browser library, e.g DHTML and Ajax. Microsoft must agree on the usefulness of jQuery - as Microsoft have plans to include jQuery in their own products: jQuery and Microsoft.

To get my hands dirty with ASP.NET MVC and jQuery I'm using it to rebuild a languishing project of mine: www.time2call.net. I've developed a little spike to test a timezone picker scenario. There's a few design goals I had in mind:

An ajax 'picker' - displays the results via Ajax, stores the options in a cookie. Subsequent visits can re-create the UI server-side.
The same server-side code to build UI HTML for Ajax AND 'from cookie' page load. I.e no duplication of HTML build code client-side and server-side.
Minimal / incredibly readable client side-code.
All the whizzy Ajax loading animation people expect.
Maintain Ajax context, so options appear on the page in the order they were clicked, regardless of the order of processing on the server.

See the spike: here - grab the code: MvcJQueryMuckingCode.zip. The code is built against ASP.NET MVC Preview 5.

Some notes / questions:

jQuery Callback Contexts - maintaining context between Ajax request / response.
Partial Rendering & View Engines in ASP.NET MVC - rendering the ViewUserControl for the Ajax request.
Passing ViewData from Controllers to Views - I don't get the "ViewData.Products" style accessor in my example - I'm accessing the collection through "ViewData.Model". Is this something that's changed in release 5?
To remove a color option I pick up the position of delete link:
```
var index = $('.delLink').index(this);
```
Then use this to get the DIV in the same position:
```
$('#fldColors > div').eq(index)...
```
Is there a better way of doing this?
When I delete an option I'm expecting the color DIVs to be in the same position as the options in the cookie. That's why I remove the DIV in the fadeout callback. So there's 500ms there where that could go wrong :(. I experimented with selecting just the 'visible' DIVs. But the the div's display style remains 'block' until it disappears.

Converting Timezones in .net

2008-10-01T19:20:00.020+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2008/10/converting-timezones-in-net/

Ever had the need to convert a date/time to another timezone? I had to do it a while back to display publishing deadlines for a website used in Australia and New Zealand. Back then I used a wrapper for the kernel32 function SystemTimeToTzSpecificLocalTime from the CodeProject article Convert between UTC (Universal Co-ordinated Time) and local time. As of version 3.5 of the framework there is now the TimeZoneInfo class making this much easier to do in managed code. But both come with some small caveats.

The API function works with daylight saving data retrieved from the registry. To use it you extract the data in the registry key "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\[Timezone name]\Tzi", and memcopy this into a TIME_ZONE_INFORMATION structure.

The TIME_ZONE_INFORMATION structure contains two SYSTEMTIME structures StandardDate, and DaylightDate date - which specify when the people in this timezone wind their clocks back / forward. This value in the registry is only ever the daylight rules for 'right now' - so we can run into problems with dates ~12 months outside of this range. Windows treats these rules as if they have been in effect forever - even when they are changed by a Windows Update.

As an example: lets say we are working on an app that stores ATM transactions in UTC time - we want to convert them to a local time to print onto statements for a bank in Los Angeles. A customer made withdrawals at UTC times: 31-Mar-2006 17:00, and 31-Mar-2007 17:00. The code to convert the UTC time using the wrapper from the CodeProject article looks like this:

DateTime utcTime = DateTime.Parse("2006-03-31T17:00:00");
DateTime converted = TimeZoneInformation.FromUniversalTime("Pacific Standard Time", utcTime);
Console.WriteLine(converted.ToString("s"));

utcTime = DateTime.Parse("2007-03-31T17:00:00");
converted = TimeZoneInformation.FromUniversalTime("Pacific Standard Time", utcTime);
Console.WriteLine(converted.ToString("s"));

Which gives:

UTC:2006-03-31T17:00:00 Los Angeles:2006-03-31T10:00:00
UTC:2007-03-31T17:00:00 Los Angeles:2007-03-31T10:00:00

So 5pm UTC converts to 10pm in LA - sounds about right? Well no.. I've obviously picked some dates where the daylight settings in the registry give us the wrong conversion. From 1987 to 2006 the USA East coast wound their clocks forward on the first Sunday of April, this changed in 2007 to the second Sunday of March. So on 31-Mar-2006 daylight savings hadn't kicked in, LA should've been 8 hours behind UTC. On 31-Mar-2007 daylight savings did apply - and we've correctly calculated LA time as 7 hours behind UTC. Windows is applying the second Sunday of March rule in 2006 - as this is the only rule it knows about.

That is - unless you are on Vista or Server 2008. The newer version of the Windows API is able to read the DYNAMIC_TIME_ZONE_INFORMATION - from a collection of multiple rules in the "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\[Timezone name]\Dynamic DST".

Enter the .net TimeZoneInfo class - lucky for us this class can interpret the dynamic DST data from the registry (even in XP). Here's the previous example using the TimeZoneInfo class:

TimeZoneInfo tzi = TimeZoneInfo.FindSystemTimeZoneById("Pacific Standard Time");
DateTime utcTime = DateTime.Parse("2006-03-31T17:00:00");
DateTime converted = TimeZoneInfo.ConvertTimeFromUtc(utcTime, tzi);
Console.WriteLine("UTC:{0:s} Los Angeles:{1:s}", utcTime, converted);

utcTime = DateTime.Parse("2007-03-31T17:00:00");
converted = TimeZoneInfo.ConvertTimeFromUtc(utcTime, tzi);
Console.WriteLine("UTC:{0:s} Los Angeles:{1:s}", utcTime, converted);

The output:

UTC:2006-03-31T17:00:00 Los Angeles:2006-03-31T09:00:00
UTC:2007-03-31T17:00:00 Los Angeles:2007-03-31T10:00:00

Seeing what I expect for the 2006 date. So everything is covered? Well no.. :)

The full list of daylight rules is VERY complicated - lots of governments worldwide seem to like messing with daylight rules. The new registry rules are not populated with historic rules. For example Sydney changed the rules for the Olympic games in 2000 - the daylight transition was on the last Sunday of August, rather than the last Sunday in October. Try converting a date in September 2000 - we should get the usual 10 hours difference plus 1 hour for daylight time. And we get:

UTC:2000-09-15T00:00:00 Sydney:2000-09-15T10:00:00

This conversion website gives the results we expect: here.

We can actually look in the TimeZoneInfo GetAdjustmentRules() and see the list of rules Windows knows about.

TimeZoneInfo tzi = TimeZoneInfo.FindSystemTimeZoneById("AUS Eastern Standard Time");
int i = 0;
foreach (TimeZoneInfo.AdjustmentRule adj in tzi.GetAdjustmentRules())
{
    i++;
    Console.WriteLine("AdjustmentRule " + i);
    Console.WriteLine("adj.DateStart = " + adj.DateStart);
    Console.WriteLine("adj.DateEnd = " + adj.DateEnd);
    Console.WriteLine(String.Format("adj.DaylightTransitionStart = Day: {0}, DayOfWeek: {1}, Month: {2}, TimeOfDay: {3}, Week: {4}", adj.DaylightTransitionStart.Day,
        adj.DaylightTransitionStart.DayOfWeek,
        adj.DaylightTransitionStart.Month,
        adj.DaylightTransitionStart.TimeOfDay.ToShortTimeString(),
        adj.DaylightTransitionStart.Week));
    Console.WriteLine(String.Format("adj.DaylightTransitionEnd = Day: {0}, DayOfWeek: {1}, Month: {2}, TimeOfDay: {3}, Week: {4}", adj.DaylightTransitionEnd.Day,
        adj.DaylightTransitionEnd.DayOfWeek,
        adj.DaylightTransitionEnd.Month,
        adj.DaylightTransitionEnd.TimeOfDay.ToShortTimeString(),
        adj.DaylightTransitionEnd.Week));
    Console.WriteLine("adj.DaylightDelta = " + adj.DaylightDelta);
    Console.WriteLine();
}

The output:

AdjustmentRule 1
adj.DateStart = 1/01/0001 12:00:00 AM
adj.DateEnd = 31/12/2007 12:00:00 AM
adj.DaylightTransitionStart = Day: 1, DayOfWeek: Sunday, Month: 10, TimeOfDay: 2:00 AM, Week: 5
adj.DaylightTransitionEnd = Day: 1, DayOfWeek: Sunday, Month: 3, TimeOfDay: 3:00 AM, Week: 5
adj.DaylightDelta = 01:00:00

AdjustmentRule 2
adj.DateStart = 1/01/2008 12:00:00 AM
adj.DateEnd = 31/12/9999 12:00:00 AM
adj.DaylightTransitionStart = Day: 1, DayOfWeek: Sunday, Month: 10, TimeOfDay: 2:00 AM, Week: 1
adj.DaylightTransitionEnd = Day: 1, DayOfWeek: Sunday, Month: 4, TimeOfDay: 3:00 AM, Week: 1
adj.DaylightDelta = 01:00:00

How would you deal with this scenario? The MSDN article for TimeZoneInfo mentions the class can be used for "Creating a new time zone that is not already defined by the operating system." The popular tz database contains a very comprehensive collection of date rules. So I was 'sort of' expecting someone would write the code to import the tz database to custom TimeZoneInfo timezones. Unfortunately a quick google doesn't come up with someone who has already done this for me. An alternative exists to use the tz database in .net: PublicDomain - described in more detail in the CodeProject article: How to Use the Olson Time Zone Database in .NET

Futher reading:

KB928388 Breaking Tests with Windows DST TimeZone Patch and Past Dates - Scott Hanselman running into the same issue.
Exploring Windows Time Zones with System.TimeZoneInfo

ASP.NET Defending Against Form Hackers

2008-09-21T23:05:00.002+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2008/09/asp-net-defending-against-form-hackers/

Something I've pondered previously: an ASP.NET page is populated with data retrieved from ViewState, is it possible to falsify the ViewState in the POST and trick the server into doing something that it shouldn't. In other words, a scenario where the original developer is just "trusting" information coming from ViewState.

Here's an example - a company 'extranet' application which gives me an admin page to manage the username/passwords of my subordinate users. Let's guess the "trusting" developer behind this system implements the save by iterating over the GridView rows, and updating the database with the emails / passwords in the textboxes.

My superior's login is 'jvandelay' - of course I'm not able to see his record on my admin screen. After a postback the page is being populated using the data stored in ViewState. Can I craft up some viewstate that will add a row to the dataview, allowing me to update my superior's password?

Seaching around gets some good articles to answer my intial questions.

Can you falsify ViewState? By default: no - From ScottGu's Cool Viewstate Decoder: "Note that ViewState is MAC (message authentication check) encoded to prevent tampering by remote clients. As such, while you can decypher the viewstate settings using the above program, you can't actually change them and repost to the server.". There is a setting "EnableViewStateMac" on the @ Page directive to switch this off, so we can have a play around.
How would you build a falsified ViewState? Paul Wilson's ViewState: All You Wanted to Know give a good intro to the ViewState format, and the LosFormatter class used to serialize/deserialize ViewState

How do you craft up the 'malicious' ViewState? Let's start with deserializing the ViewState using LosFormatter. Paul Wilson's article provides a some code to traverse the object graph. See the results here. Now I can insert the objects into the object graph to fake an extra row in the ViewState. I've modified Paul Wilson's code to give to generate code to access the unwieldy positions in the graph, see the code here.

Here's the code to fake the ViewState, and serialize it back to a string we can put in a browser: here. The fake ViewState can be inserted into the __VIEWSTATE hidden field with the Web Developer extension in Firefox: right-click > Web Developer > Forms > Display Form Details. Click 'Save' and we get...

Foiled by EventValidation - somthing else I can switch off in the @ Page directive. More on Event Validation in K. Scott Allen's ASP.NET Event Validation and “Invalid Callback Or Postback Argument” : Part I. Interestingly the __EVENTVALIDATION value is derived from a hash of UniqueIDs XORed with a hash of the allowed values. Would I be able to fake this also? Maybe I'll follow that up in another blog article...

Anyway with EnableEventValidation off we get:

Success! And I certainly can fill in the email and password details for 'jvandelay' and see them saved! So it is did take quite a few things to come together to make this possible:

the original developer was a little to 'trusting' - the application could be testing if my login is attempting to update a superior's details
ViewState MAC encoding and Event validation needed to be turned off

Release Branches and Bugfixes with Subversion

2008-07-22T20:56:00.002+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2008/07/release-branches-and-bugfixes-with-subversion/

I've finally taken out the time to properly learn about the subversion "trunk, branches, and tags" structure. So while its fresh in my head I thought I'd blog about a common scenario with an extremely contrived example. New to Subversion? Here's the links that got me started:

Version Control with Subversion - a free book about Subversion.
VisualSVN Server - a simple to use (and free!) Subverion server for Windows.
CollabNet Subversion Downloads - a command line server and client.
TortoiseSVN - a Subversion client, implemented as a windows shell extension.

This is the scenario: You've deployed an application to production. A few weeks later development work is continuing on the source tree, when someone finds a bug in production. The development code isn't ready for production, and hasn't been tested. So we want to pull out the production version of the source code, apply a bugfix, reapply the fix to the development tree, and roll out the updated production build. This is a very common scenario outlined in the "Version Control with Subversion" book here: Release Branches.

The fix? In short terms Subversion makes this possible with the following steps. Once code is ready for a production deploy we create a production branch "/TurtlesApp/branches/Production". Any production bugfixes can be carried out in this location and, with the help of Subversion, merged back into the developement tree "/TurtlesApp/trunk"

Step by step: Here's the extremely contrived application ready to go to production. We've created a simple application which reads in an XML file, populates a collection of business objects, and binds this to a GridView.

View Code

Ready for production - create a branch:

Now we have a something that looks like this in the repository: Work continues in the development trunk, with new features are being added. View Code

But in production someone has discovered a bug. They've attempted to add this line to the XML file:

<Turtle Name="Splinter"/>

The code is crashing out attempting to read the 'null' weapon. The development tree hasn't been tested, and isn't ready for production (contrived, I tell you!). So the changes can be made in the 'Production' branch and merged back into the trunk.

Let's say we are doing our dev on the "C:\VS2008\TurtlesApp\trunk" folder. We've got IIS vdirs pointing at this app, and a number of build scripts expect things to be in this location. This is where the svn switch command comes in handy. Using this command we can replace our code in "C:\VS2008\TurtlesApp\trunk" with the production branch.

The bugfix is a simple test for null:

turtle.Name = (node.Attributes["Name"] != null) ? node.Attributes["Name"].Value : null;
turtle.Weapon = (node.Attributes["Weapon"] != null) ? node.Attributes["Weapon"].Value : null;

Let's commit this to the "Production" branch, and we are ready to build and deploy.

The bug still exists in our development trunk. Subversion can merge the changes we've made in production back into development. In the real world a bugfix could impact any number of source files. I start the merge by first switching my directory back to the trunk, getting an update of the source - always a good convention if you are about change a bunch of files - then do the merge.

So what does the Turtle.cs file look like now with the changes merged in...

Turtle turtle = new Turtle();
turtle.Name = (node.Attributes["Name"] != null) ? node.Attributes["Name"].Value : null;
turtle.Weapon = (node.Attributes["Weapon"] != null) ? node.Attributes["Weapon"].Value : null;
turtle.Nickname = node.Attributes["Nickname"].Value;
turtle.Colour = node.Attributes["Colour"].Value;
results.Add(turtle);

Very cool! Subversion has automatically added our production changes to the development branch!

Amazon Elastic Compute Cloud - EC2

2008-04-20T20:20:00.005+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2008/04/amazon-elastic-compute-cloud-ec2/

The Amazon Elastic Compute Cloud (EC2 for short) was recently mentioned on the IT Conversations podcast episode A Web-Scale Computing Architecture. EC2 looks very similar to a Virtual Private Server hosting service - where you rent a virtualized server. On top of this service is a webservice giving you the ability to dynamically create, stop and start multiple server instances. Which makes this service an ideal platform for an application with variable load. For example; a concert ticket website could rent an additional 40 servers when a popular concert is about to go on sale. Or dynamically ramp up the number of servers as load increases. The service bills you for hours each instance runs, plus bandwidth. Running a single small instance non stop for one year will cost you approximately $USD876 - so cheaper options exist elsewhere if you don't need a dynamic number of servers.

Interested enough to check it out? Follow the steps in the Getting Started Guide to fire up your own instance. In the guide you communicate with the 'cloud' via a collection of java commandline utilities. The utilities themselves are ulitising the public webservice API. Just like Amazon's S3, third parties are free to build applications upon the API. RightScale, mentioned in the podcast, uses the public API to deliver an automated cloud computing management system. The Firefox extension for EC2 uses the public API to offer a GUI alternative to the command line utilities.

The Getting Started Guide takes you through the steps of firing up a public instance of a Linux server, making modifications to the instance, then packaging this up as a custom Amazon Machine Image (AMI). The customised AMI is then uploaded to your S3 storage.

This is a very interesting technology from Amazon, I'm intrigued to see what services get built on top the cloud!

PropertyInfo.GetCustomAttributes() Doesn't Return Inherited Attributes

2008-03-26T20:37:00.005+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2008/03/propertyinfo-getcustomattributes-doesnt-return-inherited-attributes/

Here's a problem I ran into today. If you have an attribute on the property of a base class; are you able to read it via PropertyInfo.GetCustomAttributes on the properties of a subclass.

Here's where it helps to read the fine print. PropertyInfo.GetCustomAttributes takes a parameter for 'inherit' - yet the reference for PropertyInfo contains some important details: Calling ICustomAttributeProvider.GetCustomAttributes on PropertyInfo when the inherit parameter of GetCustomAttributes is true does not walk the type hierarchy. Use System.Attribute to inherit custom attributes.

The code to read the attributes ended up looking like this:

foreach (PropertyInfo property in type.GetProperties())
{
    // not this one -> property.GetCustomAttributes(true);
    Attribute[] attributes = Attribute.GetCustomAttributes(property);
}

Silverlight Animated Optical Illusion

2008-02-23T21:34:00.005+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2008/02/silverlight-animated-optical-illusion/

Spotted this illusion on digg: The anatomy of an illusion -- and what it tells us about the visual system. Being the skepical fellow I am - I decided to recreate this illusion.

The animation is simply cycling the colours of inner circles. From/to the frames below.

So, here's my Silverlight version of the animated illusion. Feeling skeptical yourself? View the source!

ObjectDataSource DateTime, and Locale

2008-02-18T20:29:00.004+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2008/02/objectdatasource-datetime-and-locale/

Thinking of using an ObjectDataSource and DetailsView to populate/save your business object? If the object has a DateTime property - lets hope you live in the United States!

Had an strange problem today with a birthday set to October 9, 1940. The edit screen would populate a TextBox with "9/10/1940", correct for my culture en-AU. Clicking save populates the database with "September 10, 1940". Strange the edit screen would observe the my culture settings, yet populating the business object doesn't.

Googling around turned up this: ObjectDataSource ignores culture information when updating. Do'h!

How Does OpenID Work?

2008-02-12T13:05:00.001+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2008/02/how-does-openid-work/

I've heard about OpenID on a podcast I listen to. Sounds interesting - an open source solution to have a 'single sign on' for many websites. Interested to see how this works - both as a user, and as a website author.

Here's a run through of an example authentication:

User accesses an OpenID enabled website, site responds with a form requesting the user's OpenID identity.
User enters their identity, e.g: russau.myopenid.com. Then submits the form to the website.
Website server accesses http://russau.myopenid.com.

Retrieves the location of the OpenID provider from the link tag:

<link rel="openid.server" href="http://www.myopenid.com/server" />

Website POSTs an 'associate' request to the provider. The two machines establish a secret using a Diffie-Hellman key exchange.

openid.mode associate

openid.assoc_type HMAC-SHA1

openid.session_type DH-SHA1

openid.dh_consumer_public

openid.dh_modulus

openid.dh_gen Ag==
Provider's response provides the website an 'assoc_handle' (and expiry) for future requests. The two servers now have established a shared secret, without passing it over the wire.

assoc_handle	{HMAC-SHA1}{47b0ec92}{5hMN8A==}
assoc_type	HMAC-SHA1
dh_server_public
enc_mac_key
expires_in	1209600
session_type	DH-SHA1

The comsumer's response from step 2 contains a redirect to the provider, containing a number of parameters in the querystring. Note, the querystring contains the established 'assoc_handle', and a 'nonce' has been attached onto the 'return_to'.

openid.mode	checkid_setup
openid.identity	http://russau.myopenid.com/
openid.return_to	http://openidconsumer.test/cp/login.aspx?&nonce=vovudmLa
openid.trust_root	http://openidconsumer.test/cp
openid.assoc_handle	{HMAC-SHA1}{47b0ec92}{5hMN8A==}
openid.sreg.required	gender,postcode,timezone
openid.sreg.optional	email,country
openid.sreg.policy_url

The user is now on the provider website, and performs the step needed to authenticate, e.g. entering a password.

The provider redirects the user back to the consumer website, along with parameters in the querystring. The consumer now has everything it needs to log in the user.

nonce	vovudmLa
openid.assoc_handle	{HMAC-SHA1}{47b0ec92}{5hMN8A==}
openid.identity	http://russau.myopenid.com/
openid.mode	id_res
openid.op_endpoint	http://www.myopenid.com/server
openid.response_nonce	2008-02-12T00:47:53ZyUUam3
openid.return_to	http://openidconsumer.test/cp/login.aspx?nonce=vovudmLa
openid.sig	EpvWdJtxacv2WtCaZLbud85M84k=
openid.signed	assoc_handle, identity, mode, op_endpoint, response_nonce, return_to, signed, sreg.country, sreg.email
openid.sreg.country	AU
openid.sreg.email	testuser@webmail.com

This querystring contains a couple of things to prevent an attacker from spoofing it. The 'assoc_handle' established in steps 5 and 6, the consumer uses to this look up the established secret. 'openid.sig' contains a digital signature of the parameter values listed in 'openid.signed', using the established secret. If an attacker were to change the 'openid.identity' in an attempt to login as someone else, the signature wouldn't match (without knowing the secret, the attacker cannot re-create the signature). Finally, the initial 'openid.return_to' in step 7 contained a nonce. If an attacker were to resubmit the querystring above unchanged (a replay attack), the consumer web site would know the nonce has already been used.

Facebook dev, IIS 5.1, and error 405

2007-12-05T20:48:00.001+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2007/12/facebook-dev-iis-5-1-and-error-405/

In the middle of a Facebook application idea of mine. Using the FacebookToolkit to get something together.

It's pretty interesting how Facebook integrates with 3rd party applications. Short version: User accesses "http://apps.facebook.com/<appplication_name>", Facebooks sends your page a POST (you host it wherever you want); Facebook displays the output of your page. Long story: Basic Application Architecture.

You can configure the location of the page Facebook POSTs to - called the Callback Url. I initially had this set to something like: http://www.mycheaphosting.com/Canvas.aspx. The location the Facebook user accesses, i.e. apps.facebook.com/myapplication/ is called the Canvas Page.

Any relative links within your Callback page will become relative to your Canvas page. For example a link to "blah.aspx", will be treated by the browser as a link to "apps.facebook.com/myapplication/blah.aspx". What does Facebook do with a URL like this? It POSTs to the same 'relative' location on your server. Which in my case would be: http://www.mycheaphosting.com/Canvas.aspxblah.aspx. Yuck!

My first thought was: Okay, I can put the logic into a 'default.aspx', and change the Callback URL to: http://www.mycheaphosting.com/.

Have you ever tried to POST to a default document? Under IIS 5.1 - it actually causes a 405 - 'Resource not allowed' error. The best reference on this I could find was in this comment from David Wang's article HOWTO: POST Resources to IIS:

The ability to POST to a DefaultDocument requires IIS6. Prior IIS versions will return "405 Method not Allowed". That is simply a limitation of the IIS Request Processing Pipeline.

The fix: WebDev.WebServer2 - an alternative to the Cassini web server that comes with VS2005. Unlike Cassini this web server can service external requests.

Creating Your Own Dev SSL Cert for IIS

2007-08-28T20:28:00.001+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2007/08/creating-your-own-dev-ssl-cert-for-iis/

Ever wanted to create an SSL certificate for your dev box? There's no need for a well known CA like Verisign or Comodo on your dev box. Here are some guides to creating your own CA/signed certificates:

Setting up SSL with a SelfSSL certificate on Windows Server 2003 - create a self signed certificate with a utility from the IIS Resource Kit.
Creating a Self-Signed Certificate using OpenSSL for use with Microsoft Internet Information Services (IIS) 5 - use the open source OpenSSL to create your own CA, and sign requests yourself. Has the advantage that users can trust one CA, and never receive SSL warnings from your dev sites.

Moving from ASP.NET 1.1 to 2.0

2007-08-28T20:00:00.001+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2007/08/moving-from-asp-net-1-1-to-2-0/

Request Validation - 2.0 picks up 'malicious' HTML even when it's escaped.
ASP.NET 2.0 MasterPages and FindControl() - recursively searching for controls inside a masterpage.
TextBox ReadOnly in ASP.NET v2.0 - populating a readonly textbox via script, the contents of the textbox don't get populated on the PostBack page.
The Attributes property of a ListItem control only works within an HtmlSelect control - is no longer the case in 2.0 (even though "This behavior is by design" in 1.1).

Link Drop VI

2007-08-07T21:52:00.001+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/?p=72

UltraVNC SC - a VNC 'server' you can package up and send to friend. When launched UltraVNC SC makes the outbound connection back to your waiting VNC client. No need to set-up any firewall rules on the 'controlled' PC.
Thoof - always has a few articles I find interesting. Uses your stats (articles clicked, your browser make/version, geographic location) to find articles tailored for you.
Imperial History of the Middle East - found this on Thoof.
Synergy - control several PCs from one mouse/keyboard, moving the mouse off one screen seamlessly flows onto the next screen.
2005 BT Technology Timeline [warning PDF link]
Slow Wave - people send in their dreams for some pretty weird cartoons

Silverlight createFromXaml Bug

2007-07-30T19:12:00.001+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2007/07/silverlight-createfromxaml-bug/

Odd Silverlight bug when calling 'createFromXaml' - here's the error for the search engines:

Firefox: Error calling method on NPObject! Internet Explorer: Error: AG_E_RUNTIME_METHOD : CreateFromXAML

The error occurred when I was trying pull apart the Video Library Sample for my own project.

The cause of the bug comes down to this:

Using the replaceAll prototype to get a string which is passed to createFromXaml:
works fine when it finds the placeholder and replaces it
crashes when it doesn't find the placeholder in the string.

Have a look at an example: Silverlight createFromXaml bug. I'm writing out the string I'm using with createFromXaml in the textarea. The first button uses the untouched template, the second replaces the $2 placeholder, and the third attempts to replace a non-existent $3 placeholder.

Stripping all the functionality out of replaceAll causes the error to happen everytime - suggesting Silverlight has a problem dealing with an untouched 'this' coming from a prototype method on a string.

String.prototype.replaceAll = function(strTarget, strSubString) {
    var strText = this;
    return( strText );
}

I've created a post about it in the Silverlight forums: BUG: createFromXaml and prototypes.

C# command line parser?

2007-07-22T20:26:00.000+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2007/07/c-command-line-parser/

Sat down to start a little command-line app on the weekend - anyone know of a good library to parse command line arguments? Expecting something with a simple api to set up a list of arguments, specific mandatory ones, and enforce some validation (types and ranges?).

Quick Google search came up with:

Expect an update (and the finished project) soon! :)

Firefox extension: CookiePie

2007-06-24T08:19:00.001+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2007/06/firefox-extension-cookiepie/

Problem: I'm testing a Facebook application of mine, so I've created a few 'testing' accounts. Rather than logging in/out of each account - I'd like to be logged into all accounts at the same time. Got me thinking there must be a Firefox extension to do this.

Solution: CookiePie: The CookiePie Firefox extension allows you to have cookies which remain only within one tab. After installing the extension, a new option is added to the right-click menu on your tabs - to toggle on/off the CookiePie feature. Exactly what I was after!

Hand-held browser

2007-06-07T21:36:00.001+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2007/06/hand-held-browser/

Here's something I've been trying to convince anyone who'd listen for a while: I think there's a market for a hand-held browser appliance. And judging by some of the products coming out recently someone out there agrees with me.

I'd like a device with a display at least 800 pixels wide, wifi connectivity, and a 'fully-fledged' browser. Something my wife could take into the kitchen to view a recipe. I could sit on the couch a surf the net while I'm watching TV, reply to emails from bed.. How many people buy a PC/Laptop and just browse websites? Most importantly this device would have to be CHEAP - this is competing with Celeron M laptops selling for $AUD800. Throw in a skype client and this device could also become your cordless phone.

What devices are out there that fit the bill?

Nokia N800 - looks very nice, 800 pixels wide display, Linux based OS with a good following of hackers, I'd prefer a slide out keyboard though: $USD400.
Sony mylo - 320×240 resolution, sounds a bit too small. But does come out of the box with a skype client: $USD280
Pepper Pad - $USD699, enough said? Those keys also look they could be comfortable for typing.
Palm Foleo - announced just last Thursday, touted as a "companion device for all brands of smartphones" - translated from marketingese means "we don't want this device to cannibalise our existing markets": $USD499. (The comments on the Engadget article are pretty amusing: Palm Foleo announced.)
Intel's MID UMPC / Mobile Internet Device - not a lot of news on this one just yet.
Asus Eee PC 701 - "supposed to start as low as $USD200". Not bad! Even the Engadget crowd like this one!

Silverlight

2007-05-27T18:10:00.003+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2007/05/silverlight/

Microsoft's new technology Silverlight is out - and already being referred to as a potential flash killer. Silverlight performs a similar function to Flash, giving developers a platform to create rich internet applications. Silverlight appeals to me as a developer as applications are built using Microsoft's XAML to create the user interface, and Javascript to add interactivity. These are technologies I'm already familiar with. Beta 1.1 of Silverlight even has a cross platform CLR called the CoreCLR - making it possible to code Silverlight applications in any .net language. Strongly typed .net languages make an intriguing alternative to Javascript/DHTML/AJAX development. Using an XML language to describe the user-interface also makes it easier for me to code generate portions of an application.

So what's it look like? Plenty of examples in the Showcase. You'll need to install the Silverlight beta - download links on the Getting Started page.

Great, what tools are there for it?

Microsoft Expression - comes in a few flavours (from Wikipedia's Microsoft Expression page):
- Microsoft Expression Web (code-named Quartz) - WYSIWYG website designer and HTML editor.
- Microsoft Expression Blend (code-named Sparkle) - Visual user interface builder for Windows Presentation Foundation applications.
- Microsoft Expression Design (code-named Acrylic) - Raster and vector graphics editor.
- Microsoft Expression Media - Digital asset and media manager.
Silverlight tools for Orcas - the add-on tools for the beta version of the next Visual Studio.

So, how do I start coding? So far I've just used Textpad to edit the HTML/XAML/JS files in my sample applications. The QuickStarts pages are a very good place to start. I've also used Expression Blend to "drag-and-drop" the XAML, but continued my development in Textpad. Once you start 'trying your own hand' at XAML/Silverlight, you will need a resource like the MSDN Silverlight Reference.

I've been working on a little Silverlight project - so expect a follow-up blog post sometime soon.

Google Finance

2007-04-22T10:12:00.000+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2007/04/google-finance/

Google has entered the finance info field - and brought with them some very fancy features, all with a nice UI: AUD to USD. The graph is draggable, grab it and move back into the history - or click the '1y', '5y' links. News items are plotted on the graph, and scroll into view as you move back through the history. The viewable area is expandable, by dragging the edge of history window under the graph. View a stock graph - GOOG - compare the history with another stock by clicking the compare button.

Feature request: a 'permalink' - so I can send someone a link that would take them directly to the 5 year history of the Australian Dollar, or directly to a comparison of GOOG and MSFT.

Link drop V

2007-04-15T15:01:00.001+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2007/04/link-drop-v/

Method Studios - Mountain Dew "Spy vs. Spy" - some clever CGI makes for a bit of nostalgia for old MAD magazine fans.
SIMILE | Timeline - Javascript library for displaying a draggable/clickable timeline.
Free Ports & Network Services Informations Database - AJAXy port number lookup.
Top 12 Ruby on Rails Tutorials - some tutorials to quickly get up to speed with Ruby on Rails.
Inside North Korea - behind the scenes documentary in North Korea.

ShowMeDo: WASTE tutorial

2007-04-06T11:26:00.001+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2007/04/showmedo-waste-tutorial/

My ShowMeDo tutorial Secure File Transfer With WASTE has just gone online. ShowMeDo is web site for tech tutorials in flash video - the majority are screencasts on varied programming topics. ShowMeDo has huge potential for learning new technologies, I think its going to get bigger and bigger...

Flash video

2007-01-27T17:17:00.000+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2007/01/flash-video/

Experimenting with flash video - and time-lapse. This involved a few free source apps:

Time-lapse video: MakeAVI, virtualdub to dub the soundtrack (although I found out virtual dub can do the time-lapse stuff itself).
Creating the flash video file: FFmpeg, there's a tutorial on it here: FLV encoding with ffmpeg.
Jeroen Wijering's Flash Video Player

TWOCrowds.com flickr CAPTCHA test

2006-10-28T10:12:00.000+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/10/twocrowds-com-flickr-captcha-test/

Noticed on the web somewhere TWOCrowds.com is using the flickr api to create a CAPTCHA test. Looks like they are using the flickr api to pull up a photo tagged with a convention that says "this is a photo of a single letter: r".

Wouldn't this be pretty easy to defeat? The JPG's are being served from flickr - and a named like this: "114556884_45d6dd4ec4_s.jpg". The first part of the filename is the photo id which you can pass to the flick API method flickr.photos.getInfo. Which returns all the tags (among other things) for the image - the "Rr" tag being the convention that says this is a photo of the letter R:


    <tags>
        <tag id="256536-114556884-484" author="95229107@N00" raw="Paris">paris</tag>
        <tag id="256536-114556884-6562" author="95229107@N00" raw="claudecf">claudecf</tag>
        <tag id="256536-114556884-17897" author="95229107@N00" raw="letter">letter</tag>
        <tag id="256536-114556884-67834" author="95229107@N00" raw="oneletter">oneletter</tag>
        <tag id="256536-114556884-6496" author="95229107@N00" raw="letters">letters</tag>
        <tag id="256536-114556884-8513" author="95229107@N00" raw="Rr">rr</tag>
    </tags>

They could prevent this by not revealing the image names in the HTML - by having their webserver read in the JPG and delivering it with a different filename.

SSL + Man-in-the-Middle

2006-10-23T20:14:00.001+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/10/ssl-man-in-the-middle/

Spent some time reading up on SSL and how it defends against against the 'man-in-the-middle' attack. All the pieces to the puzzle were there in my previous post - I just needed a good reference on the protocol. The best references I found were:

Introduction to SSL
An Overview of SSL (version 2) (Thanks Craig)
Special mention: Mentalis's Secure Socket Library - free and open source implementation of the Secure Socket Layer (SSL) protocol version 3 and the Transport Layer Security (TLS) in C#!

Examining the protocol reveals how SSL defends against a man-in-the-middle attack.


ClientHello: SSL version number, cipher settings, randomly generated data
	ServerHello: SSL version number, cipher settings, randomly generated data, server certificate. The server certificate contains the server's public key.
ClientKeyExchange: premaster secret for the session - derived from a hash of all the communcations to this point. This is sent encrypted with the server's public key. The server decrypts this, and ensures the hash matches its own hash of the communcations.
The client and server both create a session key to be used for the remainder of the session. The session key is derived from the premaster secret, client random data, and server random data.
	ChangeCipherSpec: Finshed
HTTP GET (communcations now encrypted with the established session key)

The server certifcate delivered in the ServerHello is signed by a trusted certifcate authority (CA). The client tests this signature against its own list of CA public keys. The server certifcate also contains the domain name of the server. This is used to confirm you have the certicate that has been authorised by an authority for the website located at amazon.com. If the certificate does not pass either criteria your browser will give you a warning.

If an attacker did sit in between your browser and a server and they passed along the certificate in the ServerHello - they wouldn't be able to decrypt the ClientKeyExchange. As this has been encrypted with the server's public key - and the attacker is only in posession of the public key. It is possible for the attacker to substitue their own certificate in this step. But the browser will issue a warning if the certificate isn't:

signed by a trusted authority,
and certificate's domain matches the site the client is connecting to.

As you may have already guessed: To have your server certificate signed by a trusted CA's (like Verign, Thawte and Comodo) you have to provide evidence you own the domain! The other weakness is the list of trusted authorities you have installed in your browser. As mention by Steve Gibson in the Security Now podcast (episode 36) some corporate environments have inserted their own CA certificate in the client installations exactly so they can perform a man-in-the-attack to filter content at the proxy.

Now, there is an exception, though, which is the other reason I put this question in here today, because when you connect to a remote server you are accepting the credentials of the server, which has been signed by someone who signed their certificate, like we were talking about briefly before, about VeriSign, for example, signing GRC’s certificate. Some corporations do want to proxy and filter and literally basically decrypt and be able to read their employees’ encrypted traffic. So what they do is they run a proxy server in their corporate environment, which has a certificate. And every browser in the company has been told to trust that certificate. So essentially the encrypted traffic is decrypted at the corporate border.

It’s decrypted at the corporate border and then, essentially, filtered, proxied, checked for spyware, or even for naughty content. I mean, they could do anything they want to once they’ve got your connection decrypted. Then it is reencrypted using a certificate that every corporate browser has been deliberately installed with in order for the browser not to complain. So employees may believe they have encrypted and secure SSL connections, when in fact it is being decrypted in, you know, en route, essentially, you know, by their corporate firewall or IT staff or proxy server for whatever corporate reasons.

Which finally does explain how SSL defends against this attack!

Charles Proxy

2006-10-08T11:51:00.002+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/10/charles-proxy/

Checking out Charles Web Debugging Proxy while I'm having a bit of a look under of the hood of SSL-Explorer. Snooping on an a SSL session works straight out of the box. Must be using a 'man-in-the-middle' method to sit between me an the SSL website.

Yet, when I access https://www.amazon.com via Charles Proxy I get a warning about the certificate. Viewing the certificate 'certification path' shows that the content coming from the proxy has been encrypted with a certificate signed by 'Charles CA Certificate'.

Left: without the proxy. Right: with Charles Proxy.

I know SSL does protect itself against a man-in-the-middle attack - but I don't know exactly how this works. There's an SSL certificate on the server that's been signed by a 'certificate authority (CA)' - and your browser contains public keys of the trusted CAs (IE: Tools -> Options -> Content -> Certificates -> Trusted Root Certification Authorities, Firefox: Tools -> Options -> Advanced -> Security -> View Certificates -> Authorities). How do these pieces fit together to protect against this attack?

More material for a blog post - stay tuned for the update. In the mean time I'll be translating this:

Analysis of the SSL 3.0 Protocol

My SSL-Explorer Questions Answered

2006-10-02T17:56:00.000+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/10/my-ssl-explorer-questions-answered/

My previous post Remote Desktop + SSH/Putty covered one approach for accessing your home PC via a strong security, strong encryption SSH tunnel. SSL-Explorer from 3SP also looks like a very simple way to remotely access your PC. I first heard of this project when it was mentioned on Steve Gibson's 'Security Now!' podcast (episode 15). There is also a review on Tom's Networking: A DIY SSL VPN with SSL-Explorer, and part 2. After reading the review I was left with a few questions, and sensing some material for a blog article. I'm about to install SSL-Explorer on a spare PC: and try answering some of my questions.

SSL-Explorer is an web-based SSL VPN server. A VPN exists for a secure external access to resources you have one your network. Perfect for 'roadwarrior' staff to access internal files and desktops from external sites, such as a hotel room, or home. SSL-Explorer provides this though a web-browser interface.

Once installed you get a web-based admin to administer the application - create users, set-up permissions, and configure the resources that will be made available to the users. A user connects via a browser, after logging-in they are presented a simple screen displaying the resources they have access to. Users can access the web securely, view Remote Desktops, and transfer files all via SSL-Explorer.

SSL-Explorer's User Console displaying the 'Applications' available to the user.

The fresh install allows me to create: Web Forwards, Network Places, Applications, and SSL Tunnels. My first question was: how exactly do you make applications available via a web browser? The Tom's Hardware article goes through the steps of creating a VNC connection back to a server behind the firewall in the section "Checking out Remote Desktop". More questions:

Where is this VNC executing?
If it is executing on the client:
- How did it get there?
- How can it connect to the VNC behind the firewall?

Trying this out on my own set-up: in the admininstration I first set-up the VNC application short cut. I'm presented will a lot of options for the short cut: Logging into the website as a 'user' I now have an option to launch VNC. Launching the app reveals an extra component to the SSL-Explorer application: the SSL-Explorer Agent. The first time I attempt to launch the VNC application from the web console - I'm prompted to install a signed java applet. This launches the SSL-Explorer Agent on my client. The SSL-Explorer Agent has:

copied the application down to my PC (a search finds the application in %USERPROFILE%\.sslexplorer\applications),
created a tunnel port on the client PC,
and launched the VNC application with the command line options to connect to the tunnel port.

So the application sharing is conceptually very similar to using SSH tunnels to connect to a server behind a firewall. VNC is connecting a tunnel port on the local machine created by SSL-Explorer Agent. The agent is transferring this data to the SSL-Explorer application via SSL - which then transfers the data to and from the VNC server. SSL-Explorer is wrapping this up in a nice web interface. Not all applications are suitable to be shared this way. To work, an application needs to:

Be the client in a TCP client/server environment, i.e. Remote Desktop, VNC, Putty.
Allow the server address and port to be 'fed in' to the app, either via a command line argument, or config file. This is how the SSL-Explorer Agent tells the client to connect to the local tunnel port. The multitude of options available when creating the VNC shortcut is used to create a VNC parameter file on the client machine. This rules out MSN Messenger and Skype as they are 'hardcoded' with their server address and port.

Notably all the applications that come out of the box prompt the user for a password when a password is not present in the command line or config. Presumably this is preferable to leaving a password on the client machine.

Well that's answered the initial questions I had of SSL-Explorer, and has given me some more questions for my next blog post. Maybe try my hand at creating my own application extension? I've had a quick look around for a minimal Jabber client which meets all the criteria, may play a bit more with that. Also thinking of using a snooping proxy to see what is actually going over the HTTPS wire (Charles Proxy is capable of this). If someone were given an account without any tunnels setup - could you falsify the server traffic to have the agent create a tunnel?

Importing the Geo-Names database into MsSql Server

2006-08-20T20:25:00.002+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/08/importing-the-geo-names-database-into-mssql-server/

Update (26-Jul-2009): This article is now a little outdated. The table now has some extra columns. Have a look at Loading GeoNames Data Into SQL Server 2008 by EdKatibah for an up-to-date approach. I've successfully imported the newest allCountries.txt with the following steps:

UNIX2DOS to update the line endings of AllCountries.txt
Same nant script below to convert AllCountries.txt to UNICODE

CREATE TABLE now looks like this:

CREATE TABLE [GeoNames] (
    [GeonameID] [int] NOT NULL ,
    [Name] [nvarchar] (200) NOT NULL ,
    [AnsiName] [varchar] (200) NULL ,
    [AlternateNames] [nvarchar] (MAX) NULL ,
    [Latitude] [float] NOT NULL ,
    [Longitude] [float] NOT NULL ,
    [FeatureClass] [char] (1) NULL ,
    [FeatureCode] [varchar] (10) NULL ,
    [CountryCode] [char] (2) NULL ,
    [CC2] [varchar] (60) NULL ,
    [Admin1Code] [varchar] (20) NULL ,
    [Admin2Code] [varchar] (80) NULL ,
    [Admin3Code] [varchar] (20) NULL ,
    [Admin4Code] [varchar] (20) NULL ,
    [Population] [bigint] NOT NULL ,
    [Elevation] [int] NULL ,
    [GTopo30] [int] NULL ,
    [Timezone] [varchar] (50) NULL ,
    [ModificationDate] [datetime] NULL 
)

EdKatibah's BULK INSERT works nicely:

BULK INSERT GeoNames
FROM 'D:\Developer\Geonames\allCountries_unicode.txt'
WITH(
   DATAFILETYPE = 'widechar',
   FIELDTERMINATOR = '\t',
   ROWTERMINATOR = '\n'
)
GO

Using BULK INSERT to load the data is MUCH nicer than using BCP. As BULK INSERT will actually tell you where and WHY and import failed. I was originally trying to do this with BCP. I had DECIMAL types for latitude and longitude - which resulted in an infuriating error because a handful of rows have scientific notation representation.

Geo-Names "provides free geo-data such as geographical names and postal codes. The database contains over 6 million entries for geographical names whereof 2.2 million cities and villages". The offer their content via a webservice, and as a database download.

I'm using a subset of this data for my 'learn ASP.NET 2.0' project, so I've imported the database export into my SQL Server. Here's the steps I followed:

Create a table that looks like this (note the nvarchar columns for the extendend characters):


CREATE TABLE [CityNames] (
    [GeonameID] [int] NOT NULL ,
    [Name] [nvarchar] (200) NOT NULL ,
    [AnsiName] [varchar] (200) NOT NULL ,
    [Latitude] [decimal](18, 15) NOT NULL ,
    [Longitude] [decimal](18, 15) NOT NULL ,
    [FeatureCode] [varchar] (10) NULL ,
    [CountryCode] [char] (2) NULL ,
    [Admin1Code] [varchar] (20) NULL ,
    [Population] [int] NOT NULL 
)

The database export is a UTF8 file - MSSQL DTS import wants a UTF16 file. Easy to convert a file by opening it in Textpad/VS.Net and using 'Save As' to change the encoding. Not so easy with the 500meg 'allCountries' file. The nant copy task works well for this:
```
<target name="build">
    <copy file="allCountries.txt" 
    todir="Converted" inputencoding="UTF-8" 
    outputencoding="UNICODE"/>
</target>
```
Import the converted file via the DTS Import/Export Wizard. In Enterprise Manager right-click the database > All Tasks > Import Data...
Follow the prompts to import the converted file. On the file format screen select the following options: File Type = Unicode, Row Delimeter = {LF}, Text Qualifer = .
If all the names look neatly lined up on the next screen your file has imported okay.
In the next two steps select the destination database / table created in the first step.
Just to make sure all the UTF-16 content has come across okay - jump into Query Analyzer and run something like this:
```
SELECT AlternateNames FROM GeoNames WHERE GeonameID=2147714
```

Better Password Management

2006-07-30T20:25:00.001+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/07/better-password-management/

Saturday night geek project: do something about my dodgy password management. Maybe listening to the Security Now podcast has got me paranoid enough to do something about my passwords. I currently deal with passwords in a way that's no embarrassingly bad I'm not going to mention it. Not as bad as a "passwords.txt" on the desktop - but still pretty bad. (And by the time you read this it'll be A LOT more secure :)

I REALLY REALLY should be doing the following things for my passwords:

Different passwords for all my logins.
Using randomly generated passwords - filled with lots of funny characters, mixed case, and numbers.
Regularly changing passwords. Take out a night every few months to log into all the sites I use and change my password?
NOT storing them in a clear file somewhere. Maybe I shouldn't be storing them in the IE & Firefox autocomplete databases. How strongly encrypted are they?

Thinking though the features I'd want for an app to automate this:

Generates random passwords.
Stores everything with strong encryption.
Runs from a USB key so I can use it from work and home.
preferably open source (or a free download).
Nice to have: integration with the IE & Firefox password autocomplete. Or maybe just an easy way to export the existing passwords from my browsers.
Some automated means of doing the monthly password update?

A search of Firefox extensions, and SourceForge came up with: RoboForm, Password Safe, and KeePass. RoboForm has most of the features I'm after (USB key operation, IE/Firefox integration, and password generation) but is limited after the trial period runs out. Password Safe and KeePass look very similar - decided to go with KeePass as: it's a single EXE, has a prettier UI, and it's a more popular project for SourceForge.

KeePass stores all your passwords in an encrypted database - which requires a password to access. When adding an entry you can choose to generate a random password.

Unfortunately there is no browser integration, but there in an auto-type feature. This enters your credentials into the active form. By default it'll simulate you typing your username, pressing tab, typing your password, and pressing enter. This is also configurable per entry. An entry can be set to expire by date - this is the closest to any automation of a monthly password update.

Now I've spent a night logging into a stack of websites, and changing my passwords to randomly generated ones. Which means I'm completely reliant on the Keypass database - there's no way I'd be able to commit these passwords to memory. A copy of the KeePass database at home, and work is fine - how often do I go to an internet cafe anyways? For convenience I've allowed Firefox to remember passwords for the sites that allow it (banking sites are "autocomplete=false" for good reason!) - and I've set a master password on the Firefox password store. This reliance also means it's very important I have backups of theKeyPasss database, plus a backup of "plaintext" export in the event I forget the KeyPass password.

Some words of warning about the process of updating all your passwords. After you've generated your password you'll paste it into the change password page somewhere. The password input box will most likely display stars as you type. You want to be pretty confident you are pasting the right thing in there. If you accidentally paste something else you'll just see stars and won't know - effectively locking yourself out of the account! Another website I use had a 8 character limit on their passwords - I pasted in a 15 character string and only the first 8 characters were saved. Because I was seeing stars I had no way of knowing what'd happened - I only worked out what'd happened when I noticed the wrong password page had the same limit (yet the main login page didn't!). Chris Pederick's Web Developer Extension has a feature to turn password fields into plain text fields - this means you can be totally confident you've pasted the right thing.

Another warning on the autotype feature: if you have the Firefox Password Manager open when you select auto type - all your passwords get wiped out. Because the 'auto-typed' tab selects the 'Remove All' button, and then the 'enter' clicks it! Firefox wipes out all your passwords without prompting you!

I've been running for a week now with KeePass and I find it's working well. As I mentioned I now can't pop into an internet cafe and check my mail - something which I haven't done in a long time. Plus I'm now WAY too paranoid to log into an online banking site from an internet cafe.

Some Things I Currently Think Are Cool

2006-07-06T21:59:00.001+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/07/some-things-i-currently-think-are-cool/

Okay, I'm a geek.. There won't be any going back after this..

The Daily WTF - a regular dose of schadenfreude.
AlterSlash ~ the unofficial SlashDot digest - has an algorithm to pull out the best comments for each Slashdot article displayed in digest format. Its got me back reading Slashdot, the comments are actually the best bit!
Security Now! - podcast on computer security issues. Steve Gibson does a good job of explaining the fundamentals, and how they relate to security hazards. Could be a good place to point people who are having trouble with some networking concepts. Some are a bit less interesting than others - safe to skip to the Buffer Overrun episode. (Thanks Ben)
Gmaps Pedometer - draw a route on a google map, measure the distance, and save it for a unique URL of your route: http://www.gmap-pedometer.com/?r=167809 (Thanks Craig)
Wikipedia featured desktop backgrounds
Opera Widgets: Circular Tetris and Bounce. (Thanks Ellecer)
Watch some doccos online from ABC's Four Corners and PBS's Frontline.

VMware update

2006-06-15T21:33:00.001+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/06/vmware-update/

What I've discovered playing with VMware server.

The wikipedia entry is actually more informative than the VMware website (or I was more patient tonight). From wikipedia:

the difference between VMware Player and Server: VMware Player, a free virtual-machine host, can run virtual machines made by other VMware products, but cannot itself create new virtual machines.
how to lock your VM network adapter to one MAC address: disable all networks/adapters other than bridged and edit each virtual machine's .vmx file to change "ethernet0.address" to a unique MAC and "ethernet0.addresstype" to "static". Make sure to also remove the "ethernet0.generatedaddress" entry entirely. Setting the MAC Address Manually for a Virtual Machine goes into more detail.

At first I was a bit puzzled that I could power up my Trustix VM - and it'll be visible on my network via ping and SSH. Yet when I logged out of the host OS the VM would disappear. According to the forum post "VM powers off by itself...." this is caused by connecting to the host OS via Remote Desktop. A better alternative is to power up my VM via the VMware Server Console.

VMware Server is a true client/server app. Your virtual machines execute on a server somewhere - and you can connect to administer/view the machines from another PC using the VMware Server Console. For me this required opening up port 902 on my host OS.

Connecting to the VM Server. Trustix VM viewed from my main PC.

Now that my VM is running continuously - I can do all my Linux mucking around from an SSH client. So I don't really have much need to connect via the VMware Server Console.

Trustix + VMware Server

2006-06-12T16:28:00.001+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/06/trustix-vmware-server/

Queen's birthday long weekend - and I've found another quick geeky project to play with at home. This one was quick (I swear!). I've being contemplating recently how I'd go about setting up a small business network with the essentials - web/mail/file/proxy server plus the very necessary extras like back-up and spam/virus filtering for email.

The offerings from the open source world are pretty impressive (without getting into a debate over paid-for / free software). Which led me to the Trustix Linux distro - from their website:

Trustix Secure Linux is a distribution for servers with a heavy focus on security and stability. One of the main features of Trustix is its small size which combined with easy updating by the automated secure software updater swup, makes it a smooth and inviting system to administer.

Having been away from the Linux world for 10 years and having never been an expert - the idea of a 'minimal' distribution appeals to me. An 'everything plus the kitchen sink' distro just means more things that could go wrong, more potential security holes, and more applications to patch/update.

Got an install up-and-running on my 'test' machine. In the mood for experimenting I downloaded the free VMware Server, and a Trustix install ISO file. The virtual PC can be set-up to boot straight from the ISO image, and install Trustix effortlessly. I know of a few people working with production servers hosted in VMware. I can see the advantages - I can now easily move my Trustix install between PCs running VMserver. Making it possible to run several servers on one physical machine - and move them off onto more physical machines as the additional resources become needed.

Documentation is a bit thin on the ground, the TrustixWiki covers most of the scenarios I'm interested in. So now its time to roll up my sleeves (stop saying 'I bet this is easier in Windows') and think about the features I want on my new server!

IE Javascript problem?

2006-05-20T13:42:00.001+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/05/ie-javascript-problem/

What would you expect the bit of javascript below to do?

<html>
<body>

    <select id="testing">
    </select>

    <script>
        var testing = document.getElementById('testing');
            
        var georgeOpt = new Option("George", 1);
        testing.options[testing.length]=georgeOpt;        
        
        var paulOpt = new Option("Paul", 2);
        testing.options[testing.length]=paulOpt;    
            
        var johnOpt = new Option("John", 3);
        testing.options[testing.length]=johnOpt;    
            
        var ringoOpt = new Option("Ringo", 4);
        ringoOpt.selected = true;
        testing.options[testing.length]=ringoOpt;        
    </script>

</body>
</html>

In Firefox the SELECT is displayed with Ringo selected, in IE John is selected. If you swap the last two lines of script - Ringo is selected in both browsers. Easily fixed so its no biggie. I guess it doesn't really make sense to tell an OPTION it is selected before it belongs to a SELECT?

Scott Guthrie's ASP.NET + Atlas Tutorial

2006-05-18T19:53:00.001+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/05/scott-guthries-asp-net-atlas-tutorial/

Pretty cool demo of some of the new features of VS.NET 2005 + ASP.NET from Scott Guthrie here. Scott shows off the new features in: DataSets, master pages, and Atlas.

Try count how many times he says 'go ahead'.

How is he recording that? Maybe it's that 'clapper board' icon in the systray? Looks like an Office icon. Got me interested in recording tutorials via screen cam software. Discovered you can record your own with the Windows Media Encoder. So here's my first attempt at a screen capture tutorial.

Google Trends

2006-05-13T09:29:00.000+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/05/google-trends/

Okay, Google's latest project Google Trends is pretty entertaining.

Type in a search term like, 'hurricane katrina' and get back a graph of search volume over time, and a table of the cities where the search term was most popular. The results are normalised, i.e. the table is ordered by searches for 'hurricane katrina' over the total searches for that city. The labels on the graph correlate the dates of news articles.

Or view a comparison by comma separating search terms, 'coke, pepsi' or 'kfc, macdonalds'.

Microsoft Virtual Labs

2006-04-23T23:09:00.001+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/04/microsoft-virtual-labs/

This rates as one of the handiest things I've seen in a while (okay I'm a geek). Say you feel like brushing up on some new Microsoft server/application - so you set up a VirtualPC and play with it there. Microsoft's Virtual Labs have made this much much easier by setting up test environments for you which you can access via a web browser. I had a play with the "Introduction to Windows Server 2003 Management" tutorial - which allows you to switch between the four PCs being "virtualized" for the tutorial (domain controller, workstation, etc).

It looks like it all works around virtual servers hosted in Microsoft Virtual Server. Virtual servers can be viewed over the network via the 'Virtual Machine Remote Control' ActiveX control. You can view a virtual server which has it network connection intentionally "restricted" - something you couldn't do with Remote Desktop. Thinking of hosting CruiseControl.net inside a virtual server at home - and adding a page to the CruiseControl webapplication with the VMRC ActiveX to jump onto the server.

Microsoft Virtual Server is now a free download. As are two VMWare products: Player and Server. VMWare also provide a directory of "pre-installed" virtual machines: Virtual Appliances. Looks like a very easy way to check out a Linux distro.

SyncToy for Windows XP

2006-03-25T16:17:00.001+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/03/synctoy-for-windows-xp/

SyncToy for Windows XP is a simple bit of software from Microsoft that fits the bill for my home PC backups. Give it any number of folder pairs, and configure how you'd like the two folders to remain in sync. There are 5 different synchronisation methods, each differ in the way they treat deleted/modified/new files. For example; to back up my digital photos I have a D:\Photos folder and an E:\Photos folder on two different physical disks. I can configure sync toy to keep the two folders in sync, and I'm protected from a hard disk failure.

The sync doesn't happen automatically, which is something I like about it. Alternatively there are instructions on how to use the Windows Scheduled Tasks to schedule recurrent SyncToy runs.

If I got really keen I could set-up folder pairs to sync everything I'd want for a rebuild (installers, coding projects, documents, bookmarks, photos, etc) with an external HD. I'll have a back-up and rebuilding my PC would be infinitely easier.

Just experimented synchronising with a CDRW. When you select the CD drive from the folder dialog the folder actually selected is in %USERPROFILE%\Local Settings\Application Data\Microsoft\CD Burning. If you try manually typing the CD-ROM drive name, you get an error telling you to 'make sure external devices are attached'. The first time you attempt to synchronise, the files get delivered to the "CD Burning" folder, and you get the disk burning pop-up.

Everything gets burnt to the disk okay. But second time around the "CD Burning" folder is empty - so SyncToy attempts to copy every file again, and you get an error when you try burn the CD. Everything does work okay if you first format the CDRW, which I could put up with. Ideally it'd be great if SyncToy itself could handle the CD burning process, and support spanning disks. Otherwise I'm very happy with this little discovery. Thanks to Ellecer for getting me onto this!

Another link drop

2006-03-25T10:29:00.001+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/03/another-link-drop/

Holidaying in Rio de Janeiro: Why not stay at Pousada Favelinha? Sounds like favela tourism is the way to discover Brazil!
CSS Menus - Horizontal CSS Menu with Dropdown and Popout Menus
Bucky's BR Dome - Urban exploration in a derelict geodesic dome in Louisiana
Currently my favourite ad on telly for the Volkswagen Jetta
Layout Gala: a collection of 40 CSS layouts based on the same markup and ready for download!

States Pass Thousands of Info Restriction Laws

2006-03-13T13:49:00.000+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/03/states-pass-thousands-of-info-restriction-laws/

Wow, I just saw this really thought provoking comment on the the Slashdot article: States Pass Thousands of Info Restriction Laws.

"The smart way to keep people passive and obedient is to strictly limit the spectrum of acceptable opinion, but allow very lively debate within that spectrum - even encourage the more critical and dissident views. That gives people the sense that there's free thinking going on, while all the time the presuppositions of the system are being reinforced by the limits put on the range of the debate." Noam Chomsky

I always knew there was something sinister about Speaker's Corner in London..

Update: Remote Desktop + SSH/Putty

2006-03-04T22:52:00.001+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/03/update-remote-desktop-sshputty/

This is an update to the article below: Remote Desktop + SSH/Putty.

After reading this article on accessing a machine behind a firewall [pdf link] it occured to me that the configuration in the previous post could also be used to access a work PC from home.

When you add a 'tunnel' via the dialog above, you can add either a local or remote tunnel. A local tunnel is like saying "I want to create a 'wormhole' port x on this PC which emerges at port y on at the SSH server". My configuration above has local ports 3390 and 3391 configured to 'emerge' at the Remote Desktop ports on my two home machines.

A remote tunnel tells the SSH server to create a 'wormhole' port on the SSH server. The remote port above points port 3400 on my SSH box to port 80 on the client machine. So I can open a browser on my SSH machine, and browse localhost:3400 and see the webserver on my work PC.

This is all explained well in the Putty documentation.

Remote Desktop + SSH/Putty

2006-03-04T13:06:00.001+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/03/remote-desktop-sshputty/

If you ever want to open your PC for remote access - but want something relatively secured. Here is a good solution using: OpenSSH, Putty, and public/private key authentication. Putty can access your OpenSSH server via a HTTP proxy on port 443, which is handy if you are behind a firewall (i.e. at work). Took a couple of articles to get it going:

Nothing like this works straight away, so here's a logical order of steps to get things going:

Install OpenSSH on the target machine, and install Putty on a non-firewalled machine somewhere. Go though the steps in the first document, and forget everything about the HTTP proxy stuff. If you can click 'Open' in Putty and see the 'Login:' prompt you're on the right track.
Luckily for me a friend opened up VNC for me on his home machine so I could test this step. If things aren't working here: make sure port 433 is being forwarded on your router (and you ISP doesn't block it!), and you've set up an exception in Windows Firewall to let port 443 in. Experiment with a different port number - make sure you configure the right port number in sshd_config, your router, and windows firewall.
Now that works try the HTTP proxy bit.
Happy with that? Now try setting up the public key authentication. I had some troubles here with OpenSSH being very sensitive to config settings. After changing a setting the SSH terminal window (above) wouldn't display anything. Keep a back-up of the config file when it works!

Google Kirkland

2006-02-28T20:59:00.000+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/02/google-kirkland/

Noticed on a blog somewhere that Google now has a location in Kirland, WA. Thought I'd have a look whereabouts, as I stayed in Kirkland while working with Microsoft. Turns out they are just across the road from the apartment building I was staying in (and where my digital camera was stolen, grrr). Have a look on Google maps. I was right on the corner of Central Way, and 6th - with my bedroom window getting all the noises from the early trucks going through that intersection.

Now why would Google set up in Kirkland? Couldn't be because it's a handy location to tempt engineers away from nearby Redmond?

Yahoo! UI Library

2006-02-15T12:31:00.000+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/02/yahoo-ui-library/

Yahoo are getting geek cred again. It wasn't that long ago I thought their web email, and photo hosting were the best. Google Mail and flickr have topped both of those.

Yet, the tide is turning. Just noticed the public APIs and code they are making available on the Yahoo! Developer Network Home. Of particular interest to me is the Yahoo! UI Library; check out the DHTML calendar sample (see the calendar reference).

Also thought the Random Videos was a very cool demo of the Maps API. Why does San Francisco lend itself so well to these projects? ;)

Debugging XmlSerializer

2006-01-31T21:19:00.000+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/01/debugging-xmlserializer/

This is pretty much the reason why I started this blog. I regularly find an article to help with a particular coding problem I'm having. The really frustrating thing is having the problem (or a similar one) a second time and not being able to google up the article again!

Which is what happened last night when I recieved a "Input string was not in a correct format" when deserializing the response from a flickr method call. Something had changed in the XML I was receiving from flickr, which caused a problem when attempting to deserialize the XML into a class. Here is a handy article that explains what is exactly going on when you deserialize an object: Troubleshooting Common Problems with the XmlSerializer.

The last section 'Debugging Serialization Code' shows how you can grab the dynamically generated serialization classes, and step into them to find where an error is occurring.

Google Video Highlights

2006-01-24T21:45:00.000+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/01/google-video-highlights/

It took someone as smart as Google to realise the current multitude of video clients and codecs isn't good for the web. The Google video site uses Flash for video playback. No need to download Quicktime, Real, or the latest Windows Media. I can actually send someone a link to a streamed video reasonably confident they'll be able to play it!

Here's some highlights I've discovered from the most popular page:

Quick way to find space used by each table in a database

2006-01-24T13:43:00.001+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/01/quick-way-to-find-space-used-by-each-table-in-a-database/

Found this very handy:

sp_msforeachtable 'sp_spaceused "?"'

Produces a kind of ugly output (returns a table for each table). The original article includes a query to get all the results into one table: Quick way to find space used by each table in a database

Reverse IP Lookup

2006-01-23T23:10:00.001+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/01/reverse-ip-lookup/

Whois Source has a pretty cool feature: Reverse IP Lookup. Enter an IP or domain and find out how many other sites are sharing the same IP. Requires 'silver membership' to see all the matching sites, but the free membership will tell you the number of sites that match. Good way to check if your hosting company is being honest about their semi-dedicated hosting!

Turns out the cheap (and reasonably good) hosting that I'm using for a project of mine, has managed to squeeze 183 sites onto the one box (for the cheap hosting - NOT the semi-dedicated one)!

Electronic Paper - Update

2006-01-13T13:04:00.000+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/01/electronic-paper-update/

Some more e-ink devices have appeared recently:

Sony Reader, very a Librie-like E-Ink e-book handheld for the North American market. From SMH: Easy on the eye: new e-book is a page turner.
Lexar JumpDrive Mercury - uses an e-ink display for the capacity meter. Pretty clever, because e-ink only needs power to change the display. That way it can constantly show you the capicity, without the need for an power within the device.
Ambient 5 Day Weather Forecaster from ambient.

The last two both use a segmented display (like a calculator or the old Game & Watch) which isn't nearly exciting as a high-res display.

Some links

2006-01-04T21:49:00.001+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/01/some-links/

Back to work tomorrow, 2 weeks of holidays are over. Some links I found funny / interesting over the holidays:

blogjam's North Korea trip - I think I discovered this from flickr. After I read it, I had Korean for lunch...
Courseware for .NET and C# - Know of anyone about to learn .net? I was pretty impressed with the online lessons here. The C# Tutorial looks like it'd be good for a developer to come up to speed on the language, and Application Development with C# and .NET covers the major APIs of the framework (plus more).
Did you get a webcam for Christmas? Or did you get one for someone else, and open it to 'make sure it works'? I found the Webcam Fire flash demo pretty cool (so is the snowstorm).
Lord of the Rings vs. The Matrix vs. Star Wars - really made me laugh.

Listamatic: CSS lists

2006-01-03T09:28:00.001+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2006/01/listamatic-css-lists/

In a similar vein to the css Zen Garden comes Max Design's Listamatic. A collections of CSS styles that can be applied to simple lists for "radically different list options". There is also a browser support chart that can save you some hassle of testing in a stack of browsers.

I'm currently playing with the clagnut CSS tabs for a project of mine. More on that later. Possibly much later...

Update: I think I'm going to go with Super-Simple DHTML Tabs now.

Electronic paper

2005-12-29T21:14:00.000+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2005/12/electronic-paper/

Electronic paper (or epaper) is a new display technology that I'm really keen to check out. LCD works by shining a light through a transparent display. Electronic paper contains configurable pigment that reflects light - just as ink on a piece of paper does. So epaper is just as readable as normal printed text. Anyone who has attempted to read a laptop in bright sunlight is probably half as excited as I am about this technology.

Citizen have a upcoming flexible digital wall clock. Currently the only commerical implementation of epaper is the Sony Librie EBR-1000EP. The product itself has some questionable purpose, but the reviewers are all commend the display.

From MAKE: blog:

The display looks so "real" it appears as if it's a sticker or printed on the screen.

From dottocomu:

The screen is unbelievable. Not quite paper, more like a dull plastic like look. My first impression of the device was that it was not an actual working unit, but a plastic mock up made for stores. With high contrast black text on a reflective background, the screen has a readability rivaling actual paper.

Virgin Atlantic Travel Podcast

2005-12-28T14:08:00.000+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2005/12/virgin-atlantic-travel-podcast/

Anything to do with technology and travel always piques my interest. Here's an extra podcast I can listen to/from work: Virgin Atlantic - Podcast Destinations [RSS]

LogParser

2005-12-09T08:45:00.001+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2005/12/logparser/

This handy utility lets you query logs just like SQL:

LogParser - Download LogParser.

Running this from the command line tells me which pages are getting 500 errors:

LogParser.exe "SELECT cs-uri-stem, count(*) FROM ex*.log where sc-status=500 group by cs-uri-stem"

Where ‘ex*.log’ are all my IIS log files…

Forensic Log Parsing with Microsoft's LogParser - covers some useful samples for identifying suspicious activity in your IIS logs.

Space Needle

2005-11-19T13:00:00.000+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2005/11/space-needle/

Space Needle,
originally uploaded by russ.au.

Experimenting with the blogs feature of flickr. Things are really coming together with "Web 2.0" technologies.

Viewing the Locks in MS-SQL

2005-11-18T16:30:00.001+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2005/11/viewing-the-locks-in-ms-sql/

select so.name, sli.*, sp.* 
from 
    sysobjects as so 
    join master..syslockinfo as sli on sli.rsc_objid = so.id
    join master..sysprocesses as sp on sp.spid = sli.req_spid
where xtype = 'U'

System tables reference:

We're off to Germany

2005-11-16T22:53:00.000+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2005/11/were-off-to-germany/

Australia in Germany 2006! Awesome!

Tricky Dynamic Controls in ASP.NET

2005-11-05T18:21:00.001+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2005/11/tricky-dynamic-controls-in-asp-net/

A few months ago I ran into a problem at work that forced me to really read up on dynamic controls and VIEWSTATE. Creating Dynamic controls requires a good understanding of the sequence of events when a page is generated in ASP.NET. If you don't understand what is happening things can get real messy, real fast!

I've created an ultra simplified version of the UI I was attempting to create. Pretty simple, I've got a DropDownList inside a table, that is populated with a DataBind when the page is first loaded. When the user selects and option from the DropDownList, and clicks a button, insert a column into the table. The dropdown always remains in the last column. I followed the guidelines from the codeproject article: Dynamically Created Controls in ASP.NET. Some important lessons to be learned from the article:

dynamically created controls don't survive a postback
so we have to 'remember' the controls, and recreate them after a postback

The first time I clicked the button everything worked as expected. Second attempt: not so happy! My DropDownList has lost its contents! View an example of broken dynamic contols: DynamicTable1.aspx (source). My first thought was to remove the test for !IsPostback in the Page_Load, so the DropDownList is populated everytime. This causes the DropDownList to 'forget' its selected position with each postback, and SelectedIndexChanged doesn't fire anymore. Presumably because I'm resetting it in Page_Load, ASP.NET doesn't consider it changed? Things are starting to get ugly.

The first clue as to what was going wrong came when I moved the DropDownList out of the table. Everything works! View an example of the working dynamic contols: DynamicTable2.aspx (source).

Some more research brings me to a really good article on the page events: Page Events: Order and PostBack by Paul Wilson. Important to note here is the order in which ASP.NET 'remembers' the contents on the DropDownList, and repopulates it.

Here is the order in which things are happening. First time we load the page:

OnLoad: DropDownList is data-bound.
SaveViewState: ASP.NET parses through the control tree, and saves the contents of each control. This is where the contents of the DropDownList are 'remembered'.

An option is selected from the DropDownList, and the button is clicked:

LoadViewState: Just as Paul Wilson says: "After ViewState is retrieved, the next method, LoadViewState, restores it to the page, and then recursively to each control and their children". This is where the DropDownList is being repopulated.
OnLoad: Page_Load calls RecreatePersistedControls, but at this stage there is nothing to recreate.
RaiseChangedEvents: This calls DropDownList1_SelectedIndexChanged, and the dynamically created table cell is added.
SaveViewState: This time around the contents of the DropDownList are 'remembered'. But the DropDownList is now in a different place in the control tree this time, because there is now a new TableCell.

At this stage everything has populated fine. For the second time an option is selected from the DropDownList, and the button is clicked:

LoadViewState: ASP.NET attempts to populate the page controls with the ViewState that was saved last time around. The dynamically created TableCell hasn't been created yet - so the control trees don't line up. The DropDownList doesn't get populated!
OnLoad: Page_Load calls RecreatePersistedControls, and a TableCell is created. Our TableCell has arrived a little late!

The mismatch of control trees can be demonstrated by switching ASP.NET Trace on.

The solution was to move the RecreatePersistedControls to a place earlier in the process. As Paul Wilson says: "The best use of this method (LoadViewState) is to restore any dynamic controls you created in events, based on values you must manually save in ViewState, which is now available to use.". Perfect - moved RecreatePersistedControls into an overriden LoadViewState like this:

protected override void LoadViewState(object savedState)
{
    base.LoadViewState (savedState);
    _persisted = (ArrayList)ViewState["persisted"];
    RecreatePersistedControls();
}

View the completed demo: DynamicTable3.aspx (source)

Handy Web Reference Links

2005-11-02T22:07:00.001+11:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2005/11/handy-web-reference-links/

Some links that I like to have bookmarked everywhere I'm working:

MSDN Library
- HTML and DHTML Reference
- JScript Language Reference
- ASP.NET Settings Schema - web.config settings
- ASP.NET Syntax - handy for the numerous DataGrid settings
- Regular Expression Syntax (JScript), .NET Framework Regular Expressions
- Formatting Types - for String.Format and ToString methods (MSDN2 link)
Firefox
W3C

css Zen Garden: The Beauty in CSS Design

2005-10-25T17:59:00.001+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2005/10/css-zen-garden-the-beauty-in-css-design/

CSS is something I've been meaning to learn properly for a while now. Every time I make a quick attempt to knock up something properly ulitising CSS for layout I get frustrated by browser incompatibilities pretty quick!

css Zen Garden: The Beauty in CSS Design is pretty phenomenal. The exact same HTML with different styles (or no style) can be rendered completely differently. Like these:

Idea for a project: take the content from backstage.bbc.co.uk, and create a stylesheet to give the BBC News website a liquid layout.

Onbeforeunload throwing errors in IE - coding around it in ASP.NET

2005-10-19T20:52:00.008+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2005/10/onbeforeunload-throwing-errors-in-ie-coding-around-it-in-asp-net/

Some of the most popular questions on any web dev forum are:

How do I trap the back button / stop people from clicking back?
How do I stop someone from viewing source?
How do I stop someone from closing a window/browser?

Short answer for all is: you can't! Especially if you are supporting multiple browsers & multiple versions. There are tricks for the first two questions - and I notice Gmail is pretty clever to redraw the UI without a server trip when you click back. I'm pretty confident in saying - you can't stop someone determined from viewing the source. Problem being that your webclient will need the source to display it!

How do you stop someone from closing a browser? Can you imagine how nasty pop-up ads would be if you couldn't close them? There is an event in IE onbeforeunload. This will pop-up a dialog asking 'Are you sure you want to navigate away from this page?' plus your own text - if you attempt to navigate away from a page.

I usually try to talk people out of this - it is kind of bad usability. I must be losing my powers or getting complacent because I wound up using this on a project recently. This is how I discovered a problem where a user clicking 'Cancel' on the dialog will throw an error in IE. It only seems to happen if the navigation is initiated by client-side script. View a demo of it here.

A google for 'onbeforeunload "unspecified error"' reveals a few articles about it. All centre around catching the 'unspecified error' in your javascript. Unfortunately my error was being thrown from within an AutoPostBack from a DropDownList - so I don't have access to the script to catch the error. There's a demo here, view the source here.

More scavenging around on Google and I find a way to hijack the postback. This is done by:

stashing ASP.NET's postback function into a variable
replacing the postback function with your own
your function does what ever you have to do
then calls the 'stashed' postback function

var __oldDoPostBack = __doPostBack;
__doPostBack = CatchExplorerError;

function CatchExplorerError (eventTarget, eventArgument)
{
    try
    {
        return __oldDoPostBack (eventTarget, eventArgument);
    } catch (ex)
    {
        // don't want to mask a genuine error
        // lets just restrict this to our 'Unspecified' one
        if (ex.message.indexOf('Unspecified') == -1)
        {
            throw ex;
        }
        else
        {
            alert('caught the error!');
        }
    }
}

This will work nicely. Its important to note that firefox will enter into the catch - because it doesn't like the onbeforeunload event. Also worth noting that the exception object also has a 'description' property in IE. I was originally testing this for the 'unspecifed' string - which throws another error in firefox. Both browsers seem happy if I use the 'message' property. The reference for the IE JScript Error object is here. The firefox reference doesn't appear to be complete?

This still leaves one more problem: the select box is still has the new item selected. There's not really any way to know that the user has clicked cancel on the 'Are you sure?' dialog. I could put something inside the catch in the CatchExplorerError. This would be a very very dodgy solution - as I'm relying on an error to occur to produce the UI that I want. What will happen when/if this bug gets fixed! A less dodgy solution (although I'm not entirely happy with it) would be to return the select box to its original selection in the onbeforeunload. This takes place before the dialog even appears. Yet at this point the browser has 'decided on' the form it will be sending to the server. So setting the selection here isn't submitted up to the server.

The script 'remembers' the original selection of the select box by storing it in an expando property.

<select id="DropDownList1" onclick="this.oldIndex = this.selectedIndex">

Then I set the select box back to its stored value when onbeforeunload fires.

function body_onbeforeunload()
{

    var DropDownList1 = document.getElementById('DropDownList1');
    if (DropDownList1.oldIndex != undefined)
    {
        // return the selectbox to its oldIndex
        DropDownList1.selectedIndex = DropDownList1.oldIndex;
    }

    event.returnValue = "You sure?";
}

View a demo of the completed solution here, and the source here.

Ajax Safari Update

2005-10-19T13:10:00.001+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2005/10/ajax-safari-update/

The problem I 'discovered' in Safari is a recognised (and fixed) bug in Konqueror:

Bug 108400 - XMLHttpRequest doesn't handle document charset

An AJAX Safari...

2005-10-15T18:34:00.001+10:00

The article you are reading has moved! It is now available at: http://blog.tinisles.com/2005/10/an-ajax-safari/

Playing around with an AJAX project at home. More of a learning project than anything. And I've run into a particularly troublesome problem with Apple Safari browser and the XMLHttpRequest object. Ah, the joys of cross-browser development. I cringe whenever I hear that a new browser has come out.

The problem comes about when I'm making an AJAX "method call" and the response contains extended characters. Mac Safari doesn't want to play nice with these characters (yet Win/Mac Opera & Win Firefox are fine). I almost feel sorry for those who have extended characters in their name! Playing with this AJAX wrapper from Michael Swartz. A look under the hood reveals how things a working. And I isolate it down to the request from the XMLHttpRequest object. Knocked up a quick spike (?) to see what is actually coming back from the server.

First off I tried loading two things from the XMLHttpRequest object:

a file on the server containing the extended characters.
simulating the request the ajax wrapper is making.

Hmmm... Loading the file works fine. The AJAX request comes back with some ugly characters in place of the extended ones. For a further look under the hood I've downloaded the Fiddler proxy to see what is going over the wire. Some observations:

Reponse Headers
From File	From Ajax
HTTP/1.1 200 OK Connection: close Proxy-Connection: close Content-Length: 649 Date: Sat, 15 Oct 2005 09:09:23 GMT Content-Type: text/xml ETag: "b04067251cfc51:ae2" Server: Microsoft-IIS/5.0 X-Powered-By: ASP.NET Accept-Ranges: bytes Last-Modified: Wed, 12 Oct 2005 07:47:07 GMT	HTTP/1.1 200 OK Connection: close Proxy-Connection: close Content-Length: 680 Expires: Sat, 15 Oct 2005 09:09:24 GMT Date: Sat, 15 Oct 2005 09:09:24 GMT Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/5.0 X-Powered-By: ASP.NET X-AspNet-Version: 1.1.4322 Cache-Control: private

Response Bytes
From File	EF BB BF 5B 27 41 6D 65 72 69 63 61 2F 41
From Ajax	5B 27 41 6D 65 72 69 63 61 2F 41

Different content types, and the preceding bytes EF BB BF on the file. A quick google discovers the bytes are a byte order mark. Presumably one of these is the reason why Safari doesn't want to treat the AJAX response as UTF-8?? Time to read up on unicode, this is a learning exercise after all: The Absolute Minimum Every Software Developer Absolutely, Positively Must Know About Unicode and Character Sets (No Excuses!)

Time to have a look at an AJAX application that isn't having problems with extended characters on Safari: Gmail seems to work fine. Time to fire up Fiddler again and see how the experts are doing it! I've sent my gmail account an email containing extended characters, interested to see how the content type and BOM will look. The content type response header from gmail looks like this:

Content-Type: text/html; charset=utf-8

The byte response starts off like this:

61	34	34	0D	0A	3C	68	74	6D	6C
a	4	4	.	.	<	h	t	m	l

And the HTML contains this meta tag:

61 34 34 isn't a byte order mark, maybe its just part of Google's own 'wire format'. This data is being read in via Javascript, maybe they are just stashing something handy here? The meta tag is worth experimenting with. So I create two HTML files one with the meta tag, and without. And load both via the XMLHttpRequest object. Interesting, the one containing the meta tag loads okay! Here's a stab in the dark theory: Maybe Safari doesn't pass the content-type from the response headers onto the XMLHttpRequest object? But it does interpret the meta tag? It previously loaded the file okay - but this contained a byte order mark which would've flagged it at UTF-8 regardless of the content type.

Now to experiment with this in my AJAX world. This time I try loading an ASPX page from the XMLHttpRequest object. A plain vanilla ASPX page with extended characters doesn't display the characters correctly. Now to try it with the meta tag. Visual Studio even provides an easy way of adding the tag: edit the ASPX page in design mode -> Properties -> Charset -> Unicode (UTF-8). And how does this look in Safari: Even uglier!

A closer look at the way Belém, Pará is being encoded:

From File:	42 65 6C C3 A9 6D 2C 20 50 61 72 C3 A1
From AJAX:	42 65 6C C3 A9 6D 2C 20 50 61 72 C3 A1
From ASPX: (without META)	42 65 6C C3 A9 6D 2C 20 50 61 72 C3 A1
From ASPX: (with META)	42 65 6C C3 83 C2 A9 6D 2C 20 50 61 72 C3 83 C2 A1

Huh?? The first two look pretty consistent with my (new found) understanding of UTF-8. Then adding the meta tag to the ASPX page is causing ASP.NET to change the response?? Is it getting encoded twice? Time to hit Google and find an explanation for this one!

The ASP.NET Resources site has an interesting article: Unicode in Visual Studio.NET 2003 - yet this mentions:

Some people—including myself—use the http-equiv="content-type" meta tag. In the course of this research I learned that this header has no bearing on anything because ASP.NET will always set a response encoding—yours or a default one.

Can't find anything about the meta tag on the web. Played around a bit, and had a look at two ASPX files with and without the meta tag. When viewed in a hex editor - it shows that Visual Studio is actually encoding the files differently when the meta tag is present! This only effects the contents of the ASPX page - this doesn't effect a label on the ASPX page, with its Text property set from the code-behind.

No meta tag

With the meta tag

Discoveries

The XMLHttpRequest object under Safari seems to require the meta tag present to correctly interpret a UTF-8 encoded response.
Visual Studio changes the encoding used to save the ASPX file when the this meta tag is present.

"When all is said and done - much more is said than done". Some interesting discoveries there. But this doesn't actually solve my initial problem. The response from the AJAX method only contains the result of the method. I could change it to wrap the reponse with html, head, meta and body tags - which seems to be the way Gmail is doing it. Experimented with this and it does actually work. But I'd have to strip out all the wrapper client-side. More client side code means more cross-browser worries. Or I could change the AJAX wrapper to make its response look more like downloading a file - the content type header, and the byte order mark at the start. This should 'play nice' in other browsers. Ideally I'd want something that integrates nicely back into Michael Swartz's AJAX project - shielding future developers from the palava I've just gone though. Lots of work for a browser that makes up for 0.85% - 5.1% of the net (when you include all KHMTL based browsers)! As I said - all a learning exercise!

openid.mode	associate
openid.assoc_type	HMAC-SHA1
openid.session_type	DH-SHA1
openid.dh_consumer_public
openid.dh_modulus
openid.dh_gen	Ag==