With the announcement at Mix their has been a lot of downloads made available and if you haven't been following it might be a little bit confusing so this is the rundown on what you need to use and develop for Silverlight.

The main thing to remember is there are two versions now.  One is Silverlight 1.0 Beta 1 which was previously WPF/E.  This is the runtime for Mac and Windows and uses javascript behind the scene as its programming model and has a Go-Live license, so you can use it in production today.  The second release is Silverlight 1.1 Alpha. This version allows applications to be created using .Net, again available for Mac and Windows.  A feature matrix can be found here - http://silverlight.net/GetStarted/overview.aspx

Runtimes download

Microsoft Silverlight 1.0 Beta - for Mac or for Windows

Microsoft Silverlight 1.1 Alpha - for Mac or for Windows

That will get you up and running, with the ability to view Silverlight powered sites.

But lets focus on the developer tools.

Silverlight is designed to work with Orcas, as shown during the keynote. If you already have Beta 1 VPC, you will need to download the addon - Microsoft Silverlight Tools Alpha for Visual Studio codename Orcas Beta 1 (VS_SilverlightTools_Alpha_Setup.exe).  This will install the templates and other goodies - note, you need 1.1 Alpha installed.

For the designer, Expression Blend 2 May Preview was announced! Allowing you to create Silverlight applications directly within Blend.  Note, Expression Studio is now shipping.  I expect this works with Orcas, but I haven't had chance to try it yet.

So that's not it,  there is also the SDK for each version of the runtime.

Silverlight1.0SDK.zip contains Quickstarts, Samples, Documentation and Beta tools for Visual Studio 2005 and some js files which look to be the runtime detection for use on your sites.  Samples looks to be the same as "WPF/E", just updated.

Silverlight1.1SDK.zip contains Quickstarts, docs, JS, but includes some of the samples online with sourcecode and some UI controls to get you started.  Looks very interesting.

Finally there is Silverlight Streaming over @ http://silverlight.live.com.  This is great to encourage uptake of Silverlight.  4Gb free space and free bandwidth for all your videos.  Did I mention its free?  Well almost free - "Unlimited streaming will also be available for free with advertising, or with payment of a nominal fee for the service for use without advertising"

Hope this helps you find your way to getting started.

Wish I had submitted my Silverlight session for DDD5 now :(  Maybe NxtGenUG will allow me to do one...

In summary:

Runtimes (1.0 + 1.1)

Orcas + Addin

Blend 2

SDK (1.0 + 1.1)

More information @ http://silverlight.net/GetStarted/

Tonight I have been looking into pluralisation (pluralization) with regard to Linq to SQL and how it handles different table names.  As some of you might be aware, there are two ways of creating the mapping between database and objects, one is using the Linq to SQL designer built into Orcas, the other being a command line tool called SQLMetal.  The Linq to SQL designer automatically pluralises the table names where as with SQLMetal you have to add the command line argument '/pluralize'.

With most nouns, it simple involves adding a ‘s’ onto the end of the word.  So Order becomes Orders.  Then there are some require ‘es’ such as gas become gases.  The other types are irregular plurals, which are a bit more complicated, for example person becomes people and sheep stays as sheep.

In the DataContext Orders is a property on the DataContext which calls this.GetTable<Order>(); to return the table.

To start with, I created the DataContext using the designer.  The designer always displays the name as a singular as when designing you are only working with a single instance of the type. In the .designer.cs class, the generated C# code is stored and this is where you can see the various properties which have been created and see how the table has been pluralised. 

When dragging on simple table names such as Categories and Country it can understand the relationship between plural and single, for example Category and Categories and create the objects accordingly.  However, when it got onto more complicated types such as Gas or People, it wouldn't pluralise correctly and create Peoples while Gas would become Ga.  SQLMetal would do the same.

One interesting point is that if you create your DataContext using SQLMetal and you have two tables, Category and Categories in the same database, then it will create Categories and Categories2, where as the designer will create Categories and Category1s. Going to be interesting to see how the product team handles this situation.

It is a shame that the two do not produce the same result, this might be due to the way the designer creates the code as the tables are added onto the design surface whereas sqlmetal does a batch process; hopefully in the final release they will always produce the same result.

Also at the moment there is no way to refresh the diagram if the underlying table changes within Orcas.  At the moment you have to delete the object and drag it on again.  Not great if you have created custom properties. 

All this said; it is only beta 1.

Just a quick note that voting for DDD5 has begun. 

Please cast your votes @ http://www.developerday.co.uk/ddd/votesessions.asp

"You are allowed to change your choices up until the voting ends, which will be around 19th May.
Note: Final selection and scheduling of sessions will be based on popularilty and availability. Grok talks will be decided separately"

Two sessions which sound really interesting are:

F#: Functional Programming on .Net Framework

and Dynamic Languages and .NET

But every session sounds great!

I've known about this for a while now and finally got around to writing a post.

I have accepted a job offer as a Graduate Test Engineer working at Red Gate Software in Cambridge.

"Since 1999, Red Gate Software has been developing ingeniously simple tools that simplify the business of working with SQL Server and .NET. Our tools, which include SQL Compare^®, SQL Backup™ and ANTS Profiler™, have become industry standards for developers and DBAs worldwide. "

I'm really looking forward to starting, I feel I will be able to gain a lot of experience and help them continue to create great software products. 

Today I completed and handed in my final year project. It's been a year of hard work, hopefully it will be worth it and I will achieve a good mark (ie First).  Need to give a demo on the project sometime in May, then its onto my three exams. 

Not long left at University now...

As some of you will know, I am currently trying to complete my final year project on web application security, then I thought that some of you might be wondering what to do next year for your project - or looking for something to do on the weekend.  So below is a list of some of the ideas I have had which could be really good projects.

Robots / NXT
This is my next thing.  Had a NXT since my birthday, however with the Imagine Cup and Uni I haven't had time to sit down and play.  If you haven't heard of the NXT, its from Lego Mindstorms, it comes with bluetooth, senors, motors, and other bits of kit to help you build the robot.  The main part is a 'brick' which everything plugs into,  this is what can be programmed using Lego's own application, Java or .Net.  The NXT is even compatible with the new Robotics Studio and with various books being released over the next few months could make for a great project.
More information at: http://mindstorms.lego.com/

XNA
If you interested in games development, then XNA is definitely the way to go.  XNA allows you to use the .Net framework to create great looking applications on Windows and XBox 360 platforms. It has been out for a while now so lots of help available online. Games development is out of my scope, but if its your thing then I'm sure you could make something really cool using it.
More information at: http://msdn2.microsoft.com/en-us/xna/default.aspx

Mobile phones
Next big platform?  Mobile phone applications are still not reaching their full potential, its a fun platform to develop on and it really needs a killer app.  The project doesn't have to focus solely on the mobile application, maybe it could communication with other platforms such as Windows Home Server...

Windows Home Server and Home Automation
Windows Home Server is on its way and could be used for home automation.  Your project could focus on integrating everything which as lights, alarms, door locks, phones with a great UI. Problem is you have to deal with hardware, but as long as you have the hardware before you start its ok.  NEVER rely on unreleased or hard to obtain hardware as if it never arrives, you in trouble... unless you use Mock Objects but still.  Make sure you can get access to it.

VoIP/Collaboration
Still yet to reach its full potential, lots could be done around this...

http://blogs.msdn.com/coding4fun/  has lots of different projects which you could find useful to gain ideas from.

Technologies to look at and keep in mind when thinking about your ideas include:
WPF WCF WF / .Net Framework 3.0
Windows Mobile 6
Linq / .Net Framework 3.5
Virtual Earth
Ajax

But most of all, keep it fun, make sure your really interested in the topic area as its going to take up a large amount of your time.  Also, make sure you can actually do it,  don't attempt to create Gears of War II for your project but at the same time don't sell yourself short by only attempting to create a ASP.net application reading data from a database.

One of the points I was told, last week, was reader/marker of the project should learn something from the work you have completed.  Basically, don't re-invent the wheel for the 100th time.

These where just some initial ideas, personally, I wish I had done my project using the NXT and if not that then Mobile Phones.  If you have any questions or other ideas, then feel free to post a comment.

After my blog on MbUnit's RowTest feature, a commenter mentioned:

"Wouldn't you think it is better to move such data into an XML file. Keeping test data separated from test logic? You can also enable sharing of data across tests"

Well, yes that would be ideal and MbUnit already has the support for this feature via the DataFixture attribute.

The DataFixtureAttribute together with XmlDataProvider and ForEachTest allows you to store your test data in a external XML file and for each XML Node, execute a test with access to the data.

Again, I am testing my simple Add method.  However, instead of using RowTest to store the data for each test, I have moved the tests into their own XML file, called DataFixtureSample.xml which contains:

<DataFixture>
    <Test>
        <Data a="1" b="2" expected="3" />
        <Data a="0" b="0" expected="1" />
        <Data a="-1" b="-2" expected="-3" />
    </Test>
</DataFixture>

These are my three tests, I could include additional data in the XML Node however I have left it as just the test data.  The element names can be anything and are set out within your own test code.

The code for my test fixture is below.

[MbUnit.Framework.DataFixture]
[XmlDataProvider(@"E:\My Documents\Visual Studio 2005\Projects\MbUnitSamples\MbUnitRowTest\DataFixtureSample.xml",
"DataFixture/Test")]
public class DataFixtureSample
{
    [ForEachTest("Data")] //Gotcha - Don't include a slash!! "/Data" causes it not to display in UI
    public void TestAddMethodUsingXML(XmlNode node)
    {
        int test = MyMethods.Add(Convert.ToInt32(node.Attributes["a"].InnerText), Convert.ToInt32(node.Attributes["b"].InnerText));
        Assert.AreEqual(test, Convert.ToInt32(node.Attributes["expected"].InnerText));
    }

}

The class needs to be decorated with the DataFixture attribute.  XmlDataProvider then takes in the full path to the xml test data, and the XPath for how the framework can find each test data node.

My tests are then decorated with the ForEachTest attribute with a parameter of the XML Node name. A small gotcha here - Don't include a slash "/Data" causes it not to display in UI. 

My test accepts a standard XmlNode which will refer to the XmlNode within the test data.  Each node in the xml file is tested separately in their own test.

From within my test, I can access the XmlNode normally.  In this case, I am getting the InnerText and casting it to a Int32 so it can be used in my add method.

However, MbUnit allows us to tidy this code up for us by allowing each XmlNode to be strongly typed to an object. In the code I have created a class for the Data node which relates to the Xml.

[XmlRoot("Data")]
public class Data
{
    public Data()
    { }

    [XmlAttribute("a")]
    public int a;

    [XmlAttribute("b")]
    public int b;

    [XmlAttribute("expected")]
    public int expected;

    public override string ToString()
    {
        return String.Format("{0} + {1} = {2}", a, b, expected);
    }

}

I then change the attribute and parameter on the test method to be:

[ForEachTest("Data", DataType = typeof(Data))]
public void ForEachTestWithSerialization(Data data)

Now, each XmlNode is just an object in my test so I can simple write data.expected to get the Int32 value from the Xml Node using serialisation.  Great feature!!!!

We can then take the code to the next level by removing the need to hardcore the path to the Xml test file.

By changing XmlDataProvider for ResourceXmlDataProvider and setting the Xml Test File as a Embedded Resource in our build we can have the code like below:

//Make sure you set the xml file as Build Action : Embedded Resource
[ResourceXmlDataProvider(typeof(DataFixtureSampleResource), "MbUnitSamples.DataFixtureSample.xml",   //'MbUnitSamples.' is my project name.
"DataFixture/Test")]

This makes the code a lot more flexible when accessing it from different machines, such as developers and build, as the file doesn't always have to be in the same place.

This is a set of great features and allows you to separate your test data from your test code, together with the serialisation it allows us to maintain readable tests.

If you interested in any other feature, or want to know more then please get in touch.

Code/Sources/More Information:

http://blog.benhall.me.uk/code/mbunit/DataFixtureSample.xml

http://blog.benhall.me.uk/code/mbunit/DataFixture.cs.txt

http://www.mbunit.com

http://weblogs.asp.net/astopford/articles/257001.aspx

http://www.mertner.com/confluence/display/MbUnit/DataFixture

Tonight I finally got around to adding various links to the bottom of my posts, the "Share this post" links you see on the bottom of various blogs.

As you might tell from the template, I use blogger as my blogging software (might switch soon)

The HTML for the links is below, the first block is for the new blogger templates which use the new data format. For example, data:post.url is the URL of the post, while data:post.title is the title.

<!-- Share this post code - Ben Hall - Blog.BenHall.me.uk -->
<b>Share this post: </b>
<a expr:href='"mailto:?body=Thought you might like this: " + data:post.url + "&subject=" + data:post.title'>Email It!</a> |
<a expr:href='"http://del.icio.us/post?url=" + data:post.url + "&title=" + data:post.title' target='_blank'>Bookmark It!</a> |
<a expr:href='"http://www.digg.com/submit?url=" + data:post.url + "&phase=2"' target='_blank'>Digg It!</a> |
<a expr:href='"http://reddit.com/submit?url=" + data:post.url + "&title=" + data:post.title' target='_blank'>Reddit It!</a> |
<a expr:href='"http://www.dotnetkicks.com/kick/?url=" + data:post.url + "&title=" + data:post.title' target='_blank'>Kick It!</a> |
<a expr:href='"https://favorites.live.com/quickadd.aspx?marklet=1&mkt=en-us&url=" + data:post.url + "&title=" + data:post.title + "&top=1"' target='_blank'>Live It!</a><br />

If your still using the old blogger templates, then the format to access information about the post is sightly different.

<!-- Share this post code - Ben Hall - Blog.BenHall.me.uk -->
<b>Share this post: </b>
<a href="mailto:?body=Thought you might like this: <$BlogItemPermalinkUrl$>&subject=<$BlogItemTitle$>" Title="Email It!">Email It!</a> |
<a href="http://del.icio.us/post?url=<$BlogItemPermalinkUrl$>&title=<$BlogItemTitle$>" target="_blank" Title="Bookmark It!">Bookmark It!</a> |
<a href="http://www.digg.com/submit?url=<$BlogItemPermalinkUrl$>&phase=2"' target="_blank" Title="Digg It!">Digg It!</a> |
<a href="http://reddit.com/submit?url=<$BlogItemPermalinkUrl$>&title=<$BlogItemTitle$>" target="_blank" Title="Reddit It!">Reddit It!</a> |
<a href="http://www.dotnetkicks.com/kick/?url=<$BlogItemPermalinkUrl$>&title=<$BlogItemTitle$>" target="_blank" Title="Kick It!">Kick It!</a> |
<a href="https://favorites.live.com/quickadd.aspx?marklet=1&mkt=en-us&url=<$BlogItemPermalinkUrl$>&title=<$BlogItemTitle$>&top=1" target="_blank" Title="Live It!">Live It!</a><br />

Just place the code in your template where you want the links to appear.  Hope this helps!

Can't they just let me get on with my degree?

The SDK for Windows Home Server has just been released, something else I need to start thinking about and playing with.

"The API for Windows Home Server provides the easiest way to access many of the objects for Windows Home Server, such as:

• Client computers
• Shared folders on the server
• Application folders on the server
• Managed volumes on the server
• Hard disks on the server
• Backup jobs on the server
• Notifications on the server"

More Here

http://blogs.technet.com/homeserver/archive/2007/04/03/developers-developers-developers.aspx

And here

http://msdn2.microsoft.com/en-us/library/bb425866.aspx

I've just heard that the ASP.net 2.0 ValidateRequest feature has a security vulnerability.  Very interesting weakness this.  If you don't know about the ValidateRequest feature, its an "on by default" feature to protect ASP.net applications from Cross-Site Scripting attacks by making sure the input field doesn't contain anything potentially dangerous.  For example, entering <script> would cause an exception to be thrown because its likely to be an attack.  It can be turned off by the way.

However, by entering    </XSS/*-*/STYLE=xss:e/**/xpression(window.location="http://www.procheckup.com")>    as an attack string, it bypasses the protection built into ValidateRequest and displays a Javascript alert dialog.  The actual report has examples of how this works with cookie stealing.

When I read it, I just had to try it out so I created a POC, which you can download here. Simply, if you enter the attack string and have no validation, a javascript alert dialog appears and also looks to perform a DoS in the process.  However, if you use either the HtmlEncode or Anti-XSS to validate the data, as you should, then the XSS is stopped and the application is protected.

Here is a screenshot:

Lesson to be learnt:  Practice Security in Depth. Never reply on a single layer of security for your applications.

Microsoft ASP.NET request filtering can be bypassed allowing XSS and HTML injection attacks

http://www.procheckup.com/Vulner_PR0703.php

My POC Project

http://blog.benhall.me.uk/code/aspnet/XSSTest.zip

Great timing for me as I can now fit this into my final year project report and demonstrate it in my demo!! :)  Bad times for all developers relying on the feature to stop XSS.

The dust is now starting to settle, for us anyway, from the whirlwind which was the UK Imagine Cup final on 30th March.

I thought I would just summarise with various blog posts and links about the final.

Phil Winstanley has a really interesting post from the viewpoint of the judges.
http://weblogs.asp.net/plip/archive/2007/04/01/uk-imagine-cup-finals.aspx

Mark Johnston who helped the three teams during the hour and a bit gap

http://blogs.msdn.com/markjo/archive/2007/03/31/uk-imagine-cup-2007.aspx

Rob Milles, University of Hull lecturer and team mentor

http://www.wherewouldyouthink.com/news/2007/3/30/imagine-cup-2007-uk-final.html

Ben Noble, who entered the Imagine Cup a few years ago

http://www.benshouse.net/

And just to finish off, a congratulations from Andrew Stopford.

http://weblogs.asp.net/astopford/archive/2007/04/04/ben-hall-in-the-imagine-cup.aspx

We have had loads of congratulations emails from various people at University which is great.  I would just like to say thank you to everyone at Microsoft UK for the Thursday/Friday, we all had a great time - it's just a shame we can't enter next year but hopefully someone will be representing the University.

If anyone has saw any other links, just add them to the comments, I'll do the same if I see any more.  Keep an eye out for some articles about my Imagine Cup experience.

Yesterday, I came across a odd bug while debugging some code for a proof of concept application.

The code itself was simple connecting to the database, executing two queries using different SqlCommand objects, but the same SqlParameter collection and returning the results to the user.

The method itself look two parameters, a SQL query as a string and a SQL Parameter[]. I would then simply add the parameters to the SqlCommand:

SqlCommand sqlCmd = new SqlCommand(sql, sqlConn);
sqlCmd.Parameters.AddRange(queryParams);

After executing I would close the connection, then code would do some other stuff and a different query would be executed but using the same parameter collection.  In theory, there is no reason why this wouldn't work however the code was throwing an exception with the error "The SqlParameter is already contained by another SqlParameterCollection."  How odd, I had closed the connection and it shouldn't be referred so I should be able to add it.

Turns out, or at least I think, that the garage collection isn't kicking in quick enough and so the reference is still alive.  Quick fix was to clear the parameters on the SqlCommand object after execution.

sqlCmd.Parameters.Clear();

Tripped me up for a little bit so I thought I would post.  Carry on...

Recently I was asked how to separate multiple test asserts based on different data from the test itself to reduce code duplication and/or have better reporting of the multiple assertions in the test instead of just a single pass/fail, even if the test actually 10 different tests.

MbUnit contains a really nice feature called RowTest which allows you to have a single test, but with multiple different sets of data to execute a test against.  Each set of data is then executed separately as a unique test.

An example of the test method is this:

[RowTest]
[Row(1, 2, 3)]
[Row(0, 0, 1)]
[Row(-1, -2, -3)]
[Row(2, 2, 5, ExpectedException = typeof(MbUnit.Core.Exceptions.AssertionException))]
public void TestForAddMethod(int a, int b, int expected)
{
      int test = MyMethods.Add(a, b);
      Assert.AreEqual(test, expected);
}

This then creates four separate tests, with one expecting to fail.

When one test fails, it doesn't stop all the other tests executing.  This is a great feature to improve your unit testing code.

Download the full code class, which includes the NUnit and MbUnit style, from:
http://blog.benhall.me.uk/code/mbunit/mbunitrowtest.cs.txt

Just one of the many great features within the MbUnit framework.

As part of a proof of concept I'm working on, I had to create a simple HTTP Handler which had to access the current HTTP Request and session data as it was coming into the website, I used a HTTP Handler because the Global.asax does not allow access to the request data.

The first thing to do is to create a new class library as the handler cannot be created in the same project as the website itself,  instead it needs to be accessed via an external assembly.

The class then needs to implement IHttpModule and IRequireSessionState, if it requires access to the session data.

The class would look something like this:

public class LoggedInCheckerModule : IHttpModule, IRequiresSessionState

Then two methods need to be implemented, public void Dispose() and public void Init(HttpApplication context).

Within the Init method, you add the code for which you want the handler to access.  context contains all the information about the request.

PITFALL: context.Request etc fails.  Instead, you need to do context.Context.Request :)

After you have coded your handler, in your website web.config you add the reference to the module you created.  Name is a local friendly name,  type is then the module class, and the name of the assembly its located in.

<httpModules>
<add name="LoggedInChecker"
type="LoggedInCheckerModule,
Modules" />
</httpModules>

That's it!  The request will then go via the HTTP Handler before hitting your website.

UPDATE: Well, that's not it. There is a small problem with this code/concept - doesn't work perfectly. I was doing the processing in the Init method (Silly me, this is when the module is launched - my fault bad testing/lack of requirement for it). However, the code below does work - trust me :)

In the Init method, I want to setup an event handler to the PreRequestHandlerExecute which occurs "just before ASP.NET begins executing a handler such as a page or XML Web service." (MSDN)

public void Init(HttpApplication app)
{
    app.PreRequestHandlerExecute += new EventHandler(app_PreRequestHandlerExecute);
}

This will get called every time a new request comes into the site, as you know HTTP is stateless so this also is called when a current user requests a different page or a postback is made. 

Within the app_PreRequestHandlerExecute you can do the processing to access the Session and Request data.  Everything you need is stored within the HttpContext.Current static method.  For example HttpContext.Current.Session["username"]; and HttpContext.Current.Request.CurrentExecutionFilePath;

I've uploaded the code for my module, Do not use this in production code, its just the concept I had to do for my project.  Feel free to use the layout, just rip out my method logic.

Code:

http://blog.benhall.me.uk/code/aspnet/LoggedInCheckerModule.cs.txt