After some time blogging at Clearscreen I've decided to stop writing (and not writing) here and,  following the current trend, start a new adventure on my own at www.josefcobonnin.com.

I would like to think the new Mad about .NET will be a much more interesting place where I will not repeat some of the mistakes done here, unfortunately the blogger will be the same, therefore I guess I will need to continue learning along the way :)

I want to thank Clearscreen and Miguel Jimenez for his support and patience during my time here.

Regards,

Jose.

My last post was related to the answers we received to basic questions we do when somebody applies for a job in our company.

I shared a couple of them I've found funny or curious, obviously I never would reveal the author of the answers.

My intention was just to show the weird answers you can receive, like one who answered to "what is Managed Execution?" saying he only works as freelance and specifying the price per hour.

I never intended to laugh about the people itself, I know how hard can be to look for a job, but just about the rarity of the answers. The prove of this is that among the answers provided, there was one of a current employee and he didn't see any problem I published on the web.

Our company is a bit special for this kind of things, we are very self-critics and we apply the humor to our daily work with things like hanging with full name the most stupid errors in our intranet, forcing the ones who break more often the builds to bring a handmade dessert, etc.

The thing is that I received one comment saying the post was not very ethical. In my opinion it was totally misinterpreted, but if one person thought that, it's possible there is more people thinking in the same way, as I said this was far away from my intention.

Therefore I decided to simply delete the post.

I initiated this blog one year ago with the intention to write basically about .NET. I started very enthusiastic and having clear that I didn't want to write just about which products come out or what other blogger said before. But reviewing the posts of this past year I've figured out that I've not been as prolific as I would like and that some of my posts really suck. I mean, I already knew it but when you see the numbers is when you face the truth (I only reached an average of 3 posts per month). I guess that sometimes one does not have time enough and/or just does not find the right inspiration, in any case below you can see my top 10 list of posts based on the web visits received. Obviously the "post competition" is not fair, since the oldest the post is the more possibilities has to be visited, but doesn't really matter.

By the way, I don't understand why the number one received this amazing amount of web visits, who knows what people expected to find when searching how to hook a keyboard and mouse ;)

Let's see what comes out in 2008.

Today I was reading a few articles about the Web 2.0 and I don't know how, I've found this funny song and after listen it I could not avoid blogging about it

Sometimes it's impressing the amount of time I can waste in Internet while I try to do other things I don't like ...

This weekend I received a very nice notice, I've been nominated to be the new Ineta Country Leader for Spain.

My predecessor Miguel Jiménez did a hard job and I hope to be able to continue doing good things for the Spanish Ineta community.

I know this will be a difficult task, the .NET groups in Spain have a lot of activity and ideas, but I will do my best to give them the support they deserve.

I'm desiring to get my hands on the work.

This past week one of our future customers have been trying to integrate with our web services without success; all the support process has been a bit complicated for several factors: first of all was they were the first customer integrating with us who did it using Delphi and our support department couldn't benefit of previous knowledge. Another one was that they don't have employees who can read nor speak other language than French, so we should make use of the Google Translator English - French - English and lot of imagination, but this was not a problem, I always say that when two parts want to communicate the communication is always possible.

The thing is that one week is a lot of time to finish the integration (we had customers integrating in a couple of hours), so we wanted to provide to our customer a solution in order he can start working with us a soon as possible. Today we decided to try to write some sample code for him, even if our developers are all .NET developers.

When I knew that they were using Delphi I felt a bit melancholic, I started working as a Delphi developer in the '98 building some CGI with version 3.0 ... I've tried to resist but I couldn't avoid it ... yes, I know ... don't say anything ... I wanted to see what is the current look of Delphi and try to write the code myself.

Following the suggestions of our customer I've visited the page CodeGear looking for the Turbo Delphi 6.0. The installation already pissed me off, has anybody seen the list of prerequisites? I can understand some things like the Microsoft .NET Framework, IE6 (this is also questionable ...), MSXML, but why should I install the Microsoft .NET SDK (Software Development Kit) v1.1? and Visual J#? there must be a confusion ...  I mean, I want to develop with Delphi not with .NET ... maybe my subconscious has betrayed me and I downloaded Turbo Delphi for .NET ... but it was not the case, so again I ask myself: Visual J#? Well doesn't matter, there must be a good reason for it and anyway I have Visual J# installed.

The first impression after open the IDE is that is quite similar to Visual Studio, the distribution of the windows are almost the same, I have the equivalent to IntelliSense, refactor...all seems very straighforward and I don't need to read too much code to get an idea of the syntaxis. It's time to consume webservices.

After look through almost all the menus and options I find the WSDL importer and after run it I get a kind of proxy with all the necessary classes imported. I get surprised because some types are not used directly but wrapped in structures, like decimal or datetime, everything works fine for simple services but there is one a bit more complex that doesn't want to work. At this point I need to look in the documentation and my first dissapointment appears, I cannot find anything that gives me a clue about what can be the cause. I add a trace module in the webservice to see what I receive from Delphi and there are some weird things like a value 1.0 converted to 56XXXXX.25 (I don't remeber the exact amount).

After lot of different tests I take a break with SOAP and I try another approach: use a simple POST request. I look for a class similar to the HttpWebRequest and after some "googling" (I couldn't find anything on the documenation and I really miss the MSDN), I see that exists a component that I can drag and drop on a form, but this component doesn't appear on the Toolbox. For a while I thought the component is a third party library not included with my version of Delphi, but then I see it's part of Indy, which I remember a radio button asking for version 9 or 10 when I was installing. So I know I have the class, I only need to find in which namespace it is to declare the variable. With .NET I don't have problems for this, I know where are lot of classes and I find quite intuitive the organization in namespaces, where can be this? Net, Networking, Web ... where is the "Resolve" feature? ... The unit I needed to add is the IdHTTP, I found it in the IndyProject, where I can see all the documentation regarding the classes used for HTTP requests, there are no search option or samples, but I have lot of patience.

The class I used has a "Request" property where I can set all the headers for the http request, it makes sense until I get my first exception: something like "Host empty"... how is that possible if I've just set the "Host" property? I rewrite the code in another way, at the end I don't need to set most of the headers, since they are already defaulted. The problem comes when I try to connect through HTTPS instead of HTTP, it seems I need to set a different IOHandler. This is extremely cool since in the hipothetical case I want to build my own handler to manage the SSL connections I can do it without build a different class to perform an HTTP post (I pretended to be ironic). I find in the IndyProject a SSL Handler which I think I read is an implementation of an open source library, the first try doesn't work and throws a very intuitive Read time out exception, I say intuitive because was nothing related to it...I'm not going to extend this post much more because the amount of complains grows exponentially, the important is that at the end it was working.

At the end I saw Delphi 6.0, I know this is not the last version, but really I don't want to see it again for a long time, I took me one day to figure out how to consume web services via HTTPS using soap and post requests. I recognize that after all this time working with .NET my brain is totally focused to what I know, but even if I criticize MSDN because doesn't have as much samples as it could have and some of them doesn't work, being honest the documentation I found about Delphi is very very poor comparing to what you can find in the MSDN about C# and I don't want to talk about lot of other important things about .NET. 

Really, the only thing for which I would recommend to work with Delphi now is to migrate it to C#. Of course this is just a personal opinion and I'm sorry if I offended anybody, but for me there is no comparison possible.

These days lot of bloggers have been writing about the new API of Google: Google Safe Browsing API. The Safe Browsing API is an experimental API that enables client applications to check URLs against Google's constantly updated blacklists of suspected phishing and malware pages.

I think this is a cool API and if you want to take profit of it you already have it with FireFox. But, I like Internet Explorer so I woud like to use both together.

If you take a look to the documentation, you will see that its usage is actually very easy. The idea is that you get a list of URL hashes, which are marked as phishing or malware; then you only need to validate the url's you want to check against these hash tables. I'm not going to enter in too much details since you can read the guide that Google provides you.

What I've done is let's say: a  "proof of concept", that it's possible to use Google Safe Browsing with IE. I've built an implementation of this using C#.  The code you can download consists in two main parts: 

• A Windows Service that hosts a WCF Service with the logic to perform updates and the validation against the hash tables.
• An BHO (Browser Helper Object) that queries the information to the WCF Service.

The BHO is configured as an add-on for IE. It just handles the BeforeNavigate2 event and checks the URL making a call to the published service, if the URL is safe then nothing happens otherwise the navigation is cancelled and the message displayed:

The code for the BHO is pretty simple, the first you need to do is to declare the interface IObjectWithSite to make available for .NET

1 [ComImport]
2 [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
3 [Guid("FC4801A3-2BA9-11CF-A229-00AA003D7352")]
4 public interface IObjectWithSite
5 {
6     void SetSite([In, MarshalAs(UnmanagedType.IUnknown)] Object pUnkSite);
7     void GetSite(ref Guid riid, [MarshalAs(UnmanagedType.IUnknown)] out Object ppvSite);
8 }

 Once you have done this you need to do a class that implements it, this class will be the one loaded by IE and where you will capture the events.

 1 namespace BalearesOnNet.GoogleSafeBrowsing.BHO
 2 {
 3     [ComVisible(true),
 4     ClassInterface(ClassInterfaceType.None), Guid("D5423C28-959D-4909-BB9B-431286B62483")]
 5     public class SafeBrowsingBHO : IObjectWithSite
 6     {
 7         private const string bhoRegistryKey = @"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects";
 8 
 9         private SHDocVw.WebBrowser webBrowser;
10 
11         #region IObjectWithSite Members
12 
13         public void SetSite(object pUnkSite)
14         {
15             if (pUnkSite == null)
16             {
17                 webBrowser.BeforeNavigate2 -= new DWebBrowserEvents2_BeforeNavigate2EventHandler(this.webBrowser_BeforeNavigate2);
18                 webBrowser = null;
19             }
20             else
21             {
22                 webBrowser = (SHDocVw.WebBrowser)pUnkSite;
23                 webBrowser.BeforeNavigate2 += new DWebBrowserEvents2_BeforeNavigate2EventHandler(webBrowser_BeforeNavigate2);
24             }
25         }
26 ...

 The other interesting part of it, is how to cancel the navigation and modify the HtmlDocument, with our custom html.

 1 void webBrowser_BeforeNavigate2(object pDisp, ref object URL, ref object Flags, ref object TargetFrameName, ref object PostData, ref object Headers, ref bool Cancel)
 2 {
 3     ....
 4 
 5     if (result == UrlValidationResult.Malware || result == UrlValidationResult.BlackList)
 6     {
 7         IHTMLDocument2 doc = webBrowser.Document as IHTMLDocument2;
 8 
 9         if (doc != null)
10         {
11             doc.clear();
12             doc.writeln(result == UrlValidationResult.Malware ? Resources.MalwareWarning : Resources.BlackWarning);
13             doc.close();
14         }
15 
16         Cancel = true;
17     }
18 }

The WCF Service exposes only two methods: "public void Update()" and "public UrlValidationResult ValidateUrl(Uri uri)". This service what it does is to obtain and keep updated the hash tables doing incremental updates, as well as the logic to validate the url's against these tables. The tables are stored in an IsolatedStorage to avoid obtaining them from internet every time, nevertheless the tables are loaded and operated in memory.

In order to validate a url you need to perform some steps, first of all you need to obtain a 128 bit MD5 Hash of the URL you want to check, then you need to get the string representation of this hash. With .NET you can accomplish this easily.

 1 private string GetHash(string url)
 2 {
 3     byte[] hashBytes;
 4     using (MD5 md5 = MD5.Create())
 5     {
 6         hashBytes = md5.ComputeHash(System.Text.Encoding.ASCII.GetBytes(url));
 7     }
 8 
 9     StringBuilder sb = new StringBuilder(32);
10 
11     int length = hashBytes.Length;
12     for (int i = 0; i < length; i++)
13     {
14         sb.Append(hashBytes[i].ToString("x2"));
15     }
16 
17     return sb.ToString();
18 }

 Google suggest you also to perform several lookups from the same URL to get an accurated result, which consists of: the exact hostname in the URL, up to 4 hostnames formed by starting with the last 4 components and successively removing the leading component. In addition for the path you should try at most 6 different strings: the exact path of the url, including query parameters; the exact path of the url, without query parameters and the 4 paths formed by starting at the root (/) and succesively appending path components, including a trailing slahsh. A sample displays better what this means.

For the url http://a.b.c.d.e.f.g/1.html

a.b.c.d.e.f.g/1.html

a.b.c.d.e.f.g/

c.d.e.f.g/1.html

c.d.e.f.g/

d.e.f.g/1.html

d.e.f.g/

e.f.g/1.html

e.f.g/

f.g/1.html

f.g/

*(Note that b.c.d.e.f.g, is skipped since we'll take only the last 5 hostname components, and the full hostname)

Another interesting feature is that you can verify that the tables obtained in the requests come from Google, this is obtained by requesting a pair of keys, client key and wrapped key. The wrapped key must be sent along the requests for updates, then Google will include a MAC (Message Authentication Code) in the header of each response following the structure "[mac=dRalfTU+bXwUhlk0NCGJtQ==]". In order to validate this mac you need to do again a 128 bit MD5 Hash with the following information: client_key|separator|table data|separator|client_key. Where the separator is the string:coolgoog: - that is a colon followed by "coolgoog" followed by a colon. To be honest I got a bit stuck here, I've tried a few ways to verify a MAC but there is something I'm missing and I cannot get the expected result. Maybe I try again when I come back from holidays.

You can download the code and test it, but remember that this code is provided as is and cannot be considered finished code. There is room enough for improvement in many areas including exception handling that has not been considered for this sample.

In order to test you will need to install and start the windows service included, before start it be sure that you include your own key in the appSettings section of the file "BalearesOnNet.GoogleSafeBrowsing.Service.exe.config". The BHO is configured to be installed when you compile it with Visual Studio, you can disable this option by unchecking the option "Register for COM interop" in the properties of the project.

I hope you like it.

Today I want to write about the most powerful development tool of our days: the copy paste.

Copy paste helps you to develop faster, increases a lot your productivity, you can develop business components, forms, entire applications; you can develop code even before you understand what it does … all just in minutes!! Your boss is happy, your customer even more and that’s great … but what happens when the original code has a bug? Then all the copy pasted components, forms, applications we did in minutes’ trend to have the same bug and now you need to fix it everywhere, the amount of bugs grows at lightspeed. But, hey!! doesn’t matter, why don’t we use copy paste again to patch everywhere? … Sorry, you are done, once you have started with this development style, there is no return back, you are damned by the “the curse of the copy paste”. Hereinafter you are damned to find the same comments, bugs, even wrongly typed method and variable names … everywhere

Don’t you believe me? Do a review or try to download tools like Simian and use them inside one of the projects of your clients, of course you will not find anything in your own projects, won’t you? Better don’t try.

Maybe it can make you feel better knowing that software like … mmm I’m not going to say the name because I want to be politically correct (tip: it’s a widely used tool to rapidly build web sites with forums, blogs and photos). If you already know which software I’m talking about, try to search “blog” in the project supposed to contain code for photos: 30 matching lines. This deserves a bigger “wow” than the 3D Vista windows; “at least” most of them are comments.

Next time after copy and before paste, please just stop for a second and try to think if you can refactor your classes … lot of times copy paste development is synonym of a bad design.

Of course we can also sum our efforts and ask Microsoft to remove the copy paste functionality from all versions of Visual Studio.

One of the problems we had in the past at Baleares on .NET was the amount of user registrations done by bots, to avoid it we managed to install a captcha control deployed by Dave Burke on the Join option of Community Server. This captha was created for Community Server 2.1, so after install the new version 2007 we needed to do some changes.

Fortunately having the source code of CS is very easy to understand how to apply the changes to have the control up and running again.

Maybe it's possible to create a standalone captcha control and plug it to CS, but since in the past we already needed to modify the CreateUser class, I've preferred just to add it as part of it and recompile. Let's see how I did it.

I've added to the Components folder of CommunityServerComponents20 project a slightly modified version of the CaptchaService class (now called Captcha), nothing important, just added IDisposable interface, some extra disposing not done and modified to use "using" (I'm a fan of the using statement) for some objects instead of the method Dispose at the end of the method.

Then in the folder Page of the project CommunityServerControls20 I've added the source code for JpegImage.cs, again with minor modifications.

After this is when we really need to modify the necessary code to support the Captcha component in our Registration page. The idea we follow is to add a new textbox in order our users can introduce the code displayed in the image of the captcha control. To do it we need to modify the class CreateUserForm that is contained in the folder Forms. 

We start adding a new field of type TextBox called "CaptchaCodeTextBox" and the next property.

1 public string CaptchaCodeTextBoxId
2 {
3     get { return (string)ViewState["CaptchaCodeTextBoxId"] ?? string.Empty; }
4     set { ViewState["CaptchaCodeTextBoxId"] = value; }
5 }

This will allow us retrieving the name of the textbox we will add later on in the ASP.NET page for validation. In the method "AttachChildControls" we get and check that effectively the ASP.NET page contains the required textbox.

1 CaptchaCodeTextBox = CSControlUtility.Instance().FindControl(this, CaptchaCodeTextBoxId) as TextBox;
2 
3 if (UserNameTextBox == null
4     || PasswordTextBox == null
5     || EmailAddressTextBox == null
6     || CreateButton == null
7     || CreateUserCustomValidator == null
8     || CaptchaCodeTextBox == null)
9     throw new InvalidOperationException("UserNameTextBoxId, PasswordTextBoxId, EmailAddressTextBoxId, CreateUserCustomValidatorId, CaptchaCodeTextBoxId and CreateButtonId must be valid controls to render a CreateUserForm");

At the end of the same method we also create the cookie that will contain the code to be manually introduced by the user.

HttpContext.Current.Response.Cookies[Captcha.CookieName].Value = Captcha.GenerateRandomCode();

The next method to modify is the one called "IsValid". As you already supposed, here is where we will compare the code introduced by the user with the one we have randomly generated. The code is very simple, take a look:

1 if (this.CaptchaCodeTextBox.Text != HttpContext.Current.Request.Cookies[Captcha.CookieName].Value)
2 {
3     CreateUserCustomValidator.ErrorMessage = CommunityServer.Components.ResourceManager.GetString("CreateNewAccount_InvalidCaptchaCode");
4     CreateUserCustomValidator.IsValid = false;
5     return false;
6 }
7 
8 this.CaptchaCodeTextBox.Text = string.Empty;
9 HttpContext.Current.Response.Cookies[Captcha.CookieName].Value = Captcha.GenerateRandomCode();

Note that in the line 3 we are using a new Resource name that we will need to introduce in the Resources.xml file.

With this we are already done with the source code, now we need to do the last updates to the CreateUser.aspx page.

Open the page and at the beginning of the CSControl:CreateUserForm you will see a list with the id's used for the required controls, as I said before we need to add the one for the new textbox.

 1 CSControl:CreateUserForm runat="server" 
 2     AcceptAgreementCheckBoxId="AcceptAgreement" 
 3     AcceptAgreementHyperLinkId="AcceptAgreementLink" 
 4     AllowSitePartnersToContactCheckBoxId="AllowSitePartnersToContact" 
 5     AllowSiteToContactCheckBoxId="AllowSiteToContact" 
 6     CreateButtonId="CreateAccount" 
 7     CreateUserCustomValidatorId="CreateUserCustomValidator" 
 8     EmailAddressTextBoxId="Email" 
 9     PasswordTextBoxId="Password" 
10     SubFormIds="" 
11     TimeZoneDropDownListId="Timezone"