How To: Perform a Security Code Review Code (.NET Framework 2.0)

How To: Perform a Security Code Review Code (.NET Framework 2.0) http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/PAGHT000027.asp Security Question List: Managed Code (.NET Framework 2.0) http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/pagquestionlist0002.asp Security Question List: ASP.NET 2.0 http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/pagquestionlist0001.asp

OSx Theme for Windows XP

http://osx.portraitofakite.com/logon.htm Also, ran across something called ObjectDock. It is a pretty cool little program. http://www.stardock.com/products/objectdock/

Interesting use of Jenga Blocks

Someone created a 30-foot Sears Tower...out of Jenga blocks!

Help Needed: Virtual PC Constantly Locking/Pausing

One of the developers on my team is having constant issues with her VPC locking/pausing up for a second or two.  It is almost like the video is not updating because if you keep typing during the lock up it will show up in the vpc when it starts working again.  She has a T42 with a standard IT build, 1 gig of memory and a single hard drive.  Does anybody have any ideas of why the virtual pc keeps doing this?


Virtual PC, Shared Networking (NAT) and VPN

In previous posts I have mentioned that I am using Virtual PC with shared networking and while this setup typically works great, I have found issues when connected through vpn.  Every so often the DNS name resolution fails to work so I can not get to any machine/web site by name.  To get around this issue, I have hard coded the DNS server values for both and work into the network adapter for the virtual pc image.  To get the dns server ip address for home, I logged into my wireless router and grab the dns servers for my isp.  To get the dns server ip address for work, I open up a command prompt and use the ipconfig/all command.

After I set the dns servers in the virtual pc I have not had any more problems with not being able to resolve server names.

 

 


A couple of good .NET Data Access Articles

Designing Data Tier Components and Passing Data Through Tiers – http://msdn.microsoft.com/library/?url=/library/en-us/dnbda/html/BOAGag.asp

.NET Data Access Architecture Guide – http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnbda/html/daag.asp

 

 


Agile Process Smells: Solution Stories

Good blogs post on XP story cards from http://weblogs.asp.net/wallen/archive/2005/10/11/427256.aspx

Agile Process Smells: Solution Stories

One of the things that often happens when the product owner is technically savvy is that they start writing solution stories. That is they specify how something should be done technically rather than what should be done.

For example here is a story that states specifically how the task should be completed (solution):

Partition the customer history table horizontally

This story has been written by a customer who either knows a lot about physical database performance tuning or has talked to someone who does (or a least someone who tossed out a possible solution).

A better story that gets to the real business need (performance) is:

Ensure that saving updated customer information takes no more than 2 seconds on average

By knowing what the need is the developers can look at the whole system to see why saving the customer is taking longer than 2 seconds. This gives the developers latitude on how to solve the problem rather than boxing them in. In this particular case the real solution was fixing some logic in the trigger and adding an index.

What Make a Good Story?

Bill Wake has an article on the characteristics of a good story. He uses the acronym INVEST:

I Independent Stories are easiest to work with if they are independent. If they are independent we can schedule and build them in any order. This allows us to select stories with the highest value without worrying about all the expensive, low value dependent stories.
N Negotiable Negotiation is a key ingredient of agile development. Remember that agile methods are typically scope variable. That is the time line is fixed (iteration length) and the quality and scope are varied. A story is a placeholder for discussion. We need to be able to split, combine, tweak, clarify, etc stories at any time.
V Valuable Stories need to have real business value to the stakeholders. Typically this is the customer although there are other stakeholders (including the development organization). I like to see all stories expressed in ways that the primary stakeholder can understand the value provided by the story. The definition of "value" can vary somewhat from project to project and organization to organization. 
E Estimable

If a story can't be estimated then the customer can't derive value or assign a priority to it. We don't need a precise estimate or a guarantee that the estimate will never change. But we do need a good enough estimate that is as accurate as current information allows. 

S Small

Having small stories is a result of estimable and negotiable. The larger the story the harder it is to estimate, the less flexibility in negotiation. Each team has a "right size" story which tends to be in the several hours to several days ranges (in ideal time). Stories larger than this tend to fall into the "I don't really know" category.

T Testable

Stories need to be testable, otherwise how do you know the story is complete?

For more info on how to write better stories see Mike Cohn's book User Stories Applied or look at the sample chapter.

Aren't there Any Exceptions?

Of course there are. Most projects have constrains of some kind which are technical in nature. I.e. "Must support Oracle and MySQL" or "all logging will use our custom Log4Net appender". These are definitely solutions, but generally apply to all (or most) stories so I track them separately. I've heard of others using different colored cards to visually indicate the difference between feature stories and constraint stories. I also like to make a note on my feature stories if there is some particular reason to pay attention to a constraint, at least until the team gets a feel for where the constraints apply.

Solution Stories in the Wild?

What are the best examples of solution stories from your experience and how would you rewrite them to be "real" stories?

Agile principles at work
So which agile principles are at work in correcting this smell?

  • Developers create & estimate tasks
  • Developers self select tasks
  • Customers write good stories

Consolidated Virtual PC Tips

I decided to consolidate the Virtual PC tips post that I have made lately.

Differencing Disk:

  • Will greatly save on disk space.
  • Remember to make base image read-only as making changes to it, may/most likely will render any child images unusable.

Performance Tuning

  • Tell WinXp/2003 to tune for best performance instead of letting windows decide.
  • It is best to have the virtual hard disk on a 2nd hard drive, this way the host OS and guest OS are not fighting for disk I/O.
  • Defrag both the host OS and guest OS.
  • Close as many applications on the host os as possible when running the virtual pc.  If you don’t need Outlook open or SQL Server running on the host OS, then close outlook and turn off SQL Server.
  • Don't allocate too much memory to the virtual pc.  a 50/50 split on the laptop seems to work pretty good.
  • You will want at least 1 gig of memory on the host computer to get a decent performance from Virtual PC.
  • Turn off the Virtual PC sound, serial ports, floppy disk, and any other device that you are not going to be using. 

Image Sizing

Virus Scan

  • Virus Scan engines are not able to actually scan the virtual hard disk for virus.  Therefore it is best to install a virus scanner on the guest OS and tell the host OS virus scanner to ignore the Virtual PC files. http://blogs.msdn.com/virtual_pc_guy/archive/2005/09/14/466291
  • The one change from the web site I would make it to specify the exact files to ignore instead of just the extensions.  If is safer that way.

Virtual Machine Additions

  • Make to always install the additions.  They include stability and performance enhancements that greatly increase the usability of virtual pc.
    Service Packs
  • There is a sevice pack 1 for both Virtual Pc and Virtual Server.  You will want to install both of these service packs.

Additional Links:


Virtualization Licensing Changes with Windows Server 2003

Microsoft announced some significant licensing changes with regards to virtualization and Windows Server 2003:

(1)  Starting with Windows Server 2003 R2 Enterprise Edition - customers can run up to 4 virtual instances of Windows Server 2003 (any edition) with no additional licensing costs.  Zero, nil.  Additionally, If you purchase Datacenter Edition of Windows Server, you can have unlimited virtual machines - still at no additional cost.  Pretty cool, huh?

(2)  Some of the Windows Server System products are licensed by the processor. (BizTalk, SQL, Etc)  When these technologies are run in a virtual machine, you only need to license for the virtual processors being used rather than for the physical processors in the host computer.

(3)  You can move active instances of a virtual instance from one computer to another without limitation.  This will allow, for example, a virtual image that is stored on a SAN to be deployed to any server with available resources and licenses.

(4)  To compliment the above scenario, licensing only counts towards the number of actually running virtual instances that are running.  This will allow customers to store as many dormant images as needed.

So why is Microsoft doing all of this?  Customer Ease. They wanted their licensing regarding virtualization to remove any potential barriers to customers using Virtual Server 2005. The best way they found to do this was to remove the licensing confusion and limitations and change the licensing to reflect how their customers actually use Virtualization Technologies.

Does these licensing changes apply only to Virtual Server 2005. No - you can use any virtualization technology that you want.

You can ready the full announcement here


Why does McAfee require so much cpu time

<rant>Why is it that after all of these years McAfee still tends to take a ton of cpu doing real time scanning.  I can tell everytime McAfee is doing something because my laptop just slows to a crawl at best.  When I pull up the task manager, the mcshield process is taking anywhere from 60–100% of the available cpu.  This is just not acceptable to me and over time it has a decent impact on productivity.

I had used the symantec enterprise edition until IT changed the standard to McAfee enterprise.  I never had any kinds of performance issues with symantec.  In fact I would tend to forget that it was even installed. 

Why can’t McAfee make software that has decent performance..

</rant>