Scott Hanselman: Programming

Internet Explorer and the Magic of Microsoft KB Article Q293792

Wed, 17 Sep 2003 00:05:12 GMT

Seems like a lot of my posts lately have started with something like "Here's a weird IE bug" or "Here's something odd in .NET" but...

Here's a weird IE thing. We do a lot of Check Imaging and Statement stuff here, so if someone wants to go online and get an image of a check, they can. We often use Web Services to talk to a Check Imaging Server. Most often we retrieve PNG, JPEG, or GIF. Sometimes, however, the client wants an Adobe Acrobat PDF.

We'll make the SOAP call, get a PDF then stream it directly to the user (You don't want to save these kinds of things, for security purposes).

Enter bug/feature Q293792. Not a lot seems to have been written about this, and not a lot of people seem to care, but apparently when opening a full ActiveX embedding window (to host Acrobat, etc) IE makes either THREE or TWO requests for the content. This is apparently "by design" as URLMON and MSHTML have trouble communicating. So, MSHTML sends a request to "sniff" for the MIME type to figure out what app to load.

Other than being a bandwidth hog, this wouldn't be a big deal - except, when the generation/retrieval of a PDF is an expensive operation involving a WS call to the back end. (Wow, a production Web Service! Madness! Heresy! ;) )

What's interesting is that IE changes the UserAgent HTTP Header to "contype" during the probe, obstensibly so we can simple return the MIME/type and not the actual data.

So, we need to handle that...something like (in classic ASP "psuedo-code"):

  If Instr(1, UserAgent, "contype") > 0 Then
   'Just send the mime/type
   Response.ContentType = "application/pdf"
   Response.End
  End If

So, that's not too bad. But, even the "Fixed" versions of IE still send TWO requests. So, we want to detect the second request and not return the whole thing again.

Here's the other ODD point. For reasons unknown to me, IE doesn't include the Accept-Language header when making this second call, so, we have them use what has already been sent by saying "Not-Modifed":

  Dim Language
  Language = Request.ServerVariables("HTTP_ACCEPT_LANGUAGE")
  If Language = "" then
   Response.Clear
   Response.ContentType = "application/pdf"
   Response.AddHeader "Last-modified", "Mon, 01 Sep 1997 01:03:33 GMT"
   Response.Status = "304 Not Modified"
   Response.End
  End If

Ah, the fun of supporting older versions of IE. I think we need an updated IE Roadmap.

The future of browsing, dear readers, is up in the air, IMHO.

Rory asks, Why do I code?

Fri, 12 Sep 2003 00:33:35 GMT

Why do I code? Because I can't cook, or change my own oil, or mow lawns. Because I lettered in drama in High School but I never got discovered walking an L.A. mall. Because I never made any money doing standup. Because, God help me, if I wasn't coding the only think I'd be good at would be selling cars. (I'm REALLY good at selling cars. Seriously.)

For real, I code because I like solving problems that are decidedly solvable. I mean, I hear the problem, I think for a moment, I figure it's "possible" and then I try to figure how to solve it in a way that feels good. Because I dig physics. Because the end of the Carl Sagan's "Contact" was UNSPEAKABLY cool. I code because of that feeling I've gotten 5 or 6 times when I just NAILED a problem and (while alone) raised my arms high in victory the same way that rapid sports fans do. Except I look at them with a worried disdain when they do it, but secretly I wish I felt like that more often.

I code because coding, at its best, is art and literature and math and physics all at the same time.

The tragedy of November 9th

Wed, 10 Sep 2003 23:16:24 GMT

So, two people commented (one email, one blog comment) with some confusion over the 11/9. Here's the explanation:

It was an internationalization joke (and a good one I thought) When we say 9/11 (formatted mmddyy) most people in the STATES assume we mean September 11. In the last two years the word 'nineeleven' means more than just a date. But it's use and newly attached deep meaning underscores how alone we are as a nation (not just politically) in things like date formatting and the measuring systems. The rest of the planet uses ddmmyy, so they would say "11/9".

The joke is, when we say "oh, ya, 9/11 was a horrible day," a non-american might say, "November 9th? What happened?" Of course, nothing happened on 11/9, we just assume that 9/11 or 4/3 or 8/12 means the same thing to us as it does to them...

P.S. There was a local news report a while back that the local news had pulled off the AP NewsWire. Some fellow came in on a Tourist Visa and transferred to a Student Visa. At some point, he was arrested for some thing or the other and the local news lady, thinking this fellow had gotten away with some clever chicanery commented slyly that his identity was called into question when the news station "discovered" that his drivers license said he was born on 4/3 but his birth certificate listed his DOB as 3/4. Oh, those wacky terrorists trying to pull one over on us. If I had a nickel for every time an international friend reversed a date on a form...

ASPLive! and flying on 9/11

Wed, 10 Sep 2003 21:30:30 GMT

Tomorrow, I'm leaving for Orlando to speak at ASPLive on Internationalization. I'll be flying exactly two years (to the minute) from September 11. Needless to say, the wife's justifiably not happy about it and I have mixed feelings.

My boss says that even flying on September 11th is safer than driving any day. I'm not sure about that, but I'll definitely be expecting some extra security. It's always a challenge to get my Insulin Pump through.

If you're in Orlando at VSLive, please do stop by my Friday afternoon session called "It's the WORLDWIDE Web." I'll be showing some cool stuff in ASP.NET like a banking site in English, Chinese, Malay, Spanish and Arabic. We'll talk all about System.Globalization and dig into the issues around Dates, Currency, Culture and Right to Left languages. It's a very interesting topic. I may try to greet the crowd in at least 10 languages. :)

Remember, when we talk about what happened on 9/11, most people in the world wonder what happened on November 9th...

Things that make my life better...thanks for sharing

Wed, 10 Sep 2003 18:49:06 GMT

Well, that was a nice little spike of traffic. A few random thoughts:

Thanks to everyone for comments and author corrections for the tools on my List o' Tools.
Too bad Radio doesn't appear to support Trackback/Pingback from 'Stories' or I'd know who's linking to me.
I'll continue to update the tools list as I add more. I'll also try to categorize it one day.
Note that I only keep favorite tools - no cruft, no crap. This isn't a list of "all tools" or "favorite tools" but rather "things that make my life better"
Some folks commented that it was mostly Windows and .NET stuff. True, true. That's where I live now, but some tools/utils I didn't include were Grep for Windows and Cygwin and Visual Studio Power Toys, etc, as I didn't think they qualified as simple little utils, although maybe they do.
I didn't include a utilities that are internal (either Corillian-internal or Microsoft-internal) although I wish I could. There's some amazing stuff out there.
Now only if my list could get Scobleized by Robert's 18 readers...
As I sit here and look at my Start Menu, that fills my 1600x1200 screen and runs off the right edge, I see at least 40 other great utils that AREN'T in C:/UTILS that I missed. I'll add them one day.

Scott Hanselman's Ultimate Developer and Power Users Tools List v1

Tue, 09 Sep 2003 21:51:03 GMT

Roy Osherove suggested that I post a list of the contents of my C:/UTILS folder. Everyone collects utilities, and most folks have a list of a few that they feel are indispensable. Here's mine. Each has a distinct purpose, and I probably touch each at least a few times a week. For me, util means utilitarian and it means don't clutter my tray. If it saves me time, and seamlessly integrates with my life, it's the bomb.

Here are most of the contents of my C:/UTILS folder. These are all well loved and used. I wouldn't recommend them if I didn't use them constantly. Perhaps Roy didn't realize what he was asking for.

One day I'll categorize them (if someone cares) but until the, here's "Scott Hanselman's Ultimate Developer and Power Users Tools List" for your approval.

The Microsoft Roadmap Decoded

Mon, 08 Sep 2003 23:53:21 GMT

Just when I'm asked to start thinking about Technology Roadmaps, I find this great dissection of the Microsoft Technology Roadmap. Some highlights:

Disappearing Code Names (Gone, But Not Forgotten)

Product Name/ "Code Name" Additional Info. Projected Ship Date

"Shorthorn" (33) Stopgap release of Windows client 2003

.Net My Services/ "Hailstorm" MS thought to be building many of these into future Windows editions 2004

"BizOffice" combo BizTalk-Office application for B2B 2003 (?)

It's happy utility day!

Mon, 08 Sep 2003 22:52:56 GMT

Finally got around to installing my new shiny version of SoapScope, the little sniffer that could. I showed an early beta at TechEd 2003 in Dallas, but now it's released! It's wicked cheap, and when you're doing Web Services development in a workgroup situation, especially when the interface is in flux and the folks on the other side are in another time zone, it's slick.

It stores all the traffic in a built-in database and others can view and debug the service as it moves through time using a web interface served by it's internal (Apache) web server. It sniffs traffic via a packet capture OR as a proxy.

Two new features that I'm really digging are the WSDL Analyzer that checks for validity and compilance, and the Diff-er, that gives a sweet view of what's been changing from call to call, version to version.

DeveloperPlayground

Mon, 08 Sep 2003 22:04:29 GMT

My buddy Jonas Blunck, hero of the people and maker of ComTrace and IEHttpHeaders has done it again (along with Kim Gräsman) with DeveloperPlayground. At first it looks like Process Explorer from SysInternals, but it includes such cleverness as:

Shows run-time DLL dependencies for running processes

Hooks any process, and tracing single calls to external DLLs

Integrates with favorite tools such as Google, OleView, Depends and the Explorer

DeveloperPlayground now lives happily in the hallowed halls of my C:/UTILS folder with the best of them. Great job guys, keep it up! I think be using and suggesting this util in my C# Class this fall.

Technical Debt

Mon, 08 Sep 2003 21:15:11 GMT

A nice clean way to describe the ramifications of the decisions we have to make every day. Also, a way to describe to our bosses (in term$ they understand) why doing something quick-and-dirty may bite us in the ass.

"Technical Debt is a wonderful metaphor developed by Ward Cunningham to help us think about this problem. In this metaphor, doing things the quick and dirty way sets us up with a technical debt, which is similar to a financial debt. Like a financial debt, the technical debt incurs interest payments, which come in the form of the extra effort that we have to do in future development because of the quick and dirty design choice. We can choose to continue paying the interest, or we can pay down the principal by refactoring the quick and dirty design into the better design. Although it costs to pay down the principal, we gain by reduced interest payments in the future" [Martin's Bliki]

The Zen of .NET: Vacation Continues

Sat, 06 Sep 2003 23:22:17 GMT

Still on vacation...it's my first one in I don't know how long and I am ALL kinds of jet-lagged. I just don't know what time it is. When we went to Zimbabwe (+10 hours) I had no jet-lag, but Malaysia (+15) is messing me up.

Anyway, turns out that the Zen of .NET presentation at TechEd Malaysia did all right. Apparently there was a short write-up in the Malaysian newspaper "The Star" on The Zen of .NET. I don't remember saying some of the quotes, but it's still nice to see that the talk resonated with folks.

Back to work, and too blogging on Monday. I've got a particularly interesting Web Services and WSE 2.0 multi-protocol problem I've got to share.

.NET Code and Intellectual Property

Wed, 03 Sep 2003 03:37:59 GMT

Here's an interesting idea via Bill Wagner - a code copyright watermarker...it creates an obfuscated function that contains your copyright notice. Clever...of course when you look at the generated code, you can see it isn't required and it's easily removed.

PDC - The Blogging Begins...

Wed, 03 Sep 2003 03:21:26 GMT

Kevin Schuler's PDCBloggers.net is up and it looks like it's going to be HUGE - much bigger than TechEdBloggers. Already the list of blogging Attendees is 46 and growing!

TechEd 2003 - DEV389 - Learning to love WSDL has been saved!

Wed, 03 Sep 2003 02:58:25 GMT

I reported in August of the Tragedy Of The Missing TechEd DEV389 Session on the Conference DVDs. Fortunately, my Malaysian buddy Fun Jim Lim pointed out that my session is available online! Glory of glories. Now the 3 people who've shown up here via Google looking for it will actually find something!

TechEd 2003's DEV389: Learning to Love WSDL is here: http://microsoft.sitestream.com/DEV/DEV389_files/default.htm

Yet another useful Utility - Snippet Compiler

Wed, 03 Sep 2003 02:54:19 GMT

My blogging buddy Jeff Key (maker of the increasingly useful NetPing) has posted yet another snazzy util, a Code Snippet Compiler. As .NET folks, we all find ourselves creating junk Console applications with a Console.WriteLine just to test a snippet of code! His utility sits in the tray and is always ready when you want to whip out a quick line or two. Very cool.

Rapid Fire Blogging

Wed, 03 Sep 2003 02:27:00 GMT

Well, we're back from Malaysia, and I'm officially on my first vacation in recent memory. I've had a couple of bloggable things on my mind, but I've been limited by time and internet access.

I arrived home and checked my hanselman.com email from my home machine. (I'd been checking my email remotely with OddPost, which is only the greatest remote email client since, well, ever.) I use POP3, as I don't trust my server enough to use IMAP, and I leave the mail on the server and retrieve it from three or four different locations and client. We were gone for 10 days, and as I hit Send/Receive I notice the status bar informing me that I have 1784 emails. Seems a smidge much for only 10 days. Of this mails about 1600 were spam and the remaining ~180 were legitimate emails that I'll need to deal with.

That's it. It's whitelisting time. I refuse to deal with this much spam. For the last few months I've been using Spamnet, but I can't justify paying $1.99 a month to prevent email I didn't ask for! So, I will now use the Junk Mail features in Outlook 2003 to automatically JUNK all email until I've added emails to a local whitelist.

Next step is to look into a server-based whitelisting system for all my hanselman.com email account users and family members. Anyone have any suggestions?

On the road and still more Web Services DON'Ts

Thu, 21 Aug 2003 23:12:44 GMT

We've just arrived in Hong Kong and we're wireless again. I'd post another picture, but it would look just like the last one except we'd be more tired and have Chinese writing behind us.

On a technical note, we're continuing to run into more Web Services No-No's. This time it was interfacing .NET with a "legacy" Apache-SOAP implementation. Oy vey. It insisted on a custom Apache encoding style ala:

<ns1:SomeMessage xmlns:ns1="urn:UpdateSubUser" SOAP-ENV:encodingStyle="http://xml.apache.org/xml-soap/literalxml">

So, in the tradition of writing Soap Extensions we are ashamed of :) my CTO whiped up an custom attribute "XmlForceEncoding" that allows this madness to occur. Also, the Web Services we were consuming was using the XSD spec from 1999, rather than 2001, so that was special.

Here's some things Chris and I learned (Chris' words):

The encodingStyle they are using is archaic and Apache-specific (non-standard). It also violates the current WS-I Basic Profile (http://ws-i.org/Profiles/Basic/2003-08/BasicProfile-1.0a.htm#refinement35501800). There are a number of messages on SOAPBuilders and elsewhere about challenges with interoperability for servers using this sort of encoding (see below). The problem here is the contradiction between the use="literal" attribute and the encodingStyle attribute. In (modern) web services, use="literal" means XSD schema-based encoding, so it is therefore unecessary (and redundant) to specify an encodingStyle. In this case it is even contradictory. http://aspn.activestate.com/ASPN/Mail/Message/Apache-Soap-Users/736360

New NetPing from Jeff Key

Tue, 19 Aug 2003 17:50:54 GMT

Jeff Key has updated NetPing. NetPing is one of the primary examples I use when teaching newbies C#. It's a nice utility that everyone can easily understand. It's full of nice examples of Threading, WinForms, etc.

It's also a cool addition to utils collections for the IT wonk. He's updated it to include launching Remote Desktop, launch Computer Management and NetworkDriveInfo (another nice util).

Digging into the Exception Management Block

Wed, 13 Aug 2003 23:22:23 GMT

I've been digging into the Exception Management Block and attending a lot of Exception-related meetings lately. Here's a list of the most useful (to me) resources around this block.

Exception Management Application Block Overview
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnbda/html/emab-rm.asp
Exception Management Architecture Guide
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnbda/html/exceptdotnet.asp
(PDF here: http://microsoft.com/downloads/details.aspx?FamilyId=73742594-DB15-4703-8892-75A569C4EB83&;displaylang=en)
Download the code for the Exception Management Block:
http://www.microsoft.com/downloads/details.aspx?displaylang=en&;FamilyID=8CA8EB6E-6F4A-43DF-ADEB-8F22CA173E02
High Level Technical Articles explaining the “gist” of the EMAB
http://builder.com.com/5100-6373-5055434.html
http://www.uml-zone.com/codemag/Article/10296
Explanatory PowerPoint on Exception Management
http://www.microsoft.com/usa/presentations/EMAB.ppt

TechEd 2003 DVD: Tragedy Strikes! I must buy a lottery ticket...

Tue, 12 Aug 2003 18:25:19 GMT

Well...there was a 1 in 400 chance, and I was the one. On the TechEd DVD boxed set that contains all the multimedia presentations for the sessions, if you sort by name, and look for DEV389.htm, you'll see DEV387, DEV388, DEV400, waaah?!? Turns out the launching .HTM file is missing from the DVD set for my session. If you look on Disc 2 and dig for the DEV389_files folder, you can launch the default.htm from there and watch the talk with no problems. But, for those using the menuing system (everyone) you'll get a broken link. Bummer.

Intellectual property, decompilation, .NET and getting the 'gist'

Mon, 11 Aug 2003 18:34:29 GMT

Sergio Pereira asked a great question in the comments that I wanted to bring out to a full blown post. He said:

I'm with you on not touching if it works. As a regular user of Reflector I constantly find myself struggling with the moral issues of what I'm doing. Do you consider what you just did a violation of Intellectual Property ?

This is a great question and a slippery slope. Here's some brainstorming and thoughts to get a discussion started.

To start, I didn't simply "decompile and copy-paste," not only is that shady (not to mention technically infeasible) but it wasn't my intent. My intent was to get the 'gist' of what is going on inside of ASP.NET's @Page Directive validateInput.

Some folks could argue that using ILDASM to get the 'gist' of something is stealing intellectual property. I believe that is usually true. On the other hand I believe that Microsoft included ILDASM (and provides rich metadata in .NET and didn't obfuscate System.*) and wants us to understand the gist of the Windows .NET Framework. They also have provided Rotor source code which many people, including myself, use as a reference implementation to get the 'gist/zen/gestalt' of .NET.

So, what is appropriate use of ILDASM? If someone ILDASMed the System.Collections and writes a better Dictionary, is that a gray area? Who first thought up Dictionaries? Do I owe someone royalties? We all look at other code, other libraries, and internal headers to get the 'gist.'

However, I'm not going to use this code until I'm satisified that it is righteous. Perhaps I'll write an MSDN Article on the subject of Cross Site Scripting and this backport. Perhaps it will be useful and released as a sample, perhaps it will be quashed, perhaps it will be my own personal unused curiousity. Any thoughts ScottGu?

My day: Back-porting Input Validation from ASP.NET 1.1 to ASP.NET 1.0

Fri, 08 Aug 2003 23:41:40 GMT

I don't know if this qualifies as evil, stupid, both, or neither, but here's a story.

Many clients move at a very, shall we say "measured" pace and don't take upgrading from Framework 1.0 to Framework 1.1 lightly. We are very security focused here and javascript injection attacks are always a problem. The client doesn't want want to upgrade to ASP.NET 1.1 until later this year, but they want to make sure they are in some way for script attacks.

So, what to do? Using Lutz's Reflector, Anakrino, and ILDASM I "examined" System.Web.CrossSiteScriptingValidation, HttpValidationException and others, and back-ported the equivalent to ASP.NET @Page Directive "validateInput = true" into an custom validateInput HttpModule. I hook PreRequestHandlerExecute and quite happily detect scripting attacks in ASP.NET 1.0.

Again, may be evil, but felt so good. When the site is upgraded to ASP.NET 1.1 later this year I'll just remove this line from the Web.config:

A couple of interesting questions came up, one of which was...

A while loop is expanded when compiling IL, and the C# equivalent is something like this:

goto L_0045;
L_0040:
   index = (index + 1);
L_0045:
if (index >= len)
{
   goto L_005E;
}
if (CrossSiteScriptingValidation.IsAtoZ(s[index]))
{
   goto L_0040;
}
L_005E:

Should I (for tidying up's sake) roll it back up to something like this:

//Programmer intent: look for non-alphas...
while (index < len)
{
if (!CrossSiteScriptingValidation.IsAtoZ(s[index]))
break;
index++;
}

or just leave well-enough (and well-equivalent) alone? Remembering that this is a so very temporary and marginally not cool thing to do, perhaps it's best to let sleeping dogs lie.

I will be there with Managed Bells on...

Fri, 08 Aug 2003 00:57:30 GMT

I shall be there. I'm really looking forward to this one. TechEd is fun, but PDC is the social and technical event of any season.

More interesting code from my buddy Sairama - How to create an object with a private constructor

Thu, 07 Aug 2003 17:46:19 GMT

using System;
namespace Corillian.Testing
{
      class PrivateClass
      {
            public string Name;
            public int Age;
            private PrivateClass()
            {
                  Name = "not initialized";
                  Age = 0;
            }
      }

      class Test
      {
            static void Main(string[] args)
            {
                  /// The following statement will not work as the constructor is private
                  /// PrivateClass newpTest = new PrivateClass();
                  /// ;But you can create the object through Serialization
                  PrivateClass ptest = (PrivateClass)System.Runtime.Serialization.FormatterServices.GetUninitializedObject( typeof(PrivateClass) );
                  ptest.Name = "Scott";
                  ptest.Age = 0x1D;

                  Console.WriteLine( String.Format("{0} {1}",ptest.Name,ptest.Age );
            }
      }
}

How many ways to Beep and Make Noise in .NET and C#

Fri, 01 Aug 2003 18:52:40 GMT

At the PADNUG meeting last night the question (Lord knows why this always comes up :) on how to make the system "beep" was asked. Here's two kinds of beeps, and links to some source.

The "PC Beep," including frequency and duration:

using System.Runtime.InteropServices;
class MainClass
{
[DllImport("kernel32.dll")]
public static extern bool Beep(int freq,int duration);

public static void Main(string[] args)
{
Beep(1000,1000);
Beep(2000,500);
}
}

The considerably more interesting "MessageBeep" (via BradA) that uses the Wav files that are configured in the Sounds Control Panel.

public enum MessageBeepType
{
    Default = -1,
    Ok = 0x00000000,
    Error = 0x00000010,
    Question = 0x00000020,
    Warning = 0x00000030,
    Information = 0x00000040,
}

[DllImport("user32.dll", SetLastError=true)]
public static extern bool MessageBeep(
MessageBeepType type
);

Product Name/ "Code Name"	Additional Info.	Projected Ship Date
"Shorthorn" (33)	Stopgap release of Windows client	2003
.Net My Services/ "Hailstorm"	MS thought to be building many of these into future Windows editions	2004
"BizOffice"	combo BizTalk-Office application for B2B	2003 (?)