• Check out Chris’ blog at:  http://blogs.msdn.com/cbowen/

Here are my rough notes:

There was no slide deck – Chris jumped right into the code. Here are a few of my rough notes.

Consider Web Platform Installer 2.0 to install Azure tooling.

• Windows Azure Platform Tools
• Visual Web Developer 2010 Express

ASP.NET MVC concepts / benefits:

• “A lot of convention” – great in the long run, hard to grasp at first…
• Separation of Concerns – controller then view
• ASP.NET MVC is closer to the metal than traditional ASP.NET – if you want to implement, say, XHTML, then nothing stands in your way.
• Strongly-typed Controllers and Views can be generated once your model is in place.
• Controller may choose to pass along only a ViewModel – subset of full Model, or perhaps enhanced
• Model Binding is also by convention
• Hackable URLs

Tips and Tricks:

• Ctrl-Shift-Click on Visual Studio in Win 7 will launch in Admin mode which Azure requires.
• Can modify the T4 template for MVC to alter its UI options in wizards.
• Ctrl-M-G – bring me to the appropriate View for this Action

New in MVC 2 / ASP.NET 4:

• Html.DisplayForModel
• RenderActions – new in MVC 2
• New in ASP.NET 4 (not just ASP.NET MVC 2) is <%: “foo” %> where the “:” is a new feature as shortcut for HTML.Encode for the content.
• MVC 2 has powerful client-side validation based on characteristics of your model. Does not require a server-side round trip. You specify e.g., [Required] attribute on Model data – and you don’t need to write any imperative code.

http://asp.net/mvc – many great resources.

Windows Azure developer fabric – also known as “the fog” – is the Azure cloud simulator running locally.

Also check out by Arra Derderian’s write-up of the same Boston Azure meeting.

There were around 30 people in attendance at the meeting.

After our system or application reaches its capacity limits, what are our options to make it work even with the new demands? In other words, how do we make it scale?

The  following scalability approaches  allow us to handle more computations (with vertical and horizontal scaling) or more system instances (with juxtaposition scaling).

There are other very important scaling patterns that we might address in a future post – such as the scalability using algorithms that embrace parallelism (such as Map/Reduce), NoSQL-like schema-less storage, and data sharding. These are not covered in this article.

Scale Up with More Powerful Hardware

The obvious option in many cases is to address a scalability problem with better, faster, more capable hardware. If we can’t load that giant spreadsheet model on a computer with 512MB of RAM, we install 2GB and give it another try. If it is still too slow, we can use a machine with a faster processor or faster hard disk.

This approach can also be applied to web servers, database servers, and other parts of your system. Got an architecture problem? Get some better hardware.

This approach is variously called “scaling up” or “vertical scaling” – since we are addressing the problem by substituting a more capable system (usually a single server), but one that is still logically equivalent.

The essential point here is that, generally speaking, the limits of scalability are due to the limits of a single computer (or perhaps the limits of an affordable single computer).

In Scaling Up (also known as Vertical Scaling) the limitation is hardware related in a very specific way: how much memory, disk, and processor a single server can support…

The key challenge with Scaling Up is that you might run out of hardware options. What happens if you are running on the fastest available machine, or it can’t take any more memory? You may be out of luck.

Scale Out with More Hardware Instances

Another option is some cases is to leave the existing machines in place, and add additional machines to the mix to share the burden. This is variously called “scaling out” or “horizontal scaling” – a metaphor suggestive of spreading out the system as we add more machines beside the existing ones.

The key point here are that systems need to be architected to support Scaling Out – though the benefit is that they can generally scale a lot more than a Scale Up system – and scalability is enabled by the software architecture.

In Scaling Out (also known as Horizontal Scaling) scalability must be architected into the system… it is not automatic and is generally more challenging than Scaling Up. You scale by running on more instances of the hardware – and having these hardware instances share the workload.

As mentioned, scaling out is an attribute of the architecture of the system. This is a great fit for the elastic nature of cloud computing platforms.

Scale Side-by-Side with More Systems

In the real world, not all of our scaling concerns are with “the” system – we tend to have many copies of systems. I recently heard that for every production instance of SAP, there are seven non-production instances. And in my own experience, organizations *always* need many instances of systems: for development, test, training and … then we have different versions of all these systems … and the list goes on.

It turns out that another great use of the cloud generally (including the Azure Cloud) is for spinning up these other instances of our system for many purposes – sometimes we don’t want 1 N-node app, we want N 1-node apps.

I dub this use of cloud to be “scaling side-by-side” or “juxtaposition scaling” – a metaphor suggestive of putting similar systems beside each other, since they are a related collection of sorts, even though the instances of systems scaled side-by-side to are not connected to, or operationally related to, any of the other instances.

Scaling Side-by-Side (also known as Juxtaposition Scaling) happens when you use the cloud’s elastic nature to create additional (often  temporary) instances of a system – such as for test or development.

Also, scaling side-by-side (juxtaposition scaling) is orthogonal to scaling up (vertical scaling) or scaling out (horizontal scaling). It is more about scaling to support more uses of more variants (versions, test regions, one for training, penetration testing, stress testing, …) for overall environmental efficiency.

And, finally, like other ways to leverage cloud infrastructure, to efficiently scale side-by-side you will benefit from some automation to easily provision an instance of your application. Azure has management APIs you can call to make the whole process automagic. Consider PowerShell for building your automation…

[It was in a conversation at the Hub Cloud Club with several folks, including William Toll and John Treadway. John mentioned the SAP statistic and also suggested that adding more instances is just another type of scaling in the cloud. I agreed and still agree. So I am giving that type of scalability a name… Scaling Side-by-Side or Juxtaposition Scaling. Neither seems to have any real hits in Google, but let's see if this catches on.]

For web addresses, I used to consider the “www” prefix an anachronism and argued that its use be deprecated in favor of the plain-old domain. In other words, I used to consider forms such as bostonazure.org superior to the more verbose www.bostonazure.org.

I have seen the light and now advocate the use of the “www” prefix – which is technically a  subdomain – for clarity and flexibility. I now consider www.bostonazure.org superior to the overly terse bostonazure.org.

I am not alone in my support of the www subdomain. Not only is there a “yes www” group – found at www.yes-www.org – advocating we keep using the www prefix, there is also an “extra www” group – found at www.www.extra-www.org [sic] – advocating we go all in and start using two sets of www prefixes. While I’m not ready to side with the extra www folks (which would give us www.www.bostonazure.org), for those who do, you might want to know they offer the following nifty badge for your displaying pleasure.

While use of two “www” prefixes may one too many, here are 4 reasons to embrace a single “www’ prefix, followed by 2 tips on how to implement it correctly.

Four reasons to embrace the www prefix

Reason #1: It’s a user-friendly signal, even if occasionally redundant

The main, and possibly best, reason is that it is user-friendly. Users have simply come to expect a www prefix on web pages.

The “www” prefix provides a good signal. You might argue that it is redundant: Perhaps the http:// protocol is sufficient? Or the “.com” at the end?

First, consider that the http:// protocol is not always specified; it is common to see sites advertised in the form www.example.com.

Second, consider that the TLD (top-level-domain) can vary – not every web site it a “dot com” – it might be a .org, .mil, or a TLD from another country – many of which may not be obvious as web addresses for the common user without a www prefix, even with the http:// protocol.

Third, consider that even if there are cases where the www is redundant, that is still okay. An additional, familiar signal to humans letting them know with greater confidence that, yes, this is a web address, is a benefit, not a detriment.

Today, most users probably think that the Web and the Internet are synonymous anyway. To most users, there is nothing but the www – we need to realize that today’s Internet is inhabited by regular civilians (not just programmers and hackers).  Let’s acknowledge this larger population by utilizing the www prefix and reducing net confusion (pun intended).

Reason #2: Go with the flow

The application and browser vendors are promoting the www prefix.

Microsoft Word and Microsoft Outlook – two of the most popular applications in the world – both automatically recognize www.bostonazure.org as a web address, while neither automatically recognizes bostonazure.org. (Both also auto recognize http://bostonazure.org.) Other text processing applications have similar detection capabilities and limitations.

Browsers also assume we want the www prefix; in any browser, type in just “twitter” followed by Ctrl-Enter – the browser will automatically put “http://www.” and append “.com” forming “http://www.twitter.com” (though then we are immediately redirected to http://twitter.com). [Note that browsers typically are actually configured to append something other than “.com” if that is not the most common TLD there; country specific settings are in force.] For the less common cases where you are typing in a .org or other non-default setting, the browser can only be so smart; you need to type some in fully on your own.

Reason #3: Advantages on high volume sites

While I have been aware of most of the raw material used in this blog post for years, this one was new to me.

High traffic web sites can get performance benefits by using www, as described in the Yahoo! Best Practices for Speeding Up Your Web Site, though there is a workaround (involving an additional images domain) that still would allow a non-www variant, apparently without penalty.

Reason #4: Azure made me do it!

It turns out that Windows Azure likes you to use the www prefix, as described by Steve Marx in his blog post on custom domain names in Azure. This appears to be due to the combined effects of how Azure does virtualization for highly dynamic cloud environments – plus limitations of DNS.

In fact, it was this discovery that caused me to rethink my long-held beliefs around the use of www. Though I didn’t find any posts that specifically viewed this exactly like I did, my conclusion is the following:

I concluded the Internet community has changed over the years and is now dominated by non-experts. The “www” affordance inserted into the URLs makes enough of a difference in the user experience for non-expert users that we ought to just use the prefix, even if expert users see it as redundant and repetitive – as I used to.

In other words, nobody is harmed by use of the www prefix, while most users benefit.

Two tips to properly configure the www prefix

One of the organizations promoting dropping the www – http://no-www.org/ – describes three classes of “no www” compliance:

• Class A: Do what most sensible sites do and allow both example.com and www.example.com to work. This is probably the most easily supported in GoDaddy, and probably the most user-friendly, since anything reasonable done by the user just works.
• Class B: Redirect traffic from example.com to www.example.com, presumably with a 301 (Permanent) http redirect; this approach is most SEO/Search Engine-friendly, while maintaining similar user-friendliness to Class A.
• Class C: Have the www variant fail to resolve (so browser would give an error to the user attempting to access it). This is not at all user friendly, but is SEO-friendly.

So what are the two rules for properly configuring the www prefix?

Tip #1: Be user- and SEO-friendly with 301 redirect

Being user-friendly argues for Class A or Class B approach as mentioned above.

You don’t want search engines to be confused about whether the www-prefixed or the non-www variant is the official site. This is not Search Engine Optimization (SEO)-friendly; it will hurt your search engine rankings. This argues for Class B or Class C approach as mentioned above.

For the best of both worlds, the Class B approach is the clear winner. Set up a 301 permanent http redirect from your non-www domain to your www-prefixed variant.

You can set this up in GoDaddy with the Forward Subdomain feature in Domain Manager, for example.

You can also set it up with IIS :

• http://www.xoc.net/works/tips/domain.asp

Or with Apache:

• http://www.thesitewizard.com/apache/redirect-domain-www-subdomain.shtml

Tip #2: Specify your canonical source for content

While the SEO comment above covers part of this, you also want to be sure that if you are on a host or environment where you are not able to set up a 301 redirect, you can at least let the search engines know which variant ought to get the SEO-juice.

In your HTML page header, be sure to set the canonical source for your content:

<head>
    <link rel="canonical" href="http://www.bostonazure.org/" />
    ...
</head>

Google honors this currently:

• http://googlewebmastercentral.blogspot.com/2009/02/specify-your-canonical.html

Google is even looking at cross-domain support for canonical tag (though other search engines have not announced plans for cross-domain support):

• http://searchengineland.com/canonical-tag-2-0-google-to-add-cross-domain-support-27222

From an official Bing Webmaster blog post from Feb 2009, Bing will support it:

• http://www.bing.com/toolbox/blogs/webmaster/archive/2009/02/12/partnering-to-help-solve-duplicate-content-issues.aspx

Reportedly, Bing and Yahoo! are not yet supporting this very well:

• http://www.matthewsdiehl.com/seo/rel-canonical-link-tag-element-update/
• http://www.seoconsult.co.uk/SEOBlog/seo-techniques/rel-canonical-google-keeps-its-word-whilst-bing-and-yahoo-fail-to-provide.html

But it appears Bing and Yahoo! have either just implemented it, or perhaps they are about to:

• http://searchengineland.com/bing-yahoo-soon-to-support-canonical-tag-37405

You can also configure Google Webmaster Tools (and probably the equivalents in Bing and Yahoo!) to say which variant you prefer as the canonical source.

Unusual subdomain uses

There are some odd uses of subdomain prefixes. Some are designed to be extremely compact – such as URL shortening service bit.ly. Others are plain old clever – such as social bookmarking site del.i.cio.us. Still others defy understanding – in the old days (but not *that* old!), I recall adobe.com did not resolve – there was no alias or redirect, just an error – if you did not type in the www prefix, you were out of luck.

Another really interesting case of subdomain shenanigans is still in place over at MIT where you will find that www.mit.edu and mit.edu both resolve – but to totally different sites! This is totally legal, though totally unusual. There is also a web.mit.edu which happens to match mit.edu, but www.mit.edu is in different hands.

In the early days of the web, the Wall Street Journal was an early adopter and they used to advertise as http://wsj.com. These days both wsj.com and www.wsj.com resolve, but they both redirect to a third place, online.wsj.com. Also totally legal, and a bit unusual.

—

Credit for Traffic Light image used above:

1. capl@washjeff.edu
2. http://capl.washjeff.edu/browseresults.php?langID=2&photoID=3803&size=l
3. http://creativecommons.org/licenses/by-nc-sa/3.0/us/
4. http://capl.washjeff.edu/2/l/3803.jpg

The deck from this presentation is here: bill-wilder-two-roles-and-a-queue-AzureUG.net-windows-azure-virtual-user-group-14-july-2010

Follow me on twitter @codingoutloud.

Follow the Boston Azure User Group on twitter @bostonazure.

The first talk was an introduction to Cloud Computing, with a Microsoft slant towards Windows Azure. The second drilled into the Two Roles and a Queue (TRAAQ) design pattern – a key pattern for architecting systems for the cloud.

The PowerPoint slides are available here:

• Intro talk – bill-wilder-demystifying-cloud-computing-introducing-windows-azure-hartford-code-camp-19-june-2010
• More in-depth talk on the Window Azure Programming Model – bill-wilder-two-roles-and-a-queue-hartford-code-camp-19-june-2010

Also plugged the Boston Azure User Group to those attending my talks! Hope to see some of you at NERD in Cambridge, MA for talks and hands-on-coding sessions. Details always at bostonazure.org.

1. Michael Stiefel on use of relational databases in the cloud

At the May 27, 2010 Boston Azure meeting, Michael Stiefel was the main speaker. Michael gave a talk (slides here) on when you might want to use SQL Azure vs. “NoSQL” Azure in the cloud.

Some key phrases, highlights (very rough!):

• “Latency exists” – you need to care about it – and the speed of light matters - analogy to digging a hole: how fast you move the shovel
• “Bandwidth is limited” – you need to care about it – with hole-digging analogy, this is the size of shovel
• Computational Power gets cheaper faster than Network Bandwidth
• Connectivity is Not Always Available – welcome to the world of occasionally-connected devices like laptops on airplanes and the boom in mobile devices
• Waiting for Data slows computation
• Human Interaction – thinking time – can add latency to any operation
• Economics dictates scale out, not up
• Availability or Consistency? What is the Cost of an Apology?
• How consistent do you need to be? Weigh cost of consistency vs. cost oc of lost business… Business Decision!
• Design for Eventual Consistency

The meeting had around 25 people in attendance.

2. Discussion of Boston Azure Project

As part of the May meeting we discussed a proposal for the Boston Azure Project – an open source, collaborative, Azure-hosted coding project to “gently overengineer the bostonazure.org web site” – by Azurizing it. The proposal met with enough enthusiasm that it was adopted and we are moving forward with it.

3. Next: June 24 Meeting is All About The Code

In the June 24 meeting (RSVP here) we will get started on the Boston Azure Project. We will spend from 6:00 – 8:30 talking about it, organizing, and getting started. Bring your Azure-powered laptop!

My talks were Azure Demystified – What is Cloud Computing? What is Windows Azure? and Why should we care? followed by Two Roles and a Queue – The most important design pattern for Windows Azure Cloud apps.

The PowerPoint slides are available right here:

• Intro talk – bill-wilder-intro-to-cloud-computing-with-windows-azure-nh-code-camp-05-june-2010
• More in-depth talk on the Programming Model – bill-wilder-roles-and-queues-nh-code-camp-05-June-2010

Also plugged the Boston Azure User Group to those attending my talks! Hope to see some of you at NERD in Cambridge, MA for talks and hands-on-coding sessions. Details always at bostonazure.org.

Currently Boston Azure meets monthly on the 4th Thursday of the month in Cambridge, MA in the USA. This is an in-person meeting. I have received a loud and clear vibe from the Boston Azure membership that there is a thirst for more hands-on stuff. That was fueled further first by the hands-on Azure SDK meeting we held April 29, then again by the all-day Firestarter held May 8. But we need more. So, I had this idea for an ongoing community coding project that we can hack on together at Boston Azure meetings and other times… I bounced the idea off the community at the May meeting… since I received a really positive response, I now officially declare I plan to go ahead with it…

Introducing the Boston Azure Project

Why are we doing this Project?

The community wants to code. There is a desire to learn a lot about programming in Windows Azure – and what better way to get really good at programming Windows Azure than by programming Windows Azure.

The primary goal of the project is to learn – to get good – really good - at Windows Azure.

How will the Project work?

To be hands-on, we need a project… so here’s a project to provide us with focus:

We shall build a “gently over-engineered” version of bostonazure.org.

This “gently over-engineered” version of bostonazure.org:

(a) will provide a productive environment where participants (developers and otherwise) can learn about Azure through building a real-world application by contributing directly to the project (through code, design, ideas, testing, etc., …), and

(b) will do so by taking maximum advantage of the technology in the Windows Azure platform in the advancement of the bostonazure.org web site (though thinking of it as “just a web site” is limiting – there is nothing stopping us from, say: adding an API; exporting OData or RSS feeds; being mobile-friendly for our visitors with iPhone, Android, and Windows Phone 7 devices; etc.), and

(c) will serve the collaboration and communication needs of the Boston Azure community, and

(d) will provide an opportunity for a little fun, meet other interesting people, and enhance our skills through sharing knowledge and learning from each other.

When will we code?

We will reserve time at Boston Azure meetings so we can collaborate in-person on a monthly basis. Participants are also free to hack at other times as well, of course.

Wait a second… Does it make sense to port a little web site like bostonazure.org to Azure?

It does not make sense – not in isolation. Go ahead and crunch the numbers on Windows Azure pricing and compare with an ISP-hosted solution. However, this is the “gently over-engineered” part: we are doing it this way to show off the capabilities of Windows Azure and learn a bunch in the process.

What is the output of the Project?

This project will be feature rich, easy to use, accessible, flexible… and open source.

Keep in mind: Since bostonazure.org is the web presence for Boston Azure community…

It Has To Work!

This project is for and by the community.

Anyone can contribute – at any seniority level, with any skill set, with many possible roles (not just developers).

Then how do we reconcile anyone can contribute with it has to work? The community process needs to be able to make the code work before we put it into production. We have to make this work. And we will.

So, now you’ve heard it all – the whole idea – at least the Big Picture. I will post more details later, but for now that’s it.

Next Steps

Please contact me (on twitter or by comment to this blog post or by email) if you want to be one of the very first participants – I would like a couple of folks to be in a “private beta” to get some details squared away before I make the CodePlex site public.

Update 23-June-2010: The project is now live on CodePlex at bostonazure.codeplex.com.

1782^12 + 1841^12 = 1922^12

Wow! A counter-example for FLT. A theorem I’ve known about since I was a kid. One counter-example is all it takes to disprove the whole deal.

Fermat’s theorem states that the equation aⁿ + bⁿ = cⁿ has no solutions for integer n > 2, and integers a, b, and c not equal to zero. For n = 2 we have many solutions (Pythagorean triples), but none for n > 2. Nor should we, according to English mathematician Andrew Wiles, who proved FLT in 1995.

Until now. Or do we? The equation Jeff posted is a little awkward to validate since most calculators cannot handle numbers this size at full precision. They appear equal with a normal calculator – due to precision limits (round-off errors). Same problem with Excel.

So, since I’ve recently started playing with F#, I put together a trivial F# program (included below) to show the math at full precision, with the following results:

1782^12 + 1841^12 = 2541210258614589176288669958142428526657
and
1922^12 = 2541210259314801410819278649643651567616
which differ by
700212234530608691501223040959

So Fermat is safe. Saved by F#. But don’t feel bad if you fell for it – just be glad you knew what it meant. Bonus if  you noticed it on The Simpsons or Futurama.

We had 60-something folks attend the Boston Azure Firestarter (more photos) on May 8, 2010 in Cambridge, MA. This event provided both talks about important Azure concepts and hands-on-roll-up-your-sleeves-and-write-some-code Labs. Yes, attendees brought laptops! Feedback was positive. Many thanks to all the folks who helped make this event possible. This was a Boston Azure cloud computing user group event, supported by and hosted at Microsoft.

Many Thanks!

Those who helped prepare for the event, work the sign-in desk, help with technical problems, and handle the pair-programmer matching service included Nazik Huq, Chander Khanna, Joan Linskey, and Maura Wilder. Jim O’Neil and Chris Bowen (our East Coast Microsoft Developer Evangelists) were also on hand for trouble-shooting and general support and help.

Here was our speaker lineup:

1. David Aiken from Microsoft’s Windows Azure team came from the left-coast in Redmond to the right-coast in Boston to keynote the event. David gave many demos, a couple of which were My Azure Storage and his new URL shortening service hmbl.me.
   David’s keynote was followed by:
2. Bill Wilder: Roles and Queues talk + lab (http://hmbl.me/1OHBMZ)
3. Ben Day: Azure Storage + lab
   
4. Andy Novick: SQL Azure + lab (http://hmbl.me/1H46PK)
5. Jim O’Neil: Dallas and OData (http://hmbl.me/1OHC5W)
6. Panel Q&A (in the order shown in photo below): Mark Eisenberg (Microsoft), Bill Wilder, Ben Day, Jason Haley, and Jim O’Neil
   

After hours, a smaller group unwound at the sports bar over at the Marriott. This included Jim O’Neil, Maura Wilder, Joan Linskey, Bill Wilder, Sri from New Jersey, (okay, other names are vague!) …

At the Firestarter event on May 8, 2010, I spoke about Roles and Queues and worked through a coding lab on same. The final code is available in a zip file. The Boston Azure Firestarter – Bill Wilder – Roles and Queues deck can be downloaded – though since there were so many questions we didn’t get to covering a number many of the slides! – this was a hot topic!

The remainder of this post contains the narrative for the LAB we did as a group at the Firestarter. It probably will not stand alone super well, but may be of interest to some folks, so I’ve posted it.

• The TEMPORARILY Running Visualizer: http://baugfirestarter.cloudapp.net/
• The TEMPORARILY Running Roles and Queues Sample: http://bostonazuresample.cloudapp.net/
• These are “temporary” since the tokens for the accounts they are running expire soon (mid/late May or early June); the live instances will automatically stop working at that time.

The following procedure assumes Microsoft Visual Web Developer 2010 Express on Windows 7. The same general steps apply to Visual Studio 2008, Visual Studio 2010, and Web Developer 2008 Express versions, though details will vary.

0. Open Microsoft Visual Web Developer 2010 Express and select File | New Project

1. Select Windows Azure Service and click Okay:

If you have trouble finding the Windows Azure Service template, you can type “Azure” into the search box in the top-right to narrow the options. Also, if you don’t have the Windows Azure SDK installed, you will need to install that before proceeding – but there will be a link provided by Visual Web Developer 2010 Express that will direct you to the right page. Install it if you need to and try again up to this point.

2. You will see a special dialog box for New Cloud Service Project from which you will add both a Web Role…

and a Worker Role…

Verify that both WebRole1 and WorkerRole1 are in the list on the right side, then click OK.

3. Before you begin making code changes, you can run your new application. You can run it in the debugger by pressing the F5 key.

You will probably get the following error message:

The error message is telling you that you need to close Visual Web Developer 2010 Express and restart it with elevated privileges.

4. To start any Windows program with elevated privileges , right-click on the application then choose Run as administrator from the pop-up menu:

Before it obeys your request to run as administrator, Windows 7 will double-check by popping up a security dialog.

Now you can reload your project and try running it again. The app should run and you should see a blank web browser page.

5. Once you’ve proven your application runs, it is time to make some changes.

Make the code changes indicated for the Two Roles and A Queue Lab in CODING STEP 1.

Note: the “coding step 1″ and future coding steps were handouts (paper!) at the Boston Azure Firestarter on Sat May 8, 2010. In lieue of reproducing them here, I will post the final solution.

This lab will establish some WebRole basics.

6. When done applying CODING STEP 1, run the application again.

7. After demonstrating your application runs, Deploy it to Azure.

This is a simple application so it helps us get through the initial deployment with minimal challenges.

8. Apply CODING STEP 2 – Add Queue (in local dev fabric storage)

9. CODING STEP 3 – Add “DumpQueue” method and “FirestarterWebRoleHelpers.cs”

You will get the following dialog box – type “code file” into the search area on the top-right, select Visual C# Code File, and type in the filename “FirestarterWebRoleHelpers.cs” as shown and click Add:

The new file “FirestarterWebRoleHelpers.cs” will open in the editor. It should be empty to begin with. Cut and Paste in the contents from http://bostonazure.org/files/FirestarterWebRoleHelpers.cs.txt.

Why? The contents of this file has little to do with Windows Azure, so we don’t want to focus on it. But we want to use some utility routines from it so that we can focus on Azure concepts.

10. CODING STEP 4 – Adding Cloud-based Queue

First we need to configure the cloud.

Go to http://windows.azure.com and log in. You may wish to consult instructions on redeeming a token at http://blog.codingoutloud.com/2010/05/06/redeeming-an-azure-token/ or http://bit.ly/dgCuMn

Your storage account has a subdomain, as circled above. This – and the Access Key – need to be added to your Web Role and Worker Role so that they can access (and share the same queue within) cloud-hosted storage.

Right-click in Visual Studio on the WebRole1, select Properties, and select the Settings tab on the left. It will appear something like this:

Now click on Add Setting and give the new item the name “DataConnectionString”, the Type “Connection String”, and click on the “…”

This will bring up the Storage Connection String editor – fill in the fields – where your “Account name” is the same as the subdomain shown on the Storage Service (see above – in that screen shot it is “bostonazurequeue”) and the Key can be either Primary or Secondary Access Key (from same area in the Azure Portal):

You are NOT DONE in the screen yet. Also add a Setting named “StatusUpdateQueueName”– of Type “String” – with Value “updatemessagequeue1” as follows:

Click OK.

11. Now REPEAT BOTH STEPS for WorkerRole1.

Yes, add both Settings also to WorkerRole1 – they both will end up with the same settings. You can “cheat” with cut and paste in the .cscfg and .csdef files.

12. Enable Cloud-hosted Queue from Web Role

Now you are ready go on to make the code changes to use this new configuration item.

Apply CODING STEP 4: Enabling the Cloud-hosted Queue from the Web Role

Now run your application using cloud storage for the queue:

Note that you can also examine the contents of the queue online by visiting http://myAzureStorage.com and providing the same credentials you used when setting up the DataConnectionString above for both the Web and Worker roles.

13. Enable Cloud-hosted Queue from Worker Role

Now you are ALMOST ready go on to make the code changes to use this new configuration item.

Before applying the coding, we need to add a project reference (otherwise you won’t be able to Resolve use of networking classes used in the FirestarterWorkerRoleHelpers.). In Visual Studio on the right side, under the Solution Explorer, right-click on the References element underneath WorkerRole1 and select Add Reference, then from the .NET tab, select System.Web and click okay:

Also, similar to step 9 above, add a new Code File called “FirestarterWorkerRoleHelpers.cs” to hold some additional needed (but not core to Azure) code.

The new file “FirestarterWorkerRoleHelpers.cs” will open in the editor. It should be empty to begin with. Cut and Paste in the contents from http://bostonazure.org/files/FirestarterWorkerRoleHelper.cs.txt.

Now you can apply Apply CODING STEP 5: Enabling the Cloud-hosted Queue from the Worker Role.

14. Deploying to Staging Area in Cloud to Staging

15. Cutover from Staging to Production

16. Add in secret Twitter posting code from your Worker Role…

Yes, this can be done by including a hash character (#) as part of the message you type into your web application.

Illegal name causes “One of the request inputs is out of range”

Here is the code – why might this Windows Azure code snippet throw an Exception on the call to queue.CreateIfNotExist()?

CloudQueueClient queueStorage = storageAccount.CreateCloudQueueClient();
CloudQueue queue = queueStorage.GetQueueReference(“My Queue”);
bool queueJustCreated = queue.CreateIfNotExist();

The answer lies in the name we are using for the queue. Since the name is just a string, I assumed it can be any string. It cannot be any string.

Experimentation suggests the rules for naming a queue include: (a) use only lower case letters, (b) digits are allowed anywhere, and (c) internal single hyphens are okay too, but (d) name should not contain any spaces (e) nor any punctuation (other than hyphen).

So there would be no problem with valid names like:

• myqueue
• my-queue
• myqueue-3

But there would be problems with illegal names like:

• MyQueue
• my queue
• bill’squeue
• -nogood
• x-
• not—quite
• bad(name)

There may be additional nuances to the rules I didn’t discover, of course. One way to test out possible names quickly is with the myAzureStorage utility; just try to create a queue using the name and see if you get an error. Note that you can feed upper case chars to myAzureStorage but the created object will return with lower-case letter and will not cause an error.

Also, I only experimented with Queue names, but I assume the same rules apply to Blobs and Tables. Further research indicates this indeed is the case...

My challenge originally was to figure out why I got the Exception that was raised – that was the non-obvious part – the exception message did not tell me it was a problem with the name. After I figured it out and experimented a bit, of course then I found the documentation on allowed names which supports my conclusions… and adds details like length of name and the fact that the name is required to be a legal DNS name.

Note that you will be interacting with the Windows Azure Developer Portal (or Dev Portal for short) to redeem your token and establish your temporary account. The Dev Portal is useful to learn about and get to know.

1. First visit http://windows.azure.com and log in with the provided credentials. Use the provided email address for your Windows Live ID.

(NOTE: If any of the images in this post are too small to read, click on them to see a larger version.)

2. You will see a screen like the following. Note the row with the light blue background; this background color only appears when your mouse is hovering there. Click on the Project Name that matches your token account name.

(Notice that the account owner is “waaccts@microsoft.com” – this is because you are using a Token. Azure supports having an overall account that pays the bills, then sub-accounts for developers. This is an example.)

3.  Now you are in! You can proceed to review some of the help resources lists, or click around on any of the tabs to the left. But to create a new application that you can host on the Azure cloud, you can click on the “New Service” link next to the green “+” sign.

4. After you choose “New Service” you will see the following. Note the two main options in the middle for Storage Account and Hosted Services.

Select Hosted Services to begin. Be sure to click on the words “Hosted Services” as opposed to the “Learn More” link, as they are different.

5. The next page will ask you for a name – this name will only be used to help you identify this service from a list in the developer portal, so don’t spend too much time coming up with the perfect name. You don’t need to provide anything for the Description.

After providing a name, click Next.

6.  Now you are faced with a form where the choices you make actually do matter.  Here’s what’ you’ll need to do:

Type in a “Public Service Name” – this will be the Internet-visible sub-domain from which your deployed application will be visible. For example, if you choose “foo” then your Azure Service will live at http://foo.cloudapp.net after you publish it.

After you settle on a Public Service Name (using Check Availability button as need), you also need to select a Region. Pick the “anywhere” region in your continent (or closest to your continent) such as Anywhere US and click Create.

Here’s what mine looked like before I clicked Create:

Now your Azure Service has been created.

7. You will see a screen inviting you to Deploy a Hosted Service Package. We won’t do that now (though you could if you had an application ready). Instead, we will create an Azure Storage Account. From here:

Click on the “New Service” link which is near the top-left – below the large Windows Azure logo – and you will see the same screen you saw in step 4:

This time select Storage Account and you will see the following:

Give it a name, as I did in screenshot, and click Next.

8. As in step 5, this is also an important choice, though not visible to humans visiting your site. You will need to know this address to program against it. Of course you can look it up in the Dev Portal at any time, but why not choose a logical name. Fill in the fields similar to step 5 – be sure to choose the same Region you chose with step 5 – and click Create.

9. You are now ready to build and deploy Azure applications that use Web Roles, Worker Roles, and various kinds of storage.

You will need the keys shows to programmatically access your storage.

You can always come back and look up the values of these keys, of course. Also, if a key is compromised, you can regenerate it easily, invalidating the prior one. There are two separate keys that can be used/invalidated independently. These keys are specific to this Storage Service you created; you can create more Storage Services with different keys and even use multiple of them together.

Five easy steps to Enable IIS 7.5 for Windows 7 Developers

1. Open Control Panel. From the Search Control Panel search box in the top right, type in “turn windows features on or off” to show just this option. Click on the “Turn Windows features on or off” link underneath the “Programs and Features” heading.

This launches the Control Panel applet you will need.

Here are the Control Panel screens you will now see:

(If the graphics are too small for you, click on them to bring up a larger version.)

Eventually it loads.

2. Once loaded, scroll down to Internet Information Services as shown below, and check the desired boxes (the one I chose are shown in the next two screen shots):

(If the graphics are too small for you, click on them to bring up a larger version.)

3. The hit okay and wait …

4. Once complete, you will see this browser window – note the yellow bar:

5. You may want to select “Enable Intranet Settings” as shown below:

Done!

On May 8, 2010 there will be a Firestarter event focused on learning about Microsoft’s Windows Azure Cloud Platform. This FREE, ALL-DAY, HANDS-ON, IN-PERSON event will be held at the Microsoft NERD building in Cambridge, Massachusetts.

Here’s the idea…

You show up in the morning curious about Cloud Computing and the Windows Azure platform… and you leave at the end of the day loaded up from a crash-course/deep-dive into Azure, including a series of Azure-specific technical talks, Azure-specific programming experience (and working code), and access to resources to continue into the future…

Registration is now open!

Register at Eventbrite now.

What will be covered?

While we are still tweaking the schedule and exact contents, we didn’t want to delay opening registration. Rest assured the focus of the event is covering the most important Azure topics through a combination of informative talks and hands-on coding sessions.

We have some outstanding speakers lined up (including a keynote speaker we will announce soon).

More information on this community event – including a more complete/detailed schedule – will be updated progressively over the next few weeks on the web site of the Boston Azure cloud computing using group.

See you there!

[image credit: Firestarter logo built based on http://shaedsofgrey.deviantart.com/art/fire-45734782?moodonly=1 under Creative Commons Attribution-Noncommercial 3.0 License.]

1. Azure Talk

• Title: Cloud Computing, Microsoft Style: What is Windows Azure and Why You Should Care:

• Slides: Intro to Cloud Computing with Windows Azure – NE Code Camp – 27-March-2010
• Abstract / description

2. Prism Talk

• Title: Demystifying Prism for Silverlight & WPF:

• Slides: Demystifying Prism – NE Code Camp – 27-March-2010
• Abstract / description

6:00 – 6:45 PM – LAPTOP TIME! – if your laptop is capable of running IIS 7.x, bring it and we’ll help you configure it so you can program against Windows Azure. If you are already configured, come for LAPTOP TIME anyway and help out the others – or submit an entry to the Azure Code Project contest.

(pizza + salad will arrive during LAPTOP TIME)

6:45 – 7:00 – MAIN MEETING BEGINS with the Azure Update from Mark Eisenberg of Microsoft. Any questions about what’s happening with Azure? Want to hear some of the recent announcements? What’s moving and shaking in the Azure world? Join us at 6:45 to stay plugged in.

7:00 – 8:15 – INTUIT PARTNER PLATFORM – Intuit‘s Alex Barnett (Group Manager for Developer Relations) and his colleague Jarred Keneally (Developer Relations Engineer) will talk about the Intuit Partner Platform, the fantastic synergy with Windows Azure, the recently announced agreement between Microsoft and Intuit, and the opportunity for developers.

8:15 – 8:30 – WRAP UP – Boston Azure announcements, SWAG/Give-Aways, and Update on the Azure Firestarter we will be hosting on Saturday May 8th at NERD (all day learning event).

Please RSVP to help us with the list for front-desk security and to make sure we order enough pizza and salad. Hope to see you there!

How-To Configure an Azure Development Environment

0. Operating System Running IIS 7.x

No way of getting around the need for a Windows operating system that runs IIS 7.0 or IIS 7.5 — either directly or indirectly (see note below on using virtualization).

The operating system versions that support IIS 7.0 include:

• Vista Business Edition and Ultimate

The operating system versions that support IIS 7.5 include:

• Windows 7 Home Starter, Home Basic, and Home Premium (instructions for installing IIS 7.5 on Windows Home editions)
• Windows 7 Professional and Ultimate (instructions for installing IIS 7.5 on Windows 7 Pro or Ultimate)
• Windows Server 2008 R2 (instructions for installing IIS 7.5 on Windows Server 2008 R2)

What happens if I don’t have Vista, Win 7, or Server 2008?

There is one other hope. Use Virtual PC (or your favorite virtualization solution) and run an instance of a supported operating system in a virtual mode. (This blog post on creating a virtual machine image for Windows 7 using Virtual PC 2007 may help.)

Once you have an operating environment – real or virtual – the rest is the same.

How do I enable IIS 7.x to run?

If you are running a desktop version of Windows (Vista or Windows 7), it is likely you need to enable IIS through the control panel. Here are step-by-step instructions for enabling IIS 7.5 on Windows 7.

If you are doing this to prepare for the April 29 Boston Azure or the May 8th Firestarter meeting, please make sure you have enabled IIS7 with ASP.NET and have WCF HTTP Activation enabled.

1. Visual Studio

You need a copy of Visual Studio that supports Azure development. Currently your options are Visual Studio 2008 SP1,  Visual Studio 2010 (many editions), and Visual Web Developer 2010 Express Edition.

If you don’t know which version of Visual Studio to install, go with Visual Web Developer 2010 Express Edition (which is also free).

2. Windows Azure Tools and SDK

Download and install Windows Azure Tools for Microsoft Visual Studio 1.1 (Feb 2010) – this includes the Windows Azure SDK (and its samples)

Pay special attention to the first note at the top of that post:

Visual Studio must be run as an Administrator

You must run Visual Studio with elevated permissions when building Cloud Services for Windows Azure.

It is possible to create a shortcut that will launch Visual Studio with administrative permissions by setting the “Run as Administrator” checkbox in the Advanced Properties page of the Shortcut tab; this is available from the Properties menu option off of the context menu.

3. Microsoft SQL Server

A local installation of SQL Server is needed for local development work involving SQL Azure, Azure Table Storage, or Azure queues.

You only need to do this step if you didn’t install a version of SQL Server during Step 1 (above) while installing Visual Studio.

If you do not have a paid license for SQL Server, your best bet is to download a free copy of either Microsoft SQL Server 2005 Express or Microsoft SQL Server 2008 Express.

If you don’t know which version of SQL Server to install, go with Microsoft SQL Server 2008 Express (which is also free).

4. Windows Azure Platform Training Kit

At least for the April Boston Azure meeting, you will  also need the Windows Azure Platform Training Kit (Dec 2009 update) since Jason Haley (the main speaker) will assume we have this installed so he can reference it during the meeting.

5. Future Optional Extra Credit Tools

Once you have deployed to the cloud, you may also be interested in:

• Fiddler (for IE) and Firebug (for Firefox) to spy on http traffic going back and forth to a deployed Azure app
• What else?

6. Do You Have a Token?

If you are lucky enough to have a token for free (though time-limited) access to Azure services in the cloud, here’s How to Redeem an Azure Token.

The following video of a talk by Edwin Catmull, Ph.D., President of Pixar, is loaded with insights from the Movie Industry (specifically Pixar Animation Studios) that are applicable to those of us in Software Development – in fact, applicable to those of us in any team-oriented endeavor of any complexity. Every technologist who works on a team should listen to the talk. Then listen again. Any place where he talks about movies, substitute Software Development (or your team-oriented, complex vocation of choice) and think about how it applies to you.

Dr. Catmull ultimately answers the question of which is more critical: good people or good ideas? In doing so, he concludes unequivocally that People are more important, but doesn’t stop there - it is really those People on Effective Teams that makes the difference.  He also peppers the talk with interesting insights, such as competitors (in all industries) are always copying ideas – but often they copy the wrong ones – they tend to copy only ideas that were previously well executed (and, thus, usually successful), but should perhaps pay more attention to the far more numerous good ideas that were poorly executed.

Successful products have got thousands of ideas. There’s all sorts of things necessary for it to be successful. And you have to get most of them right to do it. That’s why you need a team that works well together.
-Ed Catmull, Ph.D., President, Pixar Animation Studios

I stumbled across the video when reading a post by Jeff Atwood admonishing us to Cultivate Teams, Not Ideas; Jeff’s post is also worth a close read.

Notes and Quotes

Notes I took of Ed Catmull’s illuminating talk follow – mostly direct quotes (prefaced with where in the video it occurs):

• @ 10:45 “We had confused the orgizational structure with the communication structure – a very common thing that happens to a lot of companies. They are different.”
• @ 13:30 “success hides problems“
• @ 15:25 (on doing “A” bug’s life and “B” toy story/direct-to-video) “We shouldn’t be thinking that it’s okay to be doing something that isn’t great.” (so they stopped the non-great ones)
• @ 21:55 “What’s the central problem, finding good ideas or finding good people?” – answer is very clear:
• @ 22:07 Teams are more important than ideas: “If you have a good idea and you give it to a mediocre group, they’ll screw it up. If you give a mediocre idea to a good group, they’ll fix it, or they’ll throw it away and come up with something else.”
• @ 22:27 “We think about ‘an idea’. When we think of ideas for movies, we think about ideas for products. And it’s usually thought of as some singular thing. But the reality is, these successful movies – as well as successful products – have got thousands of ideas. There’s all sorts of things necessary for it to be successful. And you have to get most of them right to do it. That’s why you need a team that works well together.“
• @ 23:49 On teams that function well together as a key competitive driver.”On the way we measure progress, is on how well that team gets together.”
• @ 23:57 “The first time you do it, it’s a mess.”
• @ 24:07 “The only failure is if you don’t learn from it – if you don’t progress. So the way you measure it, is this team functioning well together? And it’s a thing that’s never let us down. When that team functions well together they will succeed. When things are going wrong, they will fail.“
• @ 25:00 “People like to copy the wrong things.”
• @ 25:25 “They always remake good movies. And rarely do they beat the good movie. But the fact is, there are thousands of movies out there that are actually great ideas, but are poorly executed. They should be remaking bad movies.”
• @ 25:38 “How does it happen with products – the ones that do better are the ones just copy somebody else’s good product, they actually take the thing that’s going wrong and fix that. That’s the better idea.”
• @ 25:52 “They could copy the technology, but they couldn’t copy the process we were using to come up with the story.”
• @ 28:07 (on post-mortems) “Get a lot of facts about the process. When you put the facts up, and you are fact driven, it actually stimulates discussion. And it’s those discussions that are very valuable.”
• @ 28:39 “Summarize a few of the things we’ve learned:
  1. Constant review
  2. It must be safe for people to tell the truth
  3. Communication should not mirror the organizational hierarchy
  4. People and how they function is more important than ideas
  5. Do not let success mask problems; do a deep assessment.”
• @ 29:55 “Everybody says that the story is the most important thing, even if the story was drivel. It might be true – in fact, it is true – but it doesn’t effect behavior.”

Here are several convenient ways to tell whether a .NET assembly is strongly named.  (English language note: I assume the form “strongly named” is preferred over “strong named” since that’s the form used in the output of the sn.exe tool shown immediately below.)

Towards the end, this post discusses use of Strong Names with Silverlight.

Then in the final section of this post the often confusing – though very important – differences between Strongly Named assemblies and Digitally Signed assemblies are clarified.

But first, here are three approaches for telling whether a .NET Assembly is Strongly Named...

Approach #1: Testing for Strong Name on Command Line or in a Script

You tell whether an Assembly/DLL has been successfully strong-named using the Strong Name Tool (sn.exe) (which can be found somewhere like here: C:\Program Files\Microsoft SDKs\Windows\v7.0A\bin\sn.exe) by running the following at the command line:

sn -vf System.Data.dll

Here are the results when running against a strongly named assembly, then one that is not strongly named.

C:\> sn -v C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.dll

Microsoft (R) .NET Framework Strong Name Utility  Version 4.0.30128.1
Copyright (c) Microsoft Corporation.  All rights reserved.
Assembly 'C:\...\System.Data.dll' is valid

C:\> sn -v C:\WINDOWS\ismif32.dll

Microsoft (R) .NET Framework Strong Name Utility  Version 4.0.30128.1
Copyright (c) Microsoft Corporation.  All rights reserved.
C:\WINDOWS\ismif32.dll does not represent a strongly named assembly

Since the return value from sn.exe is 0 (zero) when the strong name is in place, and 1 (one) if not correctly strong named, you can test for this in a script by examining ERRORLEVEL, as in the following (put it into a text file called “sn-test.bat” for example and run as “sn-test foo.dll”):

@ echo off

if "%1"=="" goto END sn -q -vf %1 > NUL if ERRORLEVEL 1 goto NOT_STRONG

:STRONG
echo Has strong name: %1
goto END

:NOT_STRONG
echo Not strong named: %1
goto END

:END

Note that this will tell you whether it has SOME strong name, but does not tell you which one. So this technique is not appropriate for all uses, but might help in, say, an automated script that checks your about-to-be-released assemblies to make sure you remembered to add the strong names to them. (See note below – “Strong Names not for Security”.)

If you need finer-grain control and wish to write low-level code to ascertain the strong-naming status of an assembly, you can do that too.

Approach #2: Viewing Strong Name Details with IL DASM

Visual Studio ships with a handy utility – the Microsoft Intermediate Language Disassembler (ILDASM.EXE (tutorial)) – which can be used for disassembling .NET binaries to peruse the contents, perhaps for viewing the method signatures or viewing the .NET Assembly Manifest. It is helpful to load an assembly using IL DASM and examine the manifest to see whether there is a strong name key available. Your first step is to load the desired Assembly using the ildasm.exe utility. On my Windows 7 machine, IL DASM is found at

C:\Program Files\Microsoft SDKs\Windows\v7.0A\bin\ildasm.exe

and you can load up the System.Drawing.dll .NET Assembly as in the following example:

C:\> ildasm C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll

Once loaded, you will see a screen like the one below.

Note the MANIFEST section highlighted. Double-click on MANIFEST which load the following screen of manifest-specific data:

Find the section for the Assembly you’ve loaded – in this case, System.Drawing and following the section (which is marked with the “.assembly System.Drawing” directive highlighted above, and the content begins with the opening brace (“{“) shown above, and ends with its matching brace later in the manifest, and shown below.

The highlighted part of the manifest is the public key for this assembly. This public key can also be seen using the sn.exe tool, as follows:

C:\> sn -Tp C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll echo Not strong named: %1

Microsoft (R) .NET Framework Strong Name Utility  Version 3.5.30729.1
Copyright (c) Microsoft Corporation.  All rights reserved.

Public key is 002400000480000094000000060200000024000052534131000400000100010007d1fa57c4aed9 f0a32e84aa0faefd0de9e8fd6aec8f87fb03766c834c99921eb23be79ad9d5dcc1dd9ad2361321 02900b723cf980957fc4e177108fc607774f29e8320e92ea05ece4e821c0a5efe8f1645c4c0c93 c1ab99285d622caa652c1dfad63d745d6f2de5f17e5eaf0fc4963d261c8a12436518206dc09334 4d5ad293

Public key token is b03f5f7f11d50a3a

Note that the Public key in the output from sn.exe matches the highlighted public key in the image immediately above it (of course you should ignore the spaces between pairs of digits in the screen shot).

If an assembly is not strongly named, the Public key will be missing from the manifest and will not be displayed by sn -Tp command.

Since IL DASM comes with both Visual Studio and with the .NET SDK, it is already on the desktop for most .NET Developers, and is therefore sometimes the handiest tool. The third option, .NET Reflector, is a third-party tool, though one adopted by many .NET Developers due to its awesomeness. Reflector conveniently shows more details about the strong name.

Approach #3: Viewing Strong Name Details with Reflector

You can load an assembly in the free version RedGate’s .NET Reflector and quickly see the strong name details – or lack thereof for non-strong named assemblies. In the image below, see at the bottom where the strong name string is highlighted. Note that the strong name has five parts (though the Culture is optional):

1. Simple Name or Assembly name without the “.dll” extension (“System.Data” in case of assembly “System.Data.dll”)
2. Assembly version (“2.0.0.0″ in case of “System.Data.dll”)
3. Culture (“neutral” in case of “System.Data.dll”, but might be “en-us” for US English, or one of many others)
4. Public Key or PublicKeyToken (public part of the cryptographic public/private key pair used to sign the assembly, “b77a5c561934e089″ in case of “System.Data.dll”)
5. Processor Architecture – Defines the assembly’s format, such as MSIL (intermediate language) or x86 (binary for Intel x86 processors)

In the next image, see at the bottom where the LACK OF complete name string is highlighted; this assembly does not have a strong name to display, so “Name” field includes a null value for PublicKeyToken. (Note that in the real world, Spring.Core.dll is in fact released as strongly named by the good folks on the Spring.NET project; the screen shot below was done on a non-production version of that DLL.)

While you are at it… make Reflector the default program for “launching” assemblies (actually would need to be for all files ending in the .DLL extension, but Reflector is smart enough to not choke on non-.NET assemblies).

Approach #4: (Bonus!) Viewing Strong Name with Windows Explorer

This post promised three ways to tell if a .NET Assembly has a strong name - but here is a bonus 4th way. Windows Explorer will not show you the strong name characteristics of an assembly, with one exception – for assemblies in the Global Assembly Cache (GAC), strong name data is included in the Properties dialog. If  you are examining the GAC, this can be handy.

Of course, if an assembly is in the GAC at all, it is strongly named by definition; assemblies are required by .NET to be strongly named to be allowed in the GAC.

Strong Naming for Silverlight

Silverlight also has support for strongly named assemblies, which is needed for the Cached Assembly Feature introduced in Silverlight 3.0.

(Silverlight 4 also introduces supports for digital signatures on XAP files, created by signtool.exe, which are validated by the Silverlight runtime for out-of-browser (OOB) applications running with elevated trust.)

Strongly Name Assembly != Digitally Signed Assembly

Strong Names and Digital Signatures are Orthogonal Concerns - Almost

Strongly Naming and Digitally Signing are largely orthogonal concerns. They have different purposes, different tools, and the digital certificates may come from different sources (for publicly distributed binaries, the certs for Digital Signing usually will come from a PKI source, though that is not essential for the Strong Naming certs).

The only dependency among them is that if the Assembly is to be Strongly Named, then the Strong Naming step has to happen before the Digital Signing step.3

How do I check whether an assembly is Digitally Signed? You can run the following command to determine whether assembly “foo.dll” is digitally signed:

signtool verify /pa foo.dll

If you want to see the hash – for example, to compare with another assembly’s hash – then you can view it using the following command sequence:

signtool verify /v /pa /ph foo.dll | find "Hash"

Of course, you can use sn.exe and signtool.exe together (one after another) to examine an assembly to ascertain both whether it is strongly named and whether it has been digitally signed.

Strong Names are NOT for Security!

Finally, a word of caution… Strong names are about versioning, not about security. Strong names are more about avoiding DLL Hell (which is largely an accidental concern) than about avoiding hackers (which is deliberate). While a strong name may help alert you to tampering, realize that strong names can be hacked, and Microsoft emphasizes that  strong-named assemblies do not give the same level of trust as digitally signing:

Strong names provide a strong integrity check. Passing the .NET Framework security checks guarantees that the contents of the assembly have not been changed since it was built. Note, however, that strong names in and of themselves do not imply a level of trust like that provided, for example, by a digital signature and supporting certificate.

Consider digitally signing your .NET assemblies if it is important to you or your customers that the origin of the assemblies be traceable and verifiable. One source of digital certificates that can be used for Digitally Signing assemblies is Verisign which has Authenticode Certificates.

1. Download Reflector and install it; remember where it is installed

2. Using Windows Explorer, navigate to any DLL file on your computer

3. Right-click on the DLL and select “Open with…” from the popup menu

4. From the Caution dialog that appears, select “Open with…” (yes, you have to select it twice, once in step 3, again in step 4):

5. From the dialog that appears, choose the second option – “Select a program from a list of installed programs”:

6. Now you will simply need to choose  the “Browse…” button and navigate to wherever it is you installed Reflector.exe, click the “Open” button and you are done.

Now whenever you want to examine a DLL in Reflector, you can double-click on it from Windows Explorer. If you tool around in the command line like I sometimes will do, you can also launch the DLL in Reflector by just “running” it from the command line like you might do for a .txt document to open it in Notepad.

Realize that Reflector can’t do much with a DLL that is not actually a .NET Assembly, but will handle that case gracefully.

I just made some updates to improve the user experience (UX). Here are the changes I made, and I list the handy web resources I used to help me decide (where applicable).

For field labels, I place the label directly above the field it describes. I use <fieldset> and <label> to describe my markup, presumably making it friendly to screen readers. (Credit to templates provided with ASP.NET MVC for making this part easy.) This is the layout that Luke Wroblewski (author of Web Form Design: Filling in the Blanks) recommends in his Best Practices for Web Form Design for scenarios where you want to maximize speed, and the user is likely familiar with the data being requested.

Luke’s work is packed with clear, actionable, useful guidance that is easily applied and backed by user research. A gold mine…

Other recommendations I adopted from LukeW include:

• Since I have two required fields and three optional ones, I removed the (Required) labels, and stuck with the (optional) ones only.
• Added field length for optional Notes field.
• Made the Primary Action of the form (the Subscribe button) green, just like Apple Store (got the idea from UIE mailing).

Also from LukeW, but from a different source (The Apple Store’s Checkout Form Redesign, which I learned of from a UIE mailing):

• After the form is submitted, the user does not get an immediate email. I made that clear in the resulting text.

More improvements I can make in the future, also based on LukeW, include:

• Validate the data entered. In my case, this is currently only that a well-formed email address is provided.
• Provide more context on why data is being requested.
• Disable the Submit (Subscribe) button after it is clicked to avoid double clicks.

Other changes, outside of LukeW’s guidance:

• Mentioned “low volume” and “will not spam you” – though also need a privacy policy. Will get to that eventually..
• Programmatically set focus to the first field in the form when the page is loaded. I used the jQuery technique described here.
• Dropped “:” (colons) at end of labels while also changing labels text from leading caps style to mixed case (“Job title” instead of “Job Title:”). While not decisive for me, I found an interesting discussion around whether to use a colon in form labels.
• Made sure users could press Enter at any time to submit – but this will only work if they are not in the single multi-line field on my form. Need to consider removing that field … Need to consult with Joan on that one.

Used semantic mark-up to implement the green Submit (Subscribe) button mentioned above:

Submit (Subscribe) Button

HTML:

<input type="submit" id="primaryaction" value="Subscribe" />

CSS:

#primaryaction
{
 padding: 5px;
 color: #FFFFFF;
 background-color: #267C18;
 font-weight: bolder;
}

Old form:

sign-up form BEFORE the make-over

New form:

The AFTER screen shot

Dealing with the dreaded blocked files problem

Quickly Unblocking files marked as Unsafe

Ever download a Zip (or other files) and have to manually “Unblock” one or more files through Windows Explorer’s Properties dialog, like this?

Perhaps you been mystified by a message like this one from Visual Studio?

Mysterious Visual Studio error message

Read on to understand what’s happening and to learn how to more easily deal with Unblocking such downloaded files on Windows 7, Vista, and XP.

Why does this happen? Why do files become “Blocked”?

It appears that Internet Explorer (versions 7 and  8, maybe late patches in IE 6) applies the “block” in a stream (see below for more on streams). Some programs handle these “blocked” files more gracefully than others (looks like the latest Adobe PDF reader can read files like this w/o error).

I’ve seen blocking happen when downloading Visual Studio solutions from the web or from an email. I’ve also seen it when downloading documents to disk for use later. You can view the file’s properties in Windows Explorer to see if the block is there (look for the “Unblock” option, as seen above).

Another option is to use Notepad as illustrated in Colin Mackay’s Tip of the Day from nearly a year ago:

notepad MyDownloadedFile.zip:zone.identifier

Of course, substitute your filename in instead of BostonAzureSite.zip, but keep everything else identical. You will see the external zone stream:

[ZoneTransfer]
ZoneId=3

Windows is protecting us from ourselves. I guess if you don’t know what you are doing, you could hurt yourself; you’ve downloaded something “untrusted” from the interweb. This “protection” is in Windows 7 and Windows Vista, and apparently can even appear in Windows XP if certain Microsoft software updates are installed. I assume this has some benefits to someone!

But if you are a programmer / hacker / techie, and are comfortable hacking and generally know what you are doing, read on…

Easily Unblock downloaded files marked by IE as Unsafe

Normally, to Unblock files, you need to visit them one at a time with Windows Explorer, pop up the properties, and click on the Unblock button. This is tedious. If you want to be able to Unblock files more quickly, including whole directory trees at once, then consider doing the following.

Go get streams.exe from the big brains at Systinternals (which is part of Microsoft) and copy the executable to c:\bin\streams.exe. (If you put it somewhere else, make a compensating adjustment in the next step.)

Use Notepad to save the following into a text file named unblock-menu.reg and save it to disk:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\Directory\shell\UnBlock]

[HKEY_CLASSES_ROOT\Directory\shell\UnBlock\command]
@="c:\\bin\\streams.exe -d -s \"%1\""

[HKEY_CLASSES_ROOT\*\shell\UnBlock]

[HKEY_CLASSES_ROOT\*\shell\UnBlock\command]
@="c:\\bin\\streams.exe -d \"%1\""

What do these Registry Settings do?

This file lists some registry settings that will allow you to invoke streams.exe from the right-click context menu in Windows Explorer. Depending on whether you right-click on a folder or a file, the context menu will vary, as will the action. For a folder (directory), the registry setting says “call the program streams.exe with the parameters ‘-d -s’ and name-of-whatever-folder-i-clicked-on” which will cause streams.exe to visit each file in that directory tree and remove its streams information. If you right-click on just one file, the command is similar, except does not use the “-s” flag (which says to recurse into subdirectories).

Now install these registry settings by executing this file, probably by double-clicking on unblock-menu.reg from Windows Explorer. You will probably get a warning from Windows saying you must be nuts to attempt to modify the registry. However, if you are a programmer you are probably cool with it (and may also be nuts).

Now you are ready for the next time Windows protects you from yourself by blocking content you didn’t want marked as unsafe in the first place. You can right-click on any file or directory on your computer and select “Unblock” and that will apply the Unblock process. If you apply it to a file, it will only impact that file. If you apply it to a directory (aka folder) then it will recursively apply to all files and directories below that folder.

Here’s what you will see when you right-click on a directory / folder from Windows Explorer – note the new option:

And here’s what you will see when you right-click on a file:

Other Options

I learned about the streams.exe utility from a handy post about unblocking files for Vista. In that same post, they describe how to turn the feature off altogether using the Policy Editor.

Caveat Emptor

With great power comes great responsiblility.

I do not advise applying streams.exe to C:\ as I have no idea whether it is ever a good idea to remove all streams from all files. This may in fact be a very bad thing to do. I just don’t know.  I am personally comfortable doing it with Visual Studio projects and various documents I’ve downloaded, and have not run into any trouble, but be careful out there…

Note that the streams utility will nuke *all* the streams. So if your files contain useful additionals streams, this is probably not going to be a helpful strategy. I expect this is not likely to be a problem for the vast majority of people.

Interesting write-up on Alternate Data Streams, which are a feature of NTFS file system. Even some interesting streams hacks out there.

If you try to use Visual Studio 2010 RC to open an existing ASP.NET MVC web site that was built on ASP.NET MVC 1.0 under Visual Studio 2008, you might expect it to be converted and to open successfully. That’s what I expected, but that did not happen. Visual Studio 2010 gave me conversion errors.

But.. there is a straight-forward way to migrate your ASP.NET MVC project from Visual Studio 2008 to Visual Studio 2010 RC.

Here’s what you need to do:

1. Uninstall the MVC 2.0 RC (or RC 1) bits that ship with the RC if you’ve already installed Visual Studio 2010 (and you probably have if you are reading this blob post – but refer to Phil Haack’s post for full details)

2. Download the latest MVC 2.0 RC 2 bits and install them into Visual Studio 2010

3. Download the work-in-progress MVC converter tool and run it on your project

4. Open your project in Visual Studio 2010 and it will now be able to complete the conversion

One step in the conversion to Visual Studio 2010 will also ask you if you wish to convert to .NET 4.0:

Since I wish to deploy this site back to a host with .NET 3.5 SP1, I chose No. I am willing to live with deploying the ASP.NET MVC RC 2 bits, but not so with .NET 4.0 as I don’t have control over that (I deploy onto a shared server).

Presumably this will all be integrated and seamless in the final release of Visual Studio. But it worked for me…

Identity, Claims, Geneva, and Trust in the Cloud

This was Boston Azure meeting #4, Feb 25, 2010

(Curt’s slide deck will be made is now available (PPT 2003 format))

Some notes from Curt’s talk:

• Azure devs need to care about claims-based-identity and federated identity
• Geneva is Microsoft’s solution in this space
• Perfect storm of paradigm shifts
• Caution: Geneva is not a panacea for “Identity in the Cloud”

“The most important thing Microsoft has done in identity since they came out with ActiveDirectory” – and think about how much we rely on AD for enterprise-class apps – “it’s like air”

First two lines of every program (with nod to Kim Cameron):

1. Who are you?
2. What are you allowed to do?

• The answer to the second generally depends on the answer to the first. “Identity” is an input.

Big architectural problem: the ‘net was built w/o any way of knowing who you are connecting to (http has no identity)

• RBAC (role-based access control) is not as flexible or powerful as claims
• Any statement that can be validated can be a claim

Microsoft’s Federated Identity Group very focused on standards. To be serious also about Azure, you need to pay deep attention to the key standards.

Azure is only cloud solution REALLY solving the SSO problem in the cloud – and into your data center. Identity must flow…

Geneva Technology stack:

• Microsoft Federation Gateway (“ADS 2.0 in the sky”)
• Windows Identity Foundation (some .NET namespaces)
• Active Directory Federation Services 2.0
• Windows CardSpace 2.0

Curt will focus for a while in his talk on Windows Identity Foundation…

Consider three parties – Security Token Service, Your App, End User

1. Secure Token Service <=> Your App – Initial handshake uses WS-Federation (metadata, X-509 cert)
2. End User <=> Your App – claims via WS-Policy (which Security Token Service(s) I trust)
3. End User <=> Security Token Service – verify policy
4. End User <=> Security Token Service – WS-Trust
5. End User <=> Your App – lots of interactions – signed tokens, claims

ADF 2.0 – same programming model across web and desktop

RP = relying party – someone that consumes tokens

PingIdentity.com

OpenID cannot help with Man-in-the-middle attacks

“Shred the token” is lingo meaning to decrypt a token.

Coded example showing implementation of Passive Federation.

• Showed the 8 (!) prerequisites
• Create full-trust app (Since runtime not fully baked in Azure yet – and certainly not yet in GAC)
• Add a reference to Microsoft.IdentityModel (which is a stronger programming model than older System.IdentityModel)
• using Microsoft.IdentityModel.Claims;
• using System.Threading;
• Then write like 5 lines of code…
• Subclasses from IIdentity, IClaimsIdentity, IClaimsPrincipal (same ones used in other .NET apps)
• WIF ASP.NET Processing Pipeline does a lot of behind-the-scenes work for us
• IsInRole method is key
• Then in the ASP.NET app, there is some 10 lines of key code for X-509 cert – which contains the URL (or domain, really) of the web site that the cert applies to – a problem with “localhost” and “stage.foo.com” etc. due to mismatch – this goes in Global.asax – plus several other blocks of code…

Now for the STS (which you don’t need if you have ADFS 2.0)

• There is a Token Service for ASP.NET visual studio template with Geneva install
• Many coding steps here (see slides)
• Use FedUtil (which comes with Geneva and VS 2008, VS 2010) to create a trust between your application and your STS
• There is a lab to create your own STS

Claims-based systems externalized the work of AuthZ, AuthN to your STS – not stuck in your code.

Geneva supports delegation – embedding one token within another…

(21 people at the meeting)

Thursday February 25, 2010 at NERD in Cambridge, MA

The following is an update to the agenda for the upcoming Boston Azure User Group meeting this coming Thursday.

To RSVP for the meeting (helps you breeze through security and helps us have enough pizza on hand), for directions, and more details about the group, please check out http://BostonAzure.org.

To get on the Boston Azure email list, please visit http://bostonazure.org/Announcements/Subscribe.

[6:00-6:30 PM] Boston Azure Theater

The meeting activities begin at 6:00 PM with Boston Azure Theater, which is an informal viewing of some Azure-related video. This month will feature the first half of
Matthew Kerner‘s talk on Windows Azure Monitoring, Logging, and Management APIs from the November 2009 Microsoft PDC conference.

[6:30-7:00 PM] Upcoming Boston Azure Events and Firestarter

Around 6:30, Bill Wilder (that’s me) will first show off an interesting CodeProject contest, then will lead a discussion about the future of the Boston Azure user group and the upcoming All-Day-Saturday-May-8th event.

Curt Devlin will take the stage at 7:00 PM.

Before the meeting, if you want a little more context, you may wish to read Kim Cameron’s essay The Laws of Identity, which is an insightful analysis of challenges around Identity.

[7:00-8:15] Featured speaker: Curt Devlin of Microsoft

Abstract

The Azure platform presents new challenges for identity management. As developers and architects, we will still have to answer the same two perennial questions: 1) Who are you? 2) And what are you allowed to do? But the traditional on-premise approaches to authentication, authorization and identity lifecycle control are not adequate to meet these new challenges. The Geneva suite of technologies for claims-based identity management can be help because cloud computing can be thought of as a “special case” of federation, with many similar requirements. Together these two paradigms appear to be converging to create the perfect storm of paradigm shifts. However, even WIF, ADFS 2.0 and CardSpace 2.0, will only take us part way to a complete solution in the near term. This session will provide a simple recipe for claims-based identity management in Azure using Geneva, discuss some of the most important reasons why this is necessary, and finally some of the shortcomings we will still have to contend with on the road ahead. The aim is to educate, motivate, and caution.

About Curt Devlin

Curt Devlin is currently an architect in Microsoft DPE (Developer & Platform Evangelism) focusing on distributed solutions across many industries and customer segments. Curt is a Microsoft veteran of many technology wars, with more than 20 years of experience developing solutions on the Windows and .NET. platforms. He is also a dyed-in-the-wool New Englander with avid interests in sailing, skiing and nearly everything else.

Curt blogs as the philosophical architect, plus you can check out his MSDN articles Enterprise Authorization Strategy and SaaS Capacity Planning: Transaction Cost Analysis Revisited.

Curt’s blog post announcing his participation in this meeting: http://blogs.msdn.com/curtd/archive/2010/02/23/an-evening-with-identity-in-the-clouds-and-the-boston-azure-user-group.aspx

Steve Krug speaks at BostonCHI

Notes from 08-Dec-2009 meeting

• Steve’s new book - Rocket Surgery Made Easy - due in bookstores in a couple of weeks – material from this talk will be in his book…
• Passed a copy of his book around through the audience for quick peek
• 150 or so people in attendance

Writing process

1. writing process: collect years of notes
2. need deadlines to force you to write (and finish)
3. collect relevant articles for each chapter and post them all on a wall
4. once you’ve begun to panic, start throwing things overboard
5. Outline, write, iterate
6. get help
7. throw things overboard (save for next book?)
8. FAQ at the end of every chapter – good idea
9. Doing usability (vs How to Think About Usability)

Doing Usability

1. A morning a month – that’s all we ask
2. Run tests – with whole team – at our site – scheduled monthly and well ahead of time – and debrief immediately after over lunch
   1. maybe do right before iteration planning
   2. company-sponsored lunch
3. Start earlier than you think makes sense
4. The sooner you get information, the better use you can make of that information
5. Don’t wait until the site is “finished” – test it as soon as it is testable
6. Don’t worry that “you already know about the problems”
7. If you have nothing built, test other people’s sites
8. Are you working on the site? –> Yes ==> test now!
9. Recruit loosely and grade on a curve
10. Beware implied domain knowledge
11. Some testing can be done w/o your target audience
12. Usability testers say many things that are similar to what therapists say – “what did you expect to happen when you did that?”
13. Keep yourself out of it! It is about the user and what the user being tested is thinking.
14. Make it a spectator sport
15. Get everyone to come and watch the test – frequently the observers suddenly just “get it” that they are not their users
16. Have high quality snacks. Keep the sessions short and compact. Do them on site. Make it easy for everyone to join in, hard to have a good reason to skip it.
17. Record sessions with Camtasia ($300). Get a good USB desktop microphone ($25). Don’t record user’s face (“useless and distracting”). Use a screen sharing service (like GotoMeeting, $40/month?) to control the UI. High quality audio is important, and should be channeled to the observation room via GotoMeeting or Skype.
18. Focus ruthlessly on a small number of the most important problems
19. Serious because everyone will come across them, or serious because for those who do encounter them will be seriously impeded.
20. Don’t feel you need to come up with the “perfect” fix
21. Ask everyone in the observation room to write down the three most important issues they observed. These are raised at the debriefing session over lunch.
22. When fixing problems, always do the least you can do ™
23. Prioritize the list, then work your way down the list until you run out of time/resources
24. Sometimes a tweak is better than a redesign – don’t get suckered into a redesign – the perfect is the enemy of the good!
25. Focus on the smallest change we think we can make to address the problem we observed
26. Q&A
27. Remote Testing?
28. Remote testing is handy – saves travel time, recruiting pool grows, … do over skype or GotoMeeting.
29. How to get it off the ground? Try a group usability test of competitor’s site – everyone can get behind that. Do one and hope people get enthused about it. Make the cost of swinging by to watch the testing really small.
30. Be very cautious about asking users how to fix the problems they’ve encountered. “Users are not designers.” “Hopefully you know a lot more than they do about design.” Listen to them, but be careful that they’re ideas are not well thought out. The purpose of testing is to “inform your design intelligence”.

We watched a clip from the first day of PDC where Ray Ozzie and others talk Azure in the keynote …

Discussed idea of an Azure Firestarter event – possibly for May 8, 2010 – and this seems to flow nicely from our scheduled April meeting where Jason Haley is scheduled to talk about getting started programming in Azure, such as with the Azure SDK.

Ben Day spoke on Windows Azure storage. Some quick notes / points from his talk:

• Relational databases have a schema – all rows in a table have same columns, structure is defined before pouring in any data, data is not repeated (third-normal form breaks out data to appear only once – no redundancy)
• … database will manage transactions across tables
• … though mixed with replication can provide performance challenges
• This changes for Azure Table Storage!
• … though Azure Table Storage can scale way better – horizontally (“out”) whereas traditional SQL RDBMs tend to scale best vertically (“up”) – to larger boxes – which is more limiting and tends to be more expensive.
• Do we need to rethink what needs to be transactional? Can we use a simplified transactional model – such as just within one table – or one instance of one table…
• … compensating transactions are another approach
• Securely storing data
  • Encrypt (compute is cheap)
  • If you encrypt a key, it won’t work for indexing
  • Search is harder if you encrypt
• String columns have a 64KB size limit for Table Storage – so reference larger objects in a Blob
• Unit testability
  • Abstract away you r persistent store, such as with Repository pattern – so you can unit test
  • Encapsulate business logic, such as with Service Layer and Domain Model patterns
  • Extract logic from UI using MVP (Model View Presenter)
  • Use Mock objects
• Ben will come back to finish the story!

Around 23 attended.

Technology + Communications + Business-Awareness = Influential Architect

The overall event was excellent. It was organized primarily by Bryan Tuttle of CodeRight, a Consulting/Training company. Many thanks to Bryan for a job well done!

Guest speakers were Michael Stiefel and Mark Eisenberg

Meeting was held December 3, 2009 at the Microsoft NERD

We opened with Boston Azure Theater, kicking off a few minutes after 6:00.  For around 45 minutes we watched a video of Microsoft Director Manuvir Das’ PDC talk A Lap Around the Windows Azure Platform.

From there, Microsoft’s Mark Eisenberg walked us through a summary of key Windows Azure announcements made at (or right before) the Microsoft PDC in November. The deck Mark used is available BAUG_PDCHighlights. There was a lot of interest in the announcement details and in the pricing model.

Our keynote speaker, Michael Stiefel, followed with a detailed look into the project “Dallas” announcement, showcasing the Dallas “Data as a Service” platform, working through sample apps, a custom mashup – with code, demonstrating the straight-forward programming model (ATOM feeds), and showing use of the data directly within Excel. Michael wrapped up by reviewing the business model – and discussing the interesting possibilities (publishers can publish – and others can consume – data so much more easily than today since Microsoft will have eliminated the “contract friction” we’d have if every consumer had to strike a deal with every publisher).

If you look at the graphic, and you consider the “not detected” section, it reads 49.99%, which means that the sum of those detected is better than half.

At PDC 2009 in November, Scott Guthrie announced that Silverlight penetration was up to around 45%, up from around 30% in the summer. These RIAStats numbers feel in line with that.

Of course, I know this doesn’t “prove” Silverlight is really on more than 50% of browsers, as RIAStats are not a perfect reflection of the web as a whole, but it seems an interesting milestone nonetheless.

Silverlight has been in the wild for 863 days: Silverlight was released for real (RTW, or “released to web”) on 05-Sep-2007, followed thirteen months later by Silverlight 2 RTW 14-Oct-2008, then less than nine months later we saw Silverlight 3 on 09-July-2009. Silverlight 4 is in beta – maybe Microsoft will announce its release at MIX10 in mid-March? If they do, that would be on a similar release rhythm as from Silverlight 2 to Silverlight 3.

Silverlight’s installed base will also get another boost from the 2010 Winter Olympics next month as well. (And Silverlight 2 shipped shortly after the 2008 Summer Olympics.)

It is interesting to note that another tracking site – StatOwl.com – not only shows the penetration lower – and doesn’t agree on any of the numbers – but also doesn’t even agree on relative installed base across versions [EDIT: after Comment from Travis Collins, added in Silverlight 4 = 0.04 for RIAStats]:

I’m not sure why they don’t agree – perhaps differences in sample sizes, sampling methodology, or due to different audiences being sampled.

Also, if you check the math yourself, you’ll see the values shown don’t tie down perfectly for RIAStats (though they do for StatOwl); if you add up the individual Silverlight versions along with the Undetected, you won’t get exactly 100%. Some sort of rounding errors I assume. [EDIT: See explanation in Comment from Travis Collins, RIAStats creator.] But I also assume that the Undetected = 49.99% is most likely right (at least not wrong due to a rounding error, since it is harder to round wrong there).

EDIT 01-Feb-2010: Found an interesting, relevant post on Cool facts about Silverlight penetration / mindshare from UXPassion.com.

Profiles

1. Will enable deployment with subset of JEE feature set – so can leave out parts you don’t use – thinner footprint, less complexity?

Theme = Loose Coupling

1. decouple server and client via well-defined types and “qualifiers” (beyond Interfaces)
2. decouple lifecycle of collaborating components via
   1. server-side lifecycle management by Container
   2. allow stateful components to interact like services via message-passing
3. decouple orthogonal concerns via Interceptors
4. decouple msg producer from consumer via Events

Theme = Strong Typing

1. eliminate lookup using string-based names
   1. enables smarter auto-complete, more power in compiler type checking

What’s unique?

1. implementations of a type may vary at deployment time – without need for central list of available implementations
   1. no need to explicityl list beans (e.g., Spring) or use Java-based DSL (Guice)

What kinds of things can be injected and how?

1. Most java classes
2. EJB session beans
3. Objects returned by producer methods
4. Java EE resources (e.g., JMS topics/queues)
5. Persistence contexts (JPE EntityManager)
6. Web service references
7. Remote EJB references
8. anything else can be supported through SPI (flexible extensibility via metamodel)
9. Can define business-sensible attributes to specify injection types (e.g., InformalGreeting extends Greeting class, then have an @Informal attribute)
10. Can use injected object in a JSF or JSP page – e.g., container will instantiate the right objects (construct as needed, etc.) and pass it is such as in: <h:commandButton value=”Say Hello” action=”#{printer.greet}”/>
11. Beans may need to be stateful – this is supported too – handled as lifecycle attributes such as @RequestScoped for per-request or

Scopes and Contexts

1. Extensible context model
2. Dependent scope, @Dependent
3. Built-in scopes
   1. @ApplicationScoped, @RequestScoped, for servlet we have @SessionScoped [e.g., Login state object may store username in a member variable], for JSF requests @ConversationScoped
4. Custom scopes – third party frameworks can support via SPI
5. KEY POINT: Client does NOT know anything about the lifecycle of the session-scoped object
6. Conversation context is scoped INSIDE OF (DOES IT NEED TO BE WITHIN, or is it just defined as more granular a SCOPE than) a session – can have more than one Concersation that don’t know about each other – supports multiple tabs, wizards, AJAX and other multi-step sub-tasks
7. Better abstracts some concepts – a set of mappings can be defined such that a class can loosely reference (my term), say, a value from another object (like the user’s first name, from the Login object), and the container will take care of all the heavy lifting and just insert that value – nicely separates lookup logic so your business logic code can stay cleaner and refer to (as in example above) their “first name”, not the Login object directly

Interceptors

1. ANOTHER APPROACH FOR WHAT ASPECTS ARE USED FOR TODAY
   1. Perceived to be more flexible, more generally useful (there are very few uses for Aspects now – nothing new in 5-10 years!)
2. Should be decoupled from implementation via semantic annotations
3. Should be deployment-specific – e.g., can turn off my transaction support during testing
4. Ordering of interceptors matters – so do this centrally so you can manage/understand it – don’t bing interceptors directly to components

Stereotypes

1. Reuse patters – not just Interceptor bindings!
2. Capture roles of components using stereotypes
3. A Stereotype packages up:
   1. a default scope
   2. a set of interceptor bindings
   3. the ability to specify that beans have names by defaults
   4. (more)
4. Uses @Stereotype annotation

Events

1. Can be injected – as in void Login(@Observes LoggedIn loggedin)…

Proposed final draft of JSR-299: http://www.jcp.org/en/jsr/detail?id=299

Seam Framework reference implementation: http://seamframework.org/WebBeans

JBoss doc: http://docs.jboss.org/webbeans/reference/current/en-US/html/

Blog: http://in.relation.to/Bloggers/Everyone/Tag/Web+Beans

—-

Value of more Type Safety in a world where Dynamic Languages are gaining traction

Debugging might be more challenging

Performance issues?

Complexity / tooling issues?

How is this different / better / worse than Spring?

Talk about an identity crisis. Maybe we should just call it, more simply, the PDC Netabletible Convertilizer? 

If yours has trouble with “phantom mouse clicks” – where you are typing away, and it seems that somehow the left mouse button was just clicked, but you know you didn’t click it – that can be fixed with the simple act of installing the Synaptics driver for this machine that, weirdly, will not ever show up in Windows Update.  But since this is a pretty useful update, consider doing it the old fashioned way. 

Or at least it worked for me. Though belated, this blog post may save someone the challenge of finding the cure, which I thought more difficult than it oughta be. 

The PDC Netabletible Convertilizer may not be the only one out there with this problem.

As an aside, my PDC Netabletible Convertilizer also became more usable once I recalibrated the touch screen. (How does one do that? Type into the search field in the Start menu “calibrate touch” for a link to the right part of Control Panel to make this happen…)

Keynote speaker: Brian Lambert of Microsoft

Meeting was held Thursday October 22, 2009 at Microsoft NERD in Cambridge, MA

Mike Werner (Microsoft evangelist for Azure in the Northeast) introduced the user group at this innaugural meeting, plugged the upcoming Microsoft PDC, then introduced Bill Wilder, the guy who started the Boston Azure User Group.

Bill Wilder provided an overview of the group (powerpoint slides):

• All meetings will have Windows Azure focus
• Any technology or business concept – cloud models, Microsoft dev technologies, tools, and so forth - is fair game, but must be presented with appropriate Azure slant: they need to be related back to Azure or else they are not appropriate for Boston Azure User Group meetings

Brian Lambert spoke on how to build applications for Windows Azure.

Bill’s raw notes from Brian’s talk:

• Can call unmanaged DLLs through Full Trust
• “Fabric Controller worries about the “shape” of your app”

Worker Roles

• Background processing – utility computing
• May communicate with outside services
• Not externally visible to client
• Queues ~ how we communicate to a Worker Role ~ since both Worker Roles and Web Roles can talk to storage (like Queues), this is a good medium

There are public and private containers in blog storage. Public is the only accessible to clients (w/o keys that is).

Partitioned for scale

Blobs = ? “cloud files”

• Up to 50 GB / blob + 8k of metadata

Azure Dev Workflow:

• Add some Web Role(s)
• Add 0+ Worker roles
• Add Service  Configuration
• Add Service Package
• Upload to Windows Azure Management Portal
• Deploy to Windows Azure Fabric Controller
• Provision / Run the roles and storage needs; monitors the health

Sticky Storage ?

….

Azure Tools + Azure SDK

….

For “dev” + “test” + “etc.” – may want to use REAL azure accounts – not just the “other account” you have in your main production account

….

Need to handle the “at least one worker role will work on it” contract – your application needs to be designed for this…

“poison message” – due to bug or oversight or bad data, a message from the queue will NEVER be successfully handled. App needs to handle this currently.

Queue timeouts can have different values – could be, say, different for different message types.

….

Worker Role => a class that inherits from WorkerRoleMain (what was this class name??)

Fabric occassionally calls GetHealthStatus() which returns a RoleStatus. If you tell the Fabric you are Unhealthy, the Fabric may slay you? Maybe your NIC card is flakey, so your performance to external web services is too slow?

….

Public container for blob – for actual image (full size) linked to from the thumb.

“Fiddler is your friend when you’re working … watch your requests.”

Dev Fabric + Cloud Storage is an excellent mode to run in for effective debugging – can watch the message traffic with Fiddler.

“There is no debugging in the cloud. There’s logging.”

RoleManager can also write to “local storage” [[more interesting access / features coming soon!]] – then can go to Portal and use “configuration” button to update your config file to “copy logs” (did they move it?)

===========

can even bring web site up with http://localhost:8020 

WorkerRole is very simple to just run it in a process

Use Test Running to fire up a WorkerRole

• Tight dev cycle
• Can also now run a performance profile

Tricks: log in “real fabric”, write to console in “dev fabric”

Per Alex Barnett of Intuit – only 12% of 4m Small Businesses not willing to use hosted data with SaaS.

Webware 100 finalists… best software solutions.

How do cloud-based apps Integrate?

• Finance system know the project in Basecamp is done
• Calendar know about CRM

Simplify by mapping services to a COMMON DATA MODEL (this is a REALLY big deal, IMHO).

QuickBooks have 4 m customers who have effectively agreed on a database schema… exposed an API to this data store. Nice…

The “Small Business Data Cloud” – available today from Intuit – as the Intuit Partner Platform.

native apps

• Flex applications hold the logic
• Server-side Java coming in development

federated apps

• identity
• data
• billing
• most of the action is over here (rather than native apps)

They expect to ship 1.7 m units of QB 10 over next 6-12 months – this will really launch the platform.

4 m users spending 4 b hours per year of screen time

25 million users within these Small Businesses

FAST TIME TO VALUE through SaaS solutions.

Intuit keeps 20% of the rate, rest goes to developers

Can have trial-periods, entitlements (monthly-charged extra features), more options coming next year.

Developers support the apps – Intuit supports everything else.

http://code.intuit.com – some Open Source in here

• some code uses SAML
• support Java, Python, Ruby, PHP, and .NET versions of code, such as SAML gateway

http://developer.intuit.com

Intuit – SMB, 4m customers

Salesforce – Enterprises, 25k customers

Is it a per-user, or per-customer license? Intuit end-users don’t need a license.

Don’t need to license QuickBooks to use the overall platform – but there may be some synergies.

Intuit certifies apps for use in their marketplace. Federated apps go through a third-party security assessment – on Intuit’s dime today, though that may change in the future.

Top 10 Presentation Tips

The top 10 presentation tips I took away from Presentation Camp Boston

From Kenny Raskin‘s keynote:

1. “Have a Passionate Purpose”

When you are speaking, it is not only about the content. If you mean what you say – you really believe in it – (which I believe Dale Carnegie refers to as conviction) - then you are more likely to be successful at conveying your message and persuading your audience.

Kenny shared a quote which was something like the following:

Who you are being when you are saying what you are saying says more about what you are saying that what you are saying.

Not just sell it – it was believe it + sell it both at once. This tip resonates with me and is consistent with a lesson from studying and performing improv; one of my instructors, Erik Volkert, really got across the difference between acting it out and really committing – and the impact that has on stage.

2. “The presentation starts before you are even in the room”

• Find out who the audience is and what you want to say to them. What do you want them to FEEL. (“Know your passionate purpose!”)
• As you are preparing to enter as a speaker, take a breath. Focus. Clear your mind.
• As you enter, look your audience in the eyes. Before you say a word. Greet the audience. Pause… and let them respond.

3. Genuine eye contact != scanning

Eye contact is important. Don’t scan the audience and think that’s eye contact – you need to pause and connect with individuals one at a time – this may be for the duration of a thought or statement – or just until you feel you’ve connected. Some of your eye contact moments will be during pauses and are your opportunity to re-energize by breathing.

From Diane Darling‘s Talk about Networking:

Not about presenting to large groups, but focused on presenting to very small groups of one or a few other folks in a social / networking situation.

4. Business Cards from A-Z

Some wisdom on business cards:

• You need business cards. And they don’t need to be plain and boring… Diane’s cards have a list of tips on one side – useful and “sticky“.
• She advises to keep your business cards in one pocket, and the ones you collect in another pocket – just have a simple system to avoid fumbling.
• Write on the business cards – you may forget later otherwise that this card is from someone you offered to send a link to an interesting paper, or perhaps they might be a future business partner. Handy, easy hack.
• If you do give a talk to a group, be sure to have a stack of cards handy to share at the end.

5. “Own the room”

I am a highly functional introvert
~ Diane Darling, author of The Networking Survival Guide: Get the Success You Want By Tapping Into the People You Know

I love that quote! As a fellow introvert, that’s how I want to be. Diane builds a case for being highly functioning with a plethora of straight-forward tips on how to handle lots of business social situations. A couple of examples:

• Prepare several generic ice breaker questions you can use when you meet someone new. A good format for such questions is “Tell me about ______.” You fill in the blank with “your job” or “how you got into this line of work” or “how you ended up at this conference” etc.
• Wear your name tag close to your RIGHT shoulder (since that’s where the eye most naturally is directed during a hand-shake.
• Don’t start with your name! Introduce yourself by saying something about yourself, and end with your name – it is easier to remember there.
• Saturday Night “Live” != Saturday Night “Unrehearsed” — you will be more successful if you practice some of what you will say — like what is your brief introduction of yourself (your elevator pitch), ending with your name, of course!

6. Connect with the Gatekeepers

If you want to get access to key people who may be hard to get to, consider connecting with those people who control access – such as a personal assistant to the CEO.

From Edwin Guarin‘s talk, The Killer Presentation:

Edwin is an Academic Evangelist for Microsoft. His talk was called The Killer Presentation – Gettting to Point B.

7. Distributing Your PowerPoint Deck

Suppose you’ve given a talk, but now your audience wants a copy. Here’s how to do it, plus a couple of important benefits:

• File > Save As… and choose either PDF or PowerPoint Show.
• If you have Hidden slides – perhaps because you want “single source” for a slide deck that you use in multiple circumstances, but don’t want to maintain the bulk of the slides more than once – this will drop all those marked as hidden at the time you Save As.
• If you have Notes, they are not included either. Sometimes your Notes are just speaking points, but perhaps they are not something you want everyone to see.

8. Spruce Up Your Talk with Images

You are preparing a deck, and you want to be memorable. You want that “just right” image or text effect.

• Edwin recommends the use of royaty-free photos from http://sxc.hu.  You need to create an account to access them, then are free to use them in your PowerPoint slides.
• Note that you are not licensed to subsequently redistribute these images if they are embedded in your PowerPoint deck. I registered an account on sxc.hu web site asking for clarification – and there was a tad bit of ambiguity around the licensing (the license text seem to both suggest it was fine and also say it wasn’t) – so I sent in a specific question on this scenario. The response from sxc.hu support was that the PowerPoint cannot be posted for redistribution. I am not a lawyer. And I do not even play a lawyer on TV.
• [In my talk, I advocate searching through Google Images advanced search and filtering by Usage Rights to only include images labeled for reuse (usually through Creative Commons).]
• To embed an image that is too bright, overlay it with a rectangle – and set the transparency to accordinly to fade it a bit so that text can be seen on top of it.
• Use SmartArt to snazz up your text… transform a bullet list into a ring, or horizontal property or other eye-candy fanciness.

From Brainshark demo:

9. Sharing Your Presentation After the Fact

Brainshark has a cool way for you to post your slide-deck to their free http://my.brainshare.com hosted service: you can upload both the deck *and* an audio track.

This is way better than just distributing the PowerPoint deck, which may not be of any use for people who didn’t attend the talk. Of course, you do need to create (or record) an audio track.

I am not sure how the slides and the audio are sync’d – like when in the audio track should slide 7 pop in – but my guess is that you are expected to record your voice while delivering the talk – and some agent on your desktop keeps an eye on when you transition between slides. If so, I wonder if it can also capture screen shots of non-PowerPoint activities – like if I pop up a web browers, or use Visual Studio.

From Bill Wilder’s talk on Better Tech Talks:

Yes, I am recommending a tip from my own talk.

10. “It is a Talk, not a Read”

Don’t even thing of reading your slides to your audience.

• If you cram all the text for your talk into your deck , you will be guilty of promulgating support for Death By PowerPoint.
• Your audience can read faster than you can talk anyway – they will be done before you. And they won’t be listening to you while they read; they can’t do both at once.
• Your audience will resent being read to. As Jack Welch is reputed to have said to a presenter reading him the slides: if everything is on the slides, then we don’t need you.
• There are better tools for a stand-alone document – like blog posts, or word-processors. PowerPoint is a poor substitute when writing a document that is being prepared for general reading.
• If you do need to capture more info than belongs in the slides, consider putting it into the Notes section, and then using dual-monitor capabilities to have your laptop display different content than the projector, and configure PowerPoint to know about this via:  Slide Show > Set Up Show > Multiple Monitors.

I’ve been thinking a lot about how to give code-centric talks to software engineers, plus the general problem of clear communication through presentations. Those in my session will recognize that my slides (Better Tech Talks – 24-Oct-2009) do not stand alone well! – but should serve as a good reminder for those who participated in the session.

Feel free to follow-up with me to continue the discussion!

The Boston Azure User Group is now on the map – literally!

Check out Jim O’Neil’s user group map. Zoom in on Cambridge, MA and you will see us waving from the NERD center. Thanks Jim!

While not as awesomely interactive and visual as a Bing map, we do appreciate other people plugging the user group:

• Boston User Groups
• The Boston-area User Group Calendar
• Our friends at New Hampshire .NET
• Community Megaphone
• Chris Bowen’s Blog : Announcing the Boston Azure User Group (might be the earliest mention ~ thanks Chris!)
• From ASP Scribe: User Group Happenings East and West and in Between
• And a mention or two from Roger Jenning’s blog

Speaking of Roger Jennings… at the first Boston Azure meeting this Thursday night (Thu 22-Oct-2009 @ 6:30), we’ll give away copy of his hot-off-the-presses book Cloud Computing with the Windows Azure Platform!

I found Roger Jennings’ book chock full of useful information – from context to detail to practical code samples. I stopped at Barnes & Noble after a user group meeting in Burlington and picked up my own personal copy – why no Kindle version!? – and quickly plowed through it. Now I want to go back and play around with the abundant code samples. And in case you are wondering – no, this isn’t the copy we’ll be giving away…we have a new one.

Gary Chin spoke at Boston Code Camp 12 (on Oct 17, 2009) – his talk was all about using SketchFlow for Silverlight.

I heard from various folks that the talk went really well. Unfortunately, I wasn’t able to make it since I was presenting at the same time (actually presenting on presenting.)

Gary was kind enough to send me his slides which I have attached to this post: SketchFlow-GaryChin-Oct2009

See you at the next Code Camp! (Though will probably also see many of you before then – this Thursday night at the first meeting of the Boston Azure User Group!)

I’ve been a member of Toastmasters for the past couple of years. While Toastmasters has many clubs around the world, I belong to Boston West Toastmasters which meets in Needham, MA on the second and fourth Monday evenings.

While at Boston West Toastmasters, I’ve made friends with some really cool people (several of whom provided ideas for my Code Camp talk on giving technical presentations) and have been working to improve my speaking skills through application of Deliberate Practice (where the feedback, ideas, analysis, expert critique and encouragement all come from fellow Toastmaster members).

Now my club is reaching out to the community to help the unemployed, holding an open house encourage the general community to get a glimpse of what Toastmasters is all about… and not to mention taking part in a really fun social event.

Some Boston West Toastmaster members from 28-Sept-2009 meeting

Scholarship offer for Unemployed

Full details are in the attached Boston West Toastmasters Scholarship Press Release from 5-Oct-2009, but here’s the teaser:

Boston West Toastmasters is offering five scholarships to the unemployed who want to improve their speaking and leadership skills.  These scholarships, underwritten by Robin Samora, owner and president of Partner Promotions, cover the annual membership dues for the winners.

Bring a Friend, Meet a Friend – Open House at Nov 9 Meeting

Our meeting on 9-Nov-2009 will have a social hour before this meeting which is an Open House for Boston West Toastmaster. Anyone is welcome to attend this meeting – at no cost, no obligation. (The “no cost, no obligation” is actually true generally – feel free to check us out at any meeting – you won’t get a hard sell – just the information you might be interested in. For most people, Toastmasters sells itself.)

Here are the details:

Bring a friend, meet a friend at the Boston West Toastmasters Open House on Monday, November 9, 2009:

Mark your calendar for this important OPEN HOUSE.  It is a great opportunity to share your Toastmaster experience with friends, relatives and co-workers.  Invite them to attend the meeting.  We will have an informal start to greet guests and answer questions @ 6:30 p.m.  Robin Samora is our Toastmaster for this and we will have special snacks that evening during our Opening reception 6:30 – 7 for new members (and our team if possible).  Send an email to people inviting them to attend our OPEN HOUSE.  It will be a memorable event!!!

You don’t need to let me know – thought would appreciate a heads-up so I can look for you – but just showing up is the key.

Soiree in Back Bay – Social Night – Co-Sponsored by Boston West Toastmasters

This looks like a really fun event: Soiree in Back Bay on 22-Oct-2009, co-sponsored by Boston West Toastmasters.

[Unfortunately, you won't see me there - I will be at the kick-off meeting for my Boston Azure User Group that same night.]

How to Give Your First Code Camp Talk – 17-Oct-2009

If you attended my talk, you learned than I don’t advocate ensuring the slide deck makes sense stand-alone (since it is a framework for a talk, with purpose different than that of an article or blog post). You’ve been warned.

We have a couple of behind-the-scenes planning meetings this week then will finalize the information on the bostonazure.org web site.

Have you joined the Boston Azure User Group mailing list?

I will be giving an updated version of this talk at the upcoming Code Camp 12 in Waltham (Boston area) on Sat Oct 17, 2009.

Motivation – I am Cheap!

I have a hosting account at DiscountASP.NET that I have used as a playground for anything I want to host on the web. My personal Coding Out Loud site is hosted there (with a few directories that are not linked, for example). Since starting the Boston Azure User Group, I need a place to host a page. While I would eventually like to host the user group site on Azure itself, for now I have produced a simple ASP.NET MVC site. To avoid paying for two hosting accounts, I am reusing my existing account – sharing the hosting across bostonazureusergroup.org and codingoutloud.com – but still maintaining their distinct identities.

We can consider the Boston Azure User Group the main site, and Coding Out Loud the secondary site.

Requirements

The approach I take makes sense to me since I want a solution that is:

• Very simple
• Inexpensive
• Easy to manage once implemented
• Treats bostonazureusergroup.org as the main site, but “tolerates” codingoutloud.com being around (in other words, maintainability/risk of errors for codingoutloud.com is less important)

Solution

In order to host two sites with a single hosting account, you have a few steps:

1. Add a Domain Pointer with your ISP. If, like me, your site is hosted on a shared IP address, this step is necessary so that the site’s IIS web server knows which top-level directory your domain is associated with. In my case, this tells both codingoutloud.com and bostonazureusergroup.org to go to the same site.
2. Configure your DNS. This is easier than it sounds. Your ISP will tell which DNS servers your should point to. You could also deal with Godaddy’s Domain Forwarding and cloaking, but for a one-time cost of $15 with my ISP (DiscountASP.NET) I just added the pointer – a cleaner solution, and possible more search-engine-friendly.
3. Note that the following changes to the code are only necessary if you want different results dependent on which domain is used to access the site – in other words, I don’t want my bostonazureusergroup.org visitors to be stumbling across any codingoutloud.com artifacts, and vice versa. The following screen shot includes the hack simple code modifications – they are circled – a private method with a little dirty work, invoke the method in the right place, and display a specific View. Note that the view is specified in a different file – and under a folder that is specific to your secondary site – CodingOutLoud in my case.

To create the …/Views/CodingOutLoud/Index.aspx view shown in the right-hand pane in the screen shown above, you would do the following:

1. Right-Click on Views folder and choose Add > New Folder from the pop-up. I called mine “CodingOutLoud” and it is shown above.
2. Right-Click on the newly created Views/CodingOutLoud folder, this time choose Add > View… from the pop-up, as shown below. I called my View “Index” (and since it lives under CodingOutLoud folder it does not clash with other Views with that name, given the default routing rules).

Name your view – and I also chose not to use the master page, so I unchecked it:

Once created, …/Views/CodingOutLoud/Index.aspx can contain any code you like – even plain old HTML.

This is all it took to get this simple approach to work. Now when users visit via “codingoutloud.com” they are diverted to …/Views/CodingOutLoud/Index.aspx, and otherwise the usual machinery of ASP.NET MVC takes over.

Other Potential Approaches

I considered, but did not adopt, some other approaches – mostly since I wanted to do something very simple. Here are some of the other approaches:

• ASP.NET MVC Subdomain Routing
• ASP.NET MVC Domain Routing
• Subdomains for a single application with ASP.NET MVC
• ASP.NET MVC root url’s with generic routing

Executive Summary – Key Take-Aways & Highlights

Notes from Javed Ikbal’s talk (http://10domains.blogspot.com) are in regular type. My editorial comments and thoughts are in italics or bold italics – so don’t blame these on Javed.

• Key take-away – going to the Cloud is waaaay more about Business Tradeoffs than it is about Technology.
• “There are 2 kinds of companies – those which have had a [data security]breach, and those which are going to have a [data security] breach” -Javed
• Centralization of data makes insider threat a bigger risk -Javed
• “On premise does not mean people are doing the right thing” –Javed – right on! I bet the majority of the fortune five-million (as 37 Signals refers to the medium and small business market) have insufficient IT – they just don’t know it. Any stats?
• Someone from the audience stated there are more breaches in on-premise data centers than in cloud. Therefore cloud is safer. I don’t buy the logic. There could so many more publicized breaches in on-premise systems simply because there are so many more on premise data centers today. So this is easy to misinterpret. We can’t tell either way from the data. My personal prediction: today if there is a data breach for data stored in the cloud, people will not be able to believe you were reckless enough to store it in the cloud; 5 years from now, if there is a data breach for data stored on premise, people will not be able to believe you were reckless enough to store it locally instead of in the cloud which everyone will then believe is the safest place.
• Someone from audience commented that business value of losing data will be balanced against business cost of it being exposed. This comment did not account for the PROBABILITY of there being a breach – how do you calculate this risk? I bet it is easier to calculate this risk on the cloud than on premise (though *I* don’t know how to do this)
• Comment from Stefan: We can’t expect all cloud services to be up all the time (we were chatting about Google and Amazon downtime, which has been well documented). I completely agree – And many businesses don’t have the data to fairly/accurately compare their own uptimes with those of the cloud vendors – and, further, if the cloud vendors did have 100% up-time, that may destroy the economies we are seeing on the cloud today (who cares if it is 100% reliable if it is 0% affordable – that’s too expensive to be interesting)
• Off-premise security != in cloud – different security issues for different data – Javed In other words, treat SSN and Credit Card data differently than which books I bought last year. But I can think of LOTS of data that is seemingly innocuous, but that SOME PEOPLE will balk at having it classified  as “non-sensitive” – might be my bookmarks, movie rentals, books purchased, travel plans/history, many more… not just those that support identity theft and/or direct monetary loss (bank account hacks). I think it would be a fine idea for data hosts to publicly declare their data classification scheme – shouldn’t we all have a right to know?
  
• I think IT generally – and The Cloud specifically – could benefit from the kind of thinking that went into GoodGuide.com.

Raw Notes Follow

The rest of these notes are a bit rough – and may or may not make sense – but here they are anyway…

Intros

• Pizza & drinks, some social (sat next to Stefan Schueller from TechDroid Sytems and enjoyed chatting with him)
• Went around the room introducing ourselves
• People who were hiring / looking for work spoke up
• Around 30 people in attendance
• Meeting host: Aprigo – 460 Totten Pond rd, suite 660 – Waltham, MA  02451 – USA
• Feisty audience! Lots of participation. This added to the meeting impact.

Twisted Storage talk

From Meetup description: Charles Wegrzyn – CTO at TwistedStorage Inc. (Check actually built an Open source cloud storage system back in ’05)

TwistedStorage is open source software that converts multiple storage
repositories, legacy or green-field, into a single petabyte-scale cloud
for unstructured data, digital media storage, and archiving. The Twisted
Storage Enterprise Storage Cloud provides federated search, electronic
data discovery with lock-down, and policy-driven file management
including indexing, retention, security, encryption, format conversion,
information lifecycle management, and automatic business continuity.

History of Building Storage Management software

• Open Source
• Been downloaded 75k times
• Re-wrote – now version 4 – in Python

Common anti-pattern observed in real world:

• Users storing “stuff” in Exchange since that was a convenient place to store it
• Results in a LOT of email storage (and add’l capacity is easy to keep adding on)
• Can’t find your data (too much to logically manage)
• Backups inadequate
• Complexity, complexity, complexity

The Twisted Storage Way

• Federated storage silos w/ adaptors/agents
• Provide enterprise capabilities spanning sites (access control, audits, search/indexing – including support for metadata, simplified administration and recovery)
• Petabyte-scale
• ILM = Information Lifecycle Management
• Open Source
• Work-flow (Python scripts, XML coming)
• Policy-driven (“delete this after 2 years”, “encrypt me”) (Python scripts)

Twisted Storage Design Goals

• Always available content (via replication)
• No back-up or recovery needed (due to replication)
• Linear scalability (scales out)
• Able to trade off durability with performance
• Supports old hardware
• Minimal admin overhead
• Support external storage systems and linkage
• Portable – will run on Linux, Windows, (iPhone?) – due to portable Python implementation
• Pricing: Enterprise Edition: $500 / TB up to 2 PB (annual), minimum $10k for first 20 TB (see web site for full story)
• versus competition like Centera which charge $15k/Silo + Enterprise Edition
• http://www.twistedstorage.com, cwegrzyn@twistedstorage.com

Info Security & Cloud Computing Talk

From Meetup description:  Javed Ikbal (principal and co-founder of zSquad LLC)- will talk about:   “Marketing, Uncertainty and Doubt: Information Security and Cloud Computing”

• What is the minimum security due diligence that a company needs to do before putting it’s data in the cloud?
• Since 2007, Amazon has been telling us they are “.. working with a public accounting firm to … attain certifications such as SAS70 Type II”  but these have not happened in 2+ years.
• On one side of the cloud security issue we have the marketing people, whohype up the existing security and gloss over the non-existing. On the other side we have security services vendors, who hawk their wares by hyping up the lack of security. The truth is, there is a class of data for every cloud out there, and there is also someone who will suffer a data breach because they did not secure it properly.
• We will look at Amazon’s EC2, risk tolerance, and how to secure the data in the cloud.
• Javed is a principal and co-founder of zSquad LLC, a Boston-based information security consulting practice.

Javed is a Security Consultant

Also co-founded http://www.layoffsupportnetwork.com

Formerly worked in Fidelity (in security area)

Cloud Definition

• Elastic – provision up/down on demand (technical)
• Avail from anywhere (technical)
• Pay-as-you-go (business model)

Cloud Challenges

• Data stored in China – gov’t could get at it
• We never have direct access
• May be locked in? (for practical reasons)
• March 7, 2009 from WSJ – Google disclosed that it exposed a “small number” of Google docs – users not supposed to be authorized were able to view them. Google estimated < 0.05% of all stored Google docs were impacted – BUT! – this is a LOT of documents. http://blogs.wsj.com/digits/2009/03/08/1214/
• Sept 18, 2009 from NYT – a recent bug in Google Apps allowed students at several colleges to read each other’s emails – this impacted only a “small handful” of colleges (like Brown University, for 3 days)http://www.nytimes.com/external/readwriteweb/2009/09/18/18/18readwriteweb-whoops-students-going-google-get-to-read-ea-12995.html
• Google’s official policy for paid customers states “at your sole risk” and no guarantee it will be uninterrupted, timely, secure, or free from errors
• Amazon states it is not responsible for “deletioreach” – Javedn, destruction, loss” etc.
• Google will not allow customers to audit Google’s cloud storage claims
• Amazon says PCI level 2 compliance is possible with AWS, level 1 not possible
• SAS 70 Type II reports not meaningful unless you can see which controls were evaluated
• “on premise does not mean people are doing the right thing” –Javed
• Perception of more breaches in on-premise systems – but there are so many more of them, it is easy to misinterpret
• Business value of losing data will be balanced against business cost of it being exposed – but this does not account for the PROBABILITY of there being a breach – how do you calculate this risk? I bet it is easier to calculate this risk on the cloud than on premise (though *I* don’t know how to do this)
• We can’t expect all cloud services to be up all the time – right, and many businesses don’t have the data to fairly/accurately compare their own uptimes with those of the cloud vendors – and, further, if the cloud vendors did have 100% up-time, that may destroy the economies we are seeing on the cloud today (it may be 100% reliable, but too expensive to be interesting)
• Off-premise security != in cloud – different security issues for different data
• “There are 2 kinds of companies – those which have had a [data security]breach, and those which are going to have a [data security] breach” -Javed
• Centralization of data makes insider threat a bigger risk
• Customers should perform on-site inspections of cloud provider facilities (but rare?)
• Ask SaaS vendor to see 3rd party audit reports – SalesForce has one, Amazon does not (Google neither? What about Microsoft – not yet?)
• Providers need to be clear about what you will NOT support – e.g., Amazon took 2 years to provide an answer… Amazon/AWS disclaimers are excellent models
• Providers need to understand they may be subject to legal/regulatory discovery due to something a customer did
• Unisys has ISO 27001-certified data centers (high cost, effort)

Creating Secure Software

• Devs care about deadlines and meeting the requirements
• If security is not in the requirements, it will not get done
• if devs don’t know how to code securely, it will not get done right (if at all)
• Train your devs and archs: one day will help with 90% of issues!
• Build security into your software dev life-cycle
• Let security experts, not necessarily developers, write the security requirements
• Secure Code Review can be expensive –  bake in an application security audit into your schedule, to be done before going live
• (high customer extensibility + low provider security responsibility) IaaS – PaaS – SaaS (low customer extensibility + high provider security responsibility)

I am considering giving a talk at the upcoming Boston (Waltham) Code Camp 12 titled “So, You Want to Give Your First Code Camp Talk” which will address that. Would that be of interest to you? If so, I’d like to hear from you in advance. Please comment either via comments to this blog post, or email me directly (to codingoutloud at gmail dot com).

What is blocking you from presenting?

From those of you who have successfully presented, do you have pointers for the aspiring speakers among us?

Inquiring minds want to know!

This post describes some key aspects of your development environment that need to be in place in order to to write and test code for Windows Azure.

Windows XP does not natively support Azure Development

For all the developers running Windows XP face an obstacle to writing code for Windows Azure:  developing for Azure requires Windows 7, Windows Vista, or Windows Server 2008. The fundamental dependency is that the Azure Fabric Controller (which runs on your desktop for development purposes, simulating cloud behavior) relies on IIS 7, which (you guessed it!) ships with Vista, Windows 7, and Windows Server 2008.

One option is to upgrade your operating system. If you are not quite ready to do that, you have another option – use Virtual PC to run Windows 7 from Windows XP. (This technique also works to run a virtualized Windows 7 image from Vista – or even Win 7 itself – since maybe you don’t want to foul your machine with beta software, like a sandbox for Visual Studio 2010 while it is still in beta (beta 1 as of this writing)).

Essential Software to Develop for Azure

The four essentials are:

• Have IIS 7.x on one of Windows Vista (Business or Ultimate, I believe) –or– Windows Server 2008 –or– Windows 7
• Install Visual Studio 2010 – currently in beta (beta 1 as of this writing) – or Visual Studio 2008
• Install Azure plug-in – currently in beta – to Visual Studio 2010 or Visual Studio 2008
• Create an account on Azure hosting in order to deploy to/test on the cloud

I wrote a separate, detailed post on creating a virtual machine image for Windows 7 using Virtual PC 2007.

Executive Summary

This post describes how to install Microsoft Virtual PC 2007, followed by a detailed walk-through of how to create a virtual machine image of a fresh Windows 7 installation using Virtual PC 2007.

In this post I concentrate on creating a Virtual PC image for Windows 7, but the steps for the other operating systems are similar.

Note this post deals with concerns for Developers. This post does not cover use of (related) virtualization techniques which are very popular today on the server-side.

Why Use Virtual Machines?

There are several reasons to use a Virtual PC-managed virtual machine for development:

You don’t want to install Pre-Release software (like a CTP – Community Technology Preview, which means “very rough”) or beta software directly on your development machine. A virtual machine environment makes it easy to manage these without risking your real machine.

You want to experiment. You may want to try out some testing with 4 GB or RAM, then maybe with 1/2 GB or RAM – so you know what to expect. Or you to keep testing something that changes your machine – and need to “start from scratch” frequently.

You want to run multiple operating systems. You may want to run Windows 7 to make sure your apps run fine on it – but you also don’t want to give up XP quite yet. You can run Windows 7 within a Windows XP host.

You want to set up a machine configuration and reuse it. You go through a lot of trouble to get your configuration “just so” and now want to share that with colleagues – or with yourself (on your home machine).

Are there other Virtualization options?

If you are a developer running XP -or- are running Win 7 on hardware that does not support hardware virtualization, Virtual PC 2007 is very likely what you want.

If you are running Windows 7, you can look into Virtual PC (sometimes seen as Virtual PC 7) (which includes XP Mode). Unlike Virtual PC 2007 which will work regardless of whether you have hardware virtualization, Virtual PC will work ONLY WHEN your computer supports hardware virtualization. Does my PC support hardware virtualization (or XP Mode)?

Unlike Virtual PC 2007, Virtual PC is for Windows 7 will not work on XP (but will work on the Windows 7 beta, sometimes known as Vista .

Only one of Virtual PC -or- Virtual PC 2007 can be installed concurrently on any given machine.

From Microsoft, other vendors, and open source, there are other sources of virtualization technology, and some might even be compatible with Virtual PC or VHD. [Did you know VHD format is an open standard?]. Though, consider that Virtual PC 2007 does not cost anything beyond the Windows license you (presumably) already have. Microsoft has many virtualization solutions, some with different purposes, such as App-V which is more for enterprise roll-out of apps (get it? App-V) to minimize incompatibilities due to other apps or environmental changes.

For developers, let’s assume (for reasons stated above in prior section) that you want a parallel universe to run other software within – safely – like an early beta… Virtual Machine images make these scenarios possible and easy! Let’s get down to business and walk through how to install & configure these virtual images.

Ready to Get Started?

Enable Hardware Virtualization in your Computer

The newer your PC, the more likely it is that it supports hardware acceleration for Virtualization. If you have this, you want to enable it for better performance. You may need to enable it in your BIOS. Unfortunately, the specific instructions will vary by computer manufacturer, so you’ll need to search the web for steps to enable Hardware Assisted Virtualization.

Installing Virtual PC 2007

Visit the download page for Microsoft Virtual PC 2007 download page for Microsoft Virtual PC 2007 sp1 and then select the appropriate version for your system (that is, 32- or 64-bit version).

Once downloaded, install it.

If you already have an earlier version of Virtual PC installed, you will likely see this self-explanatory message to uninstall the older version. If you are upgrading to Virtual PC 2007 sp1 from Virtual PC 2007, the installer will handle it for you.

Go to your trusty Add or Remove Programs applet and remove any remnants of old Virtual PC installs and proceed.

You can run Virtual PC 2007 and look in Help > About to see which version you are running. Version “Microsoft Virtual PC 6.0.192.0″ is Virtual PC 2007 sp1, which is the one expected by the rest of this post.

Installing Microsoft Virtual PC 2007

Run Virtual PC 2007 installer …

.. fill in your own info here, of course.

I kept the default installation location and let it rip. It completed around 2 minutes later.

NOW GET DOWN TO BUSINESS!

Create fresh Windows 7 virtual machine environment using Microsoft Virtual PC 2007

Download Your Windows 7 ISO Image

In order to install Windows 7, you need a copy of Windows 7. This could be a retail version of Windows 7 (from a DVD), but let’s make the assumption here that since you are a developer, you will be using a download image from MSDN that comes down as an ISO file, such as en_windows_7_professional_x86_dvd_x15-65804.iso. Note that you will need to install a 32-bit operating system to run under Virtual PC 2007. Log in to your MSDN account and select an appropriate version of Windows 7 to download, download it, and also be sure to copy the Activation Key (if applicable). 

Run Upgrade Advisor

You may wish to run the Windows 7 Upgrade Advisor on your machine to make sure Windows 7 will be happy (as of this writing, the upgrade advisor tool is in beta). Assuming that goes well..

Run Virtual PC 2007

Run Microsoft Virtual PC 2007. From the opening screen, click the “New…” button:

The wizard will start. Click the “Next >” button:

Select “Create a virtual machine” and click “Next >” button…

Give your new Virtual Machine an appropriate name:

I also changed my location:

Select “Other” as Operating system and click “Next >” …

The recommended RAM will likely not be sufficient, so click “Adjusting the RAM” option:

How much memory is right? Considering Windows 7 system requirements (which call for at least 1 GB in the 32-bit version) and Visual Studio 2010 (beta 1) system requirements (which also calls for 1 GB (though not an additional 1 GB), you will hopefully be able to allocate at least 1 GB. I have 3 GB on my host machine, so I allocated 1.5 GB (1024 MB + 512 MB = 1536 MB). These values can also be tweaked later using Virtual PC.

I chose to create a new virtual disk:

For disk space, you have another set of decisions – Windows 7 wants 15 GB, Visual Studio 2010 wants 3 GB, so I rounded up to a nice even 18.5 GB (since I don’t have an abundance of space here):

Click “Next >” and you are almost done with this step.

Click “Finish” and now we are in business within Virtual PC:

Click on “Azure Dev” (or whatever you called your image) and click “Start” button to proceed:

If you have trouble starting your virtual machine due to not enough memory available, as in the following message, you either need to adjust its memory requirements of free up some memory.

You might consider throttling back your Anti-Virus software which could be a big consumer of memory (I disabled the on-the-fly file-system protection). Also, of course, close all unnecessary processes. The long-term solution is to buy a 64-bit machine with oodles of memory and be happy with that.

Once you have enough memory available, you will see the virtual machine complain very soon as it craps out after spinning up and thinking for a couple of minutes:

This is expected. You still need to install Windows 7 to move this along. To do this, make sure you have a ready-to-go image of Windows 7 as an ISO file (as you might download from MSDN) or physical media. You have two menu options, one for each of these cases:

In my case, I selected “Capture ISO Image…” and installed from there. Note that you navigate your host file-system for the ISO image to capture – not the file-system on your virtual machine, since that does not yet exist.

Click “Open” and notice how the CD menu on the virtual machine has been updated:

Now you can reboot your virtual machine to let the installation on the captured ISO image run (as if it was auto-starting to install on a physical machine). To reboot, choose Reset from the Action menu:

You will be warned:

But since you don’t have any unsaved changes to worry about, select the Reset button and proceed with the reset. (You have saved some information, you may be thinking, like memory and hard disk configuration; but that is all metadata about your image – not changes within the virtual machine itself – so there is no problem here.)

The reset begins…

Here is a warning which we will come back to. Dismiss this for now:

The system will chug and chug for a looong time – mine took around two hours to run (the good news is I let this run while I was watching the New England Patriots game this Sunday; the bad news is the Patriots fell to the Jets):

You will then proceed to install Windows 7 … mostly you will be just moving along without much fanfare, though you will need to name your “computer”, come up with a username (and optionally a password), and will need your Activation Key for Windows 7. Here is a good guide for installing Windows 7 on Virtual PC 2007. (And another.)

Don’t that forget the magic key/mouse combo to un-capture your mouse from the Virtual Machine is Right-Alt while dragging the mouse!!

After you get Windows 7 all configured, you probably still want to come back and install some updates:

But that’s the end of the detailed tour. You should now have a usable baseline virtual machine image that you can reuse, share, play with, etc. Make sure you create a back-up copy! And have a look at the features which allow you to manage roll-backs.

Good luck!

The Boston Azure User Group will focus on Cloud Computing, specifically as it relates to Microsoft’s Windows Azure platform.

This group will likely kick-off in October 2009 – exact date to be determined - exact dates have now been determined – now working on the times   – see the Boston Azure User Group site for details and updates – and to join the mailing list.

What would YOU like to see covered in the meetings of the Boston Azure User Group? Please leave a comment with your thoughts / feedback.

And see you at the Boston Azure User Group!

Howard Rourke hacking Open Source

Here is the plot summary, brought up-to-date:

• Open Source is represented by the protagonist, a brilliant architect named Howard Rourke. Rourke is idealistic, does his own thing, is uncompromising, and is not driven by money or recognition – and certainly not by Big Business.
• Big Business is  represented by newspaper magnate Gail Wynand. Wynand wields substantial influence and is in perpetual pursuit of any means to incite the populace – an energized populace buys more product.
• Consultants and Certified Vendor X Developers and Vendor Partners are represented by  architect Peter Keating. Keating goes with the flow, producing whatever the powers that be say is desirable. At one point, he mentions to Ms. Francon he’s polling folks on what they think of Rourke’s latest building to which she responds (with some disdain) “why, so you’ll know what you think of it?”

Lessons:

• Talent != influence. Keating’s influence is limited to those who recognize his greatness. Most only recognize as great what they are told to recognize as great.
• Passion can be directed constructively (Rourke pours his love into his life’s work) or destructively (Wynand devotes his career to controlling the masses through his newspaper).

The movie is based a book of the same title. The author, Ayn Rand, became well known for her Objectivism philosophy of life, exemplified in the movie by Gary Cooper who played the lead character, Howard Roark. [I wonder what Richard Stallman thinks of the book?]

I wonder how many professional software developers identify more with Howard Rourke or Peter Keating? And which is more desirable?

Any my clean analogies fall apart when one considers the combinations of Big  Business and Open Source. Microsoft just announced CodePlex.org and the CodePlex Foundation “to enable the exchange of code and understanding among software companies and open source communities.”

A dirty little secret of Eclipse, Linux, Apache and other high-profile projects is that they also have professional, full-time staff – sponsored by Big Business (like IBM) – since the success of these endeavors is strategic for their business.

Maybe Open Source isn’t as pure as the romantic notion of developers from around the world contributing since it was a nice thing to do. The world-wide altruistic contributions may still be there in some cases, just supplemented by Big Business. Which is okay with me, though might not be with Howard Rourke.

(The image above is a mashup of http://www.coverbrowser.com/image/bestselling-movies-2006/911-1.jpg and http://farm4.static.flickr.com/3045/2997960369_258313ab0a.jpg, both of which were found on the web with Creative Commons licenses allowing this use. I used Google’s Advanced Search for Images with a License filter to find these.)