Development tips

Role-based permissions vs. Enterprise permissions

2011-05-19T20:07:00.007-04:00

The problem

My application has multiple features. For example:
1) View resume.
2) Sending message to resume poster.
3) Viewing contact information on a resume.
My application has multiple users. For example:
1) Anonymous
2) Fred Lurker
3) Paul Generous
I want to allow some users to have access to one set of features and other users to have access to another set of features.
For example I want:
1) Anonymous users to have ability to view resume
2) Fred Lurker to be able to view resume and to send messages to resume poster.
3) Paul Generous to be able to see resume, send messages, and be able to see contact information on the resume.

Direct Permissions Mapping

The most direct approach would be to make every feature check a user who tries to access it. For example:

If (User is “Fred Lurker” or User is “Paul Generous”)
{
    Allow user to send a message.
}
If (User is “Paul Generous”)
{
    Allow user to view resume contact information.
}

That’s very direct and simple, but does not scale at all. My application has thousands of users, new users are added to the system, old users are deleted, and existing users are getting access more or less features over time. In order to deal with all that code would have to constantly change which is not feasible.

Role-based Permissions

Better approach would be to introduce roles. For example:
1) “Recruiters” role that has access to “Sending message to resume poster” feature.
2) “PayingUsers” role that has access to “Viewing contact information on a resume” feature.
Then:
1) Add “Fred Lurker” user to “Recruiters” role.
2) Add “Paul Generous” user to “PayingUsers” role.
With such approach software developers would define what roles have access to what features. They would define it in code (e.g. in C#, C++ or Java).
Application administrator would define roles that users have access to.
When Paul Generous pays his membership fee, administrator would simply add Paul to “PayingUsers” role. Administrator does not need to explicitly define what features Paul would have access to, because it’s already defined by developers in application code for “PayingUsers” role.
To summarize:
1) Roles introduce one intermediate step in mapping users to features.
2) Developers map roles to features
3) Administrators map users to roles.

Enterprise Permissions

What if I want my application to be more flexible and allow administrator to map groups of users to features without asking developers to modify code?
That could be setup like this:
1) My enterprise system would still have Users.
2) I’d add Groups, so administrator would be able to add users to groups.
3) Developer would add Privileges, so administrator would be able to map groups to privileges.
4) Developer would code features in such a way that one feature would be mapped to one privileges in my code:

If (user.HasPrivilege(“ViewResume”))
{
    ShowResume()
}

5) Administrator would create and delete Groups and map these groups.
Enterprise Permissions system gives lots of flexibility to application administrators. It’s very appealing for IT department management to be able to tweak users’ permissions without need to wait for developers releasing new version of the app. That’s why such enterprise permissions systems are so popular.

Disadvantages of Enterprise Permissions

Unfortunately in real life flexible enterprise permissions system causes nothing but pain.
Here’s why:
1) With any flexibility comes added complexity.
Having “Users-Groups-Privileges-Features” chain instead of shorter “Users-Roles-Features” chain – significantly complicates the number of possible combinations of how permissions to access features can be granted to end users.
That means permissions could be granted to a user in several different ways through multiple groups. So it’s hard to revoke user’s permissions if necessary simply because it’s hard to figure out what permissions does the user really have.
2) It’s very hard for administrators to grasp what group should map to what privileges.
Administrator focuses on the end user. Administrator knows what groups user should belong to. But administrators have only vague idea about what privilege allows user to do in the application.
End result: developer is setting up the permissions anyway.
3) Enterprise permissions are much harder for developers.
Developers know what features should be available to what role (see Role-based Permissions above). Developers can map features to roles in their code.
Can developers map features to privileges and then map privileges to groups?
Yes, they can. But it’s harder. It’s more work. It requires both coding in C#/Java and scripting in SQL. Or even worse approach – mapping groups to privileges in the UI (error-prone deployment nightmare).
Administrators can setup new groups that developers do not know about. Administrators can delete groups that developers originally created. All that can quickly bring system to its knees. That’s why in the end administrators are afraid to create and delete groups and that defeats original purpose of enterprise system to give more flexibility to application administrators.
4) It’s hard to trace changes in Enterprise Permissions.
In role based system roles-features mapping is coded in C#/Java and is stored under source control. Code changes history helps to find out when and why this role was mapped to that feature.
Not so with mapping between groups and privileges. Such mapping is stored in database and is wiped out without trace every time when administrator changes the mapping.
There are no comments on why groups-features mapping was done the way it was done. There is simply no place to put such comment (unlike roles-features mapping that can be commented in C#/Java code).

Conclusion

The most robust way of handing permissions in most of applications is with role-based permissions (Users-Roles-Features).
In spite of “flexibility” appeal of enterprise-based permissions (Users-Groups-Privileges-Features), such system has serious disadvantages and virtually no real advantages.

Fixed headers scrollable content in HTML table

2011-01-25T14:40:00.003-05:00

It's a tough problem to create HTML table in such a way that supports all of the following requirements simultaneously:
1) Has scrollable table body with content.
2) Has fixed table column headers.
3) Has header columns automatically aligned with body columns.

I looked through multiple solutions on the internet, and the best option so far is jquery.tablescroll.js plugin by Dimas Begunoff.

It allowed me:
1) Not to specify columns width explicitly.
2) Have multi-row headers with some cells spanning across several columns. The only trick is that first header row should have the same number of cells as body row.

While it's the best solution I could find -- it's still not perfect.
If table is pretty busy, and table content pushes column borders pretty hard -- header columns do not align perfectly with body columns.

If anybody knows better solution -- please let me know.

Boolean Search to SQL CONTAINS

2010-10-18T00:18:00.003-04:00

Today I rolled out Boolean Search feature for PostJobFree.
PostJobFree uses SQL Server backend, so it seems obvious to use Full-Text search that SQL Server have to process boolean search queries from users.
Unfortunately it's not as easy:
Full-Text search CONTAINS query is pretty strict, and crashes the whole SELECT statement if CONTAINS clause syntax is not correct. For example:

asp sql

query would crash SQL Server's SELECT command if the query would be passed into CONTAINS clause as-is. Correct syntax would be:

asp AND sql

So I need to write a parser that parses user's search input into boolean search query object hierarchy and then renders CONTAINS query for SQL Server from that hierarchy.
Here's how I designed it.
Search object hierarchy consist of the following parts:
1) Word. It consists only of letters, digits, dots, and dashes. Dashes can be only be inside the word, between letters/digits. Dash outside the word is considered as negation.
2) Phrase. Phrase can have any chars wrapped in quotes.
3) OrList. OrList consists from two or more elements, separated by "or". For example:

("sql server" or oracle or DB2)

4) AndList. AndList consists from two or more elements, separated by "and" or "and not" operators. For example:

sql and asp and not oracle

This query would be rendered into AndList that consists of 3 elements.
Both OrList and AndList could consist not only from atomic pieces (such as Word and Phrase), but also from OrList and AndList subelements.

Parsing logic:
1) Split input query by quote char ('"'). Basically even elements in this split list are phrases. Everything else does not contain phrases.
2) After phrases are extracted, partially processed list consists of strings and Phrase objects.
3) Next step is to extract parenthesis that are not wrapped by other parentheses. Consider example:

(one and (two or three)) or four

"one and (two or three)" would be extracted from original query, and then recursively processed again.
The recursion ends when there are no more parentheses.
4) When recursion is so deep, that there are no parentheses left in a subquery, then that subquery is split by "or" word (or "|" char).
5) Last major step is to split remaining subquery into AndList. The trick here would be to appropriately assign negation if subquery was preceded by negation orerator "not", "!", or leading dash ("-").

After query is fully parsed, it's time to get final CONTAINS query for SQL Server.
It can be accomplished by overriding ToString() method for Word, Phrase, OrList, and AndList:
1) Word just converting containing text to UpperCase.
2) Phrase's ToString() overload converts InnerText to UpperCase and wraps it by quotes.
3) AndList joins all elements into single string using "&" separator or "&!" separator if one of AndList's subqueries was negated.
4) OrList joins all elements into single string using "|" separator. Then it wraps the result by parenthesis.

How to set executionTimeout for individual requests?

2010-09-23T10:00:00.002-04:00

You probably know that you can change http request processing timeout for specific page like this:

 <location path="MyLongRunningHttpHandler.ashx">
  <system.web>
   <httpRuntime executionTimeout="600" />
  </system.web>
 </location>

But what if you want to set it up for a control or just a function and do not have predefined list of pages to specify it in web.config?
Of maybe you don't want to pollute web.config with junk like that?

There should be some way to do it in C# code, right?
Right.
Here's how you do it:

    HttpContext.Current.Server.ScriptTimeout = 600; // 10 minutes

If that's what you were looking for, you probably want to test it.
I tried to test it too, and it turned out to be tricky.

First I set web.config's timeout to 2 seconds:
<httpRuntime executionTimeout="2" />

Then I put 10 seconds delay to my ashx handler's code-behind:
System.Threading.Thread.Sleep(10000); // 10 seconds

Then I commented this line:
// HttpContext.Current.Server.ScriptTimeout = 600; // 10 minutes

and opened my ashx handler's url in browser.

I expected it to crash with timeout error... but it did not happen.
:-O
Few experiments showed that executionTimeout works only if all of the following is true:
1) Domain name is not localhost (to test timeout you should use "YourComputerName" instead of "localhost").
2) Project is compiled in Release mode.
3) <compilation debug="false">
If any of the above is not true then executionTimeout length is virtually unlimited.
On top of that IIS typically times out later than executionTimeout limit asks it too.
When I set executionTimeout=2 and made my page request to sleep for 10 seconds, I was getting "Request timed out." response only in ~40% of requests.

Sneaky MaxItemsInObjectGraph attribute in WCF

2010-09-13T15:34:00.005-04:00

I spent almost couple of days trying to figure out what caused WCF service to crash (in a weird way) when it was tried to return large resultset.
Initially the problem expressed itself on the WCF client side. When number of records in returning results was close to 5000 – WCF client generated
Meaningless "An existing connection was forcibly closed by the remote host." exception.
Google search for '"An existing connection was forcibly closed by the remote host." WCF size' brought up
WCF issues sending large data forum discussion.
The right answer (maxItemsInObjectGraph) was mentioned there, but it was buried under pile of misleading suggestions.

One step toward the solution was to use soapUI utility to make the requests (instead of calling WCF service from another .NET client).
That helped to determine that the problem is on the WCF server side -- soapUI simply couldn't get any response (when number of returning dataset rows was ~5000+).

What really helped to find the final answer -– was enabling WCF diagnostic by adding this to web.config on server side:

<system.diagnostics>
    <sources>
      <source name="System.ServiceModel" switchValue="Warning, ActivityTracing"
        propagateActivity="true">
        <listeners>
          <add type="System.Diagnostics.DefaultTraceListener" name="Default">
            <filter type="" />
          </add>
          <add name="ServiceModelTraceListener">
            <filter type="" />
          </add>
        </listeners>
      </source>
    </sources>
    <sharedListeners>
      <add initializeData="app_tracelog.svclog"
        type="System.Diagnostics.XmlWriterTraceListener, System, Version=2.0.0.0, 
        Culture=neutral, PublicKeyToken=b77a5c561934e089"
          name="ServiceModelTraceListener" traceOutputOptions="Timestamp">
        <filter type="" />
      </add>
    </sharedListeners>
  </system.diagnostics>

Then app_tracelog.svclog revealed much more specific error message:
---
Maximum number of items that can be serialized or deserialized in an object graph is '65536'. Change the object graph or increase the MaxItemsInObjectGraph quota. '
---
Quick googling for "maxItemsInObjectGraph" brought me to MaxItemsInObjectGraph and keeping references when serializing in WCF blog post which recommended to add the following section to WCF server web.config:

<behaviors>
  <serviceBehaviors>
    <behavior name="LargeServiceBehavior">
      <dataContractSerializer maxItemsInObjectGraph="100000"/>
    </behavior>
  </serviceBehaviors>
</behaviors>

and this section to WCF client web.config:

<behaviors>
  <endpointBehaviors>
    <behavior name="LargeEndpointBehavior">
      <dataContractSerializer maxItemsInObjectGraph="100000"/>
    </behavior>
  </endpointBehaviors>
</behaviors>

That worked.
I used VS.NET 2008 / .NET Framework 3.5, but I think that is applicable to .NET 4.0 too.

Enjoy.

How to allow multiple users in RDC in Windows 7 64 bit

2010-09-09T10:36:00.001-04:00

Guide: How to Enable Concurrent Sessions in Windows 7 RTM

How to preserve data during processing HttpRequest in ASP.NET?

2010-06-03T14:49:00.000-04:00

The answer to it is HttpContext.Current.Items

I'm planning to use HttpContext.Current.Items for preserving pointers to controls that would render final javascript on the pages.
Or may be preserve javascript itself and then make these controls to retrieve the javascript from HttpContext.Current.Items["BottomScriptBuilder"] and HttpContext.Current.Items["HeadScriptBuilder"]?

System.Web.HttpContext.Current.Items is actually pretty old thing in ASP.NET

How to include JavaScript tracking code into head control in asp.net

2010-05-16T17:27:00.001-04:00

Google Analytics team recommends to include Asynchronous Google Analytics tracking javascript code right before closing </head> tag.
So, how to include that script into every page on your web site without modifying every page?

I considered multiple solutions:

1) Cut&paste into every page (the worst).

2) Create HeadScriptControl.cs server control and cut&paste it into every page (slightly better, but still requires lots of cut&paste).
Here's an example of HeadScriptControl code:

using System;
using System.Web.UI;
using System.Text;

public class HeadScriptControl : Control
{
 private const string GoogleAnalyticsFirtsPartScript = @"
<script type=""text/javascript"">
var _gaq = _gaq || [];
_gaq.push(['_setAccount', 'UA-XXXXXX-2']);
_gaq.push(['_trackPageview']);
</script>
";
 protected override void Render(HtmlTextWriter writer)
 {
  writer.Write(GoogleAnalyticsFirtsPartScript);
 }
}

3) Create PageWithHeadScript.cs, inherit it from Page control, inherit every page on your web site from PageWithHeadScript.cs and render HeadScriptControl in PageWithHeadScript.cs like this:

public class PageWithHeadScript : Page
{
 protected override void Render(HtmlTextWriter writer)
 {
  this.Header.Controls.Add(new HeadScriptControl());
  base.Render(writer);
 }
}

That approach requires even less cut&paste, but still every page on your web site needs to be touched.

4) Using HttpHandler.
I think that's the best approach, because it's not necessary to modify pages at all.
Here’s how I do it.

4.1. Create HttpModule:

public sealed class MyHttpModule : IHttpModule
{
 void IHttpModule.Init(HttpApplication application)
 {
  application.PreRequestHandlerExecute += new EventHandler(application_PreRequestHandlerExecute); 
 }

 void application_PreRequestHandlerExecute(object sender, EventArgs e)
 {
  RegisterPagePreRenderEventHandler();
 }
 private void RegisterPagePreRenderEventHandler()
 {
  if (HttpContext.Current.Handler.GetType().ToString().EndsWith("_aspx"))
  { // Register PreRender handler only on aspx pages.
   Page page = (Page)HttpContext.Current.Handler;
   page.PreRender += new EventHandler(page_PreRender);
  }
 }

 void page_PreRender(object sender, EventArgs e)
 {
  System.Web.UI.Page page = (Page)sender;
  page.Header.Controls.Add(new PostJobFree.WebUI.Controls.HeadScriptControl());
 }

 void Application_BeginRequest(object sender, EventArgs e)
 {
  DosAttackAnalyzer.AnalyzeHttpRequest(Ijs.Misc.BrowserIPAddress);
  // DenyIpAddress.DenyAccessToCurrentIpAddressIfBlacklisted();
 }
  void IHttpModule.Dispose()
 {
 }
}

4.2. Register HttpModule in web.config:

<?xml version="1.0"?>
<configuration>
 <system.webServer>
  <modules>
   <remove name="DenyIpAddressModule"/>
  </modules>
 </system.webServer>
</configuration>
</pre>

Note that it's impossible to add controls into page straight in PreRequestHandlerExecute event handler.
That's why I subscribe for Page.PreRender event.

Please let me know what you think.

ValidationSummary control is not red anymore

2010-05-16T00:08:00.000-04:00

We upgraded PostJobFree.com to ASP.NET 4.0.
Then we discovered that ValidationSummary controls are not red anymore.

It turned out that The BaseValidator class and validation controls that derive from it no longer render red text by default.

Why did ASP.NET team make that breaking change?
Because they wanted to render cleaner and more CSS compliant HTML

Anyway, here's the solution:
Add ~/App_Themes/Default/Default.skin
Put there:

    <asp:ValidationSummary runat="server" ForeColor="Red" />

That worked for PostJobFree.
Hope it would help you too.

ASP-NET-SQL-XML-Dennis-Gorelik-Resume

2010-05-15T13:49:00.009-04:00

Dennis Gorelik

E-mail:

blogresume @ dennisgorelik.com

You describe your business problem – I deliver technical solution
Objective

Team Lead / Architect / Senior Software Developer for the position that requires deep technical knowledge as well as good understanding of underlying business processes.

Please ask me:
- How to deploy program changes without interruptions in web site work (which is 24/7 service).
- How to improve web site usability.
- How to use A/B testing in Google WebSite Optimizer.
- How to track web site performance and usage (Google Analytics, IIS Logs, custom logs, …).
- How to use Google AdSense and Google AdWords.
- How to integrate your solution with Google Checkout (payment system).
- How to add maps to your web site using Google Maps API.
- How ASP.NET Membership provider helps to keep users passwords reliably encrypted.
- Practical way to setup data exchange with other web sites using XML web services.
- How to quickly implement Full-Text search using SQL Server 2008.
- How to make Web Application and background Windows Service to communicate with each other using WCF.
- What physical tiers and logical layers I recommend to use for your application and why.
Background

Team Lead / Architect / Senior ASP.NET Developer. Over 10 years of experience in analysis, design and software development.
Full system life cycle experience: design, coding, testing, bug fixing, deployment, documentation and maintenance.
Preferences in Agile/RAD methodologies.
Technical skills

Languages: C# 4.0, VB.NET, T-SQL (DDL, DML), VB script, JavaScript, JQuery, HTML/DHTML, XML, ...

Technologies: ASP.NET 4.0, ADO.NET, WCF (Windows Communication Foundation), XML Web Services, Unit test, WPF …

Databases: MS SQL Server, Oracle, DB2 …
Development Tools: Google Search, Visual Studio.NET 2005 Team Edition, Microsoft SQL Server Management Studio, Nant, Toad VI, MS Visio, Google Docs, MS Office, Google Maps API.
Web Development: ASP.NET, XML Web Services, IIS, JavaScript, HTML, DHTML, CSS, ...
Reporting Tools: Microsoft Reporting Services, Crystal Reports.
Version and Source Control: TFS, Visual Source Safe, Subversion, VisualSVN, ...
Operating Systems: Windows 7, Windows Server 2008, MS Windows XP/2000/NT, Windows 95/98/Me, Windows 3.xx, MS DOS.
Projects history

May 2008 - Present. Team Lead, www.postjobfree.com, Jacksonville, FL

Tools and technologies: VS.NET 2010 (ASP.NET, WCF, AJAX, JQuery, Unit Tests, Web Tests, MembershipProvider …), C# 4.0, SQL Server 2008, VisualSVN, NDepend, Reflector, Google Analytics, AdWords, AdSense.

- Architected and implemented www.postjobfree.com.
- Integrated PostJobFree with external systems: job search aggregators, Google and search engines, Twitter, … (XML Services, API calls).
- Designed and lead implementation of search alerts, including immediate match delivery.
- Analyzed users’ feedback and prioritized development features.
- SEO (Search Engine Optimization):
- Implemented RESTful architecture: Made all content available through direct HTTP GET requests (direct URLs to every bit of information without need to clicking buttons (HTTP POST)).
- Exposed PostJobFree web content through Site Maps to Google and Yahoo search engines.
- Designed & implemented strategy to fight spam and duplicates.
- Designed database structure to accommodate business requirements.
September 2010 - December 2010. Senior ASP.NET developer, Lender Processing Services, Jacksonville, FL

http://www.lpsvcs.com - Tax Desktop application -- tax oriented component of Loan Processing System.
Tools & Technologies: ASP.NET 3.5, C#, VS.NET 2008, MS SQL Server 2008, T-SQL Stored Procedures, WCF web services, JavaScript, JQuery, TFS.
Accomplishments:
Extended business functionality (Loan details, Tax Lines).
Refactored spaghetti code into object oriented muti-tier/multi-layer solution with:
- DAO (Data Access Object -- client consuming WCF service)
- WCF service (Windows Communication Foundation)
- BLL (Business Logic Layer)
- DAL (Data Access Layer) that faces LINQ-to-SQL designer.
Eliminated the need of updating web references and minimized WCF client footprint in web.config, which improved code maintainability.
Identified SQL Connection leak and implemented solution that fixes it.

- September 2005 – May 2008. Senior ASP.NET & database developer, National Flood Services, Kalispell, MT
http://www.nfsmt.com/ - the company works in flood insurance business.
Conversion from Legacy system (AS-400/DB2/VB6/ASP/ASP.NET/MS SQL2000) to new ASP.NET 2005 / MS SQL 2005 application.

Tools & Technologies: ASP.NET 2.0, VS.NET 2005, C# 2.0, SSRS (SQL Server Reporting Services), Generics, Provider Model, User Controls, Master pages, GridView, Web parts, ADO.NET, Web Forms, XML Web Services, MS SQL Server 2000, Validation controls, JavaScript, Telerik controls, HTML/DHTML, CSS, VSS, Web Forms.

Achievements:

- Data Warehouse: Architected and developed system that imports data from legacy database (DB2) in form of flat files. Incoming data is parsed, scrubbed for errors, and loaded into final database in denormalized form for fast reports performance.

Data Correction Application: Designed and developed application that allows to review and fix incorrect data that was imported into Data Warehouse (Winforms, C#, Web Services, SQL Server 2005).

Insight Reports: Architected and developed web application for report requests – users can customize reports according to their requirements (ASP.NET 2.0, MS SQL 2005, SSRS (SQL Server Reporting Services), Web Services, JavaScript, HTML/DHTML, Telerik controls,
DB2, SQuirreL SQL 2.1).
- Developed custom Membership and Role providers to access legacy database (ASP.NET 2.0, Provider Model, MS SQL 2000, DB2).
- Developed custom localization provider (C# 2.0, Reflector. Namespaces: System.Reflection, System.Resources, System.Web.Compilation, System.IO).
Developed User Management system + Web site administration (MS SQL 2005, ASP.NET 2.0 Login controls).
- Developed several Flood Service providers (C# 2.0, HttpWebRequest).
- Developed UI for testing various Flood Service providers (ASP.NET, C# 2.0, GridView, ObjectDataSource, Session, ViewState).
- Helped others to solve technical problems.
June 2005 – August 2005. Senior ASP.NET developer, IBM Global Services, Indianapolis, IN

http://www.ibm.com/services/
This is fast paced project for Wells Fargo bank (http://www.wellsfargo.com/). The project was about making web portal for managing vendor evaluation scorecards.
Snapshots: http://www.dennisgorelik.com/resume/IbmGlobalServices
Tools & Technologies: ASP.NET, C#.NET, ASP.NET User Controls, ADO.NET, Web Forms, MS SQL Server 2000, Validation controls, JavaScript, HTML/DHTML, CSS, VSS, RapTier codegenerator.

Achievements:
- Analyzed business requirement.
- Defined technical details of the solution.
- Developed scorecard template functionality edit/view/report (ASP.NET, C#, MS SQL, Stored Procedures, RapTier, CSS, HTML).
- Implemented making and handling web-page snapshorts in “Web archive, single file (*.mht)” format:
- Developed functionality for saving web pages snapshots into database (used CDO functionality).
- Developed functionality for viewing saved snapshots.
Saved images into database and showed images from database on web pages.
Implemented Scorecard View with dynamical load of heterogeneous user controls into the web page.
Developed several appendices for Scorecard functionality:
- Designed database tables.
- Created stored Procedures / Views / User defined functions
- Created middle-tier DB classes (C#).
- Created AppendixControl_Base.cs as a base for “Appendix” user controls. This base class was used by me and other developers in the team.
- Created user controls (*.ascx / C#).
Tested, fixed, and modified application according to changes in user requirements.
December 2004 – June 2005. Senior ASP.NET developer, Cendant Mobility, Danbury, CT

http://www.cendantmobility.com/

Tools & Technologies: ASP.NET, C#.NET, ASP.NET User Controls, ADO.NET, Web Forms, Win Forms, MS SQL Server, Remoting, Validation controls, JavaScript, HTML/DHTML, CSS, Nant, VSS.
Analyzed business requirements.
- Developed Template Request module (ASP.NET, C#, JavaScript, ADO.NET) and integrated it with existing application https://atlas.cendantmobility.com/.
- Template finder.
- Multiple container pages.
- Various template list screens with "multiple rows add" and "multiple rows remove" functionality (ASP.NET, JavaScript). (“Template associations”, “Template list”).
- “Update” screens (document template update, package template update).
- Developed ASP.NET User controls, including:
- Template list ASP user control - with Middle tier call, page navigation (paging), and sorting all columns.
- Navigation ASP user control.
- Created unit tests (WinForms).
- Used the following techniques:
- Nested pages (iframe), including nesting iFrames.
- Popup pages (Template finder, Product selection)
- Style sheets (*.css)
- Wrote stored procedures.
- Set up Nant --- tool for automatic build generation (for daily build).
- Helped other developers to solve technical problems.

August 2004 – December 2004. Senior ASP.NET developer, MPS Group, Jacksonville, FL
http://www.mpsgroup.com/
“Knowledge Spring” web portal project development.
Developed portlets(ASP.NET user controls) for multi-tier web system.
Tools & Technologies: VS.NET, ASP.NET, User Controls, Portlets, Repeater, DataList, Validator Controls, JavaScript, C#.NET, VB.NET, WebForms, WinForms, Oracle 9.2, LLBLGen Pr- Engine, Toad VI, SQL Plus, VB Script, PL/SQL script, ADO.NET, XML Web Services, MS VSS 6.0d, ComponentArt TreeView.

Projects:
- Directory Browser (recursive browsing through database items + Properties PopUp)
- MessageSet Editor & Message Editor (used repeater and Cute Editor control)
- Role Editor, UserSelectionControl, Actions Editor PopUp
- Attribute Editor, Portlet type editor, User Control editor, Item Types editor, DomainMappings editor, Audiences editor, Actions editor (repeater, JavaScript including passing data between main and popup windows, Web Validation Controls)
- SubstitutionVariables editor (used RegEx expressions)
- FileReportViewer (including NTFS permissions check through Advapi32.dll and Kernel32.dll API)
- Developed Windows services (C#).
- Developed win forms test app.
- Site Directory View 3-layers tree (ComponentArt TreeView).
- Configurations loading (VB Script, PL/SQL script, *.lst files).
May 2004 – July 2004. .NET architect, Yellow Pepper, Boston, MA

http://www.yellowpepper.com/
Tools & Technologies: VS.NET, ASP.NET, C#.NET, VB.NET, WebForms, WinForms, MS SQL 2000, ADO.NET, XML Web Services, MS Visual Source Safe, Groove.

Projects:
- Shazam web service wrapper.
- SMS Tracker – tracks information about SMS messages delivery.
- SMS Games – games based on sending/receiving SMS text messages to/from cell phone.
- Phone number look up – look up information about specified phone number (Carrier, Gate, IsWireless, City, State, Country, Switch).
August 2003 – April 2004. Senior .Net Software developer, Wurzburg, Memphis, TN

Tools & Technologies: ASP.NET, C#.NET, WebForms, WinForms, MS SQL 2000, ADO.NET, Microsoft Application Block, Remoting, Crystal Reports, XML Web Services, User controls, Server Controls, MS Visual Source Safe, MS Project, MS Visio.

Projects:
Development of various functionalities for warehouse project.

Web-site security
Designed and developed security framework for the web application: User authentication and authorization, Cross-applications calls.

UPS address validation project
Designed and developed mail address validation program. The program interface is exposed through web-page interface (and .csv file) and through XML Web Service (http://www.wurzburg.com/UPS/UpsValidation.asmx).
Technologies: ASP.NET, IIS, C#, XML, XML Web Services.
The program prepares XML-request and send it to UPS.

The program is based on UPS EDI functionality exposed here:
https://www.ups.com/ups.app/xml/AV

Reports project
Developed various business reports. Reports are provided in PDF-format, HTML-format, and can be printed directly to the specified printer. Reports functionality is exposed as to end users (through web-pages) as to other developers (in form of XML web services).
Technologies: IIS, ASP.NET, C#, Crystal Reports, ADO.NET, MS SQL Server 2000 (stored procedures, views, functions), XML Web Services, IE 6.

Catalogue project
Designed catalogue module, including ASP.NET and MS SQL database design. Developed shopping card functionality.

Label printing project
Designed and developed program to print bar-code labels. Program is tightly integrated with the company’s database. For instance, user which prints a label is associated with it’s own label printer.
Technologies: IIS, ASP.NET, C#, Crystal Reports, ADO.NET, MS SQL Server 2000 (stored procedures, views, functions), IE 6.

Deployment
Worked out fast and reliable deployment method. This method allows to deploy development changes to Production every day. Automated deployment SQL-script preparation.
In case of emergency deployment can be made even more often (in extreme cases up to 4 times per day).
Technologies: VS.NET, Database project, VSS, ASP.NET.
Performance
After initial prototyping and user evaluation I improved performance of "bottle-neck" applications. Modified SQL-queries, used MS SQL Query analyzer and SQL Profiler.

Other responsibilities
Was responsible for managing project documentation and for Visual Source Safe administration.

April 2003 – August 2003. Team leader. Global Consulting Group, Cincinnati, OH

Tools & Technologies: Visual Studio .NET, VB.NET, C#.NET, WebForms, WinForms, ADO.NET, MS SQL 2000, MS Visual Source Safe, MS Project, MS Visio.

Responsibilities: Lead team of 3 developers.
Achievements:

- Analyzed business requirements.
- Designed application architecture.
- Wrote technical specification.
Coached team members.
- Implemented logical and physical database design.
- Created SQL-queries (T-SQL).
- Developed web UI forms (ASP.NET, WebForms).
- Implemented data exchange (ADO.NET).
- Created business components (C#.NET).
- Created reports (Crystal Reports 9.0).
- Created XML Web services.
- Created XSL transformations.
May 2002 - April 2003. Application Developer, Scala

http://www.scala.net/
Tools & Technologies:

Visual Studio.NET, VB.NET, ASP.NET, WinForm, WebForms, Visual Basic 6.0, MS XML Parser, SOAP, Crystal Reports, MS SQL Server, Oracle, VC++, VB Script, Syncr- VSS, Source of Site and Visual Source Safe for version control.
MS Project for time tracking.
Benjamin (http://benjamin.scala.se/) - for tracking bugs and features.
MS Office, Rational Rose diagrams – for documentation purposes.

Responsibilities: Migration of legacy VB6 application into new .NET application. Reports development, XML services development for ERP (Enterprise Resource Planning) system. Retail sales, Warehousing, and Accounting modules development.

Achievements:
- Converted existing VB6 application into VB.NET application.
- Developed WinForms (VB.NET).
- Developed WebForms (ASP.NET).
- Implemented business logic (VB.NET).
- Created and modified SQL-queries.
- Developed several XML services for iScala (see: http://www.scala.net/scalasap/scalasap.asp):
- Created XSD, XDR schemas and XML samples. (Used XML Spy http://www.xmlspy.com/).
- Created XSLT transformations. Used Xselerator http://www.vbxml.com/xselerator/.
- Created business reports (Crystal Reports).
- Created and maintained tools for development process:
- Universal AutoTest program for testing iScala XML-services.
- Wrote documentation for AutoTest program.
- XML validator – allows quick checking is XML document valid or not.
- XML service registrator – copies all necessary components of specified XML service on tester’s computer and registers them under COM+ server.
- Created and modified type libraries (*.idl, *.tlb).
- Designed Work Flow diagrams for iScala.
October 2001 - April 2002: System analyst/Software developer, Egar Technology Corporation

http://www.egartech.com/
Tools & Technologies: MS SQL 2000, VB 6.0, Data Environment, ADO, Far Point Spread 2.5 (data grid), Crystal Reports 8.0, VSS 6.0, Visual InterDev 6.0, ASP, Rational ClearQuest and MS Outlook.

Responsibilities:
Development of the Collateral module for financial system. Data Modeling. ER-diagrams (ERwin).
Full Application consists of more than 300 database tables, 200 views, 500 stored procedures, 1000 VB-forms and modules

Achievements:
- Developed Back End of the Collateral module (tables, constraints, views and stored procedures).
- Developed VB user interface (Designed client forms and wrote VB-code).
- Created various financial reports (Crystal Reports 8.0).
- Developed Web interface (ASP).
- Wrote SQL-script for database deployment on customer computer.
- Used Rational ClearQuest to track defects and change requests.
- Used Visual InterDev for DB-scripts (SP and view) handle and version tracking and control via VSS.
November 2000 – September 2001: Software developer, Granat International Inc., Cleveland, OH

http://www.granatinternational.com/
Tools & Technologies:
VB 6.0, MTS, Visual Source Safe 6.0, InterDev, IIS, ADO, MS SQL 7.0 (MS SQL Query Analyzer, MS SQL Enterprise manager), Microsoft Transaction Server 2.0, Crystal Reports 8.0, VB-script (MS-Word 2000), Windows 2000.

Project: Loan Inventory Control System. Migration from Clipper to VB6.
Application consists of more than 200 forms and reports. It is 3-tier application.

Responsibilities:
The task was complete transferring the business logic from the existing file-server application (AS400, Clipper) to the Windows 3-tier architecture. Customer is the “Leader Mortgage” co., USA, OH (http://www.mortgagemag.com/guide/c008/c008630.htm).

Achievements:
- Investigated behavior of DOS-application and its source code (Clipper).
- Created DTS-package for conversion *.dbf into MS SQL database.
- Developed SQL-queries and business logic (COM+ components).
- Created reports (Crystal Reports 8) and forms for view and update database information.
- Developed VB-script (MS Word 2000), which helps to convert large fragments of clipper source code to VB code.
- Developed VB-script (MS Word 2000), which helps to convert large fragments of clipper source code to VB code.
- Developed Web interface (ASP).
Certification

Microsoft

http://www.microsoft.com/learning/mcp/transcripts
Transcript ID: 663106
Access Code: dennisgorelik
- 070-320 exam (Developing XML Web Services and Server Components with Microsoft Visual C#.NET and the Microsoft .NET Framework).
Score: 981.
- 080-316 exam (Developing and Implementing Windows-based Applications with Microsoft Visual C#.NET and Microsoft Visual Studio.NET).
Score: 917.
- 080-315 exam (Developing and Implementing Web Applications with Microsoft Visual C#.NET and Microsoft Visual Studio.NET).
Score: 916.
Brainbench

- 2004 Brainbench certification ASP.NET.
- 2004 Brainbench certification C#.NET.
- 2004 Brainbench certification VB.NET.
http://www.dennisgorelik.com/resume/BrainbenchNetCertification.htm
- 2000 Brainbench certification in MS SQL 7.0.
- 2000 Brainbench certification in VB 6.0.
- 2000 Brainbench certification in Active Server Pages (ASP).
- 2000 Brainbench certification in MS Visual Interdev 6.0.
Education

1997 - 2000 MS degree in Economic and Management. South-Ural State University, Chelyabinsk, Russia.
1991 - 1997 MS degree in Automatic Control Systems. Chelyabinsk State Technical University, Chelyabinsk, Russia.
Personal

Excellent analytical, problem solving, technical, interpersonal and communication skills with a strong entrepreneurial drive.
References

Wurzburg

Keywords
ASP.NET, C#, SQL, MS SQL Server, Microsoft SQL Server, Visual Basic, VB, JavaScript, JQuery, Microsoft developer, Microsoft technologies, Visual Studio 6.0, Visual Studio.NET, VC++, XML, MS XML Parser, XML services, XML Web Services, SOAP, EDI (Electronic Data Interchange), BizTalk, XSLT, XPath, XSD schemas, XDR schemas, OAGIS, Active Server Pages, ASPX, Visual InterDev, Visual Source Safe, VSS, VSS 6.0d, IIS, Internet Information Server, MS Office, Microsoft Office, Perl, Microsoft Access, Microsoft Word VBA, Microsoft Excel VBA, Outlook VBA, Windows 2000, Windows XP, Windows NT, Windows 98, Windows 95, Object Orienting Programming, OOP, Component Object Model, COM, COM+ Server, MTS Server, RDBMS, UML, Rational Rose, Rational ClearQuest, Crystal Reports 9.0, MSDN Library, AS400, XML Spy, ERP, Microsoft Office VBA, Microsoft Query Analyzer, Microsoft Enterprise Manager, Profiler, XSelerator, OAGIS, *.idl, *.tlb, mIDL, DLL, VB6, VB.NET, ASP.NET, User controls, Server Controls, Portlets, Repeater, DataList, DataGrid, Components, ActiveX controls, ADO, OLE DB, MS Project, MS Visio, Work Flow diagrams, The Far manager, The Bat, Grid, True DB grid, FarPoint Spread, MSN, ICQ, Email, VB script, Java script, HTML, DHTML, programmer, data modeling, ER-diagrams, Erwin, Database technologies, Database developer, System Analyst, DBA, stored procedures, SP, Views, Triggers, MS IE, eCommerce, Microsoft Internet Explorer, MCAD, NTFS permissions check, Oracle 9.2, Toad VI, SQL Plus, ComponentArt TreeView, LLBLGet, RapTier codegenerator, mht, CDO, WCF, WPF.

Willing to relocate to: Tampa, FL; Saint Petersburg, FL; Orlando, FL; Jacksonville, FL; Miami, FL; Atlanta, GA; Dallas, TX; Houston, TX; Austin, TX; San Antonio, TX; Raleigh, NC; Memphis, TN; Chattanooga, TN; Nashville, TN, Phoenix, AZ; Kansas, KS; San Diego, CA; San Francisco, CA; Oakland, CA, Los Angeles, CA; Orange County, CA; SC; AL; LA; CO; AR; MS; NM; OK and some other warm places.

Extreme intellisense

2010-04-13T13:47:00.002-04:00

Scott Guthrie's team is working on technology that allows to build intellisense based on executing underlying JavaScript code.
It's not available in Visual Studio yet, but looks like it would be available soon.

Cast from float to double error

2010-04-11T22:49:00.003-04:00

I was surprised to find out that this line of code fails:


    Assert.AreEqual(0.1d, (double)0.1f);

(double)0.1f is actually the same as ... drumbeat ... 0.100000001490116

Why does it happen?
Because float and double do NOT represent fractions precisely.
Rounding is always going on.

How to deal with this?
There are several options:
1) Round double after converting float number into it.
For example:


    float f = 0.1f;
    double d = Math.Round(f, 8);

would assign 0.1d to d.

2) Don't use float/Single and use double only.


    double d = 0.1;

would assign exactly 0.1d to d.

3) Use decimal or bigdecimal if you are dealing with money.


    decimal m = 0.1m

Hope it helps.

ASP.NET: MVC Framework vs Web Forms Framework

2010-01-23T21:15:00.008-05:00

It looks like "MVC vs Web Forms" debate heats up.

Here's my take on it:
1) Last time I checked, MVC required 50+% overhead (relative to Web Forms) in terms of the amount of code required to implement the same functionality.
Was that fundamental problem fixed yet?

Let's consider an example of business requirements:
Create a page that allows user enter text, click "Save" button, and then call existing business layer method BusinessLayer.Save().
With Web Forms approach it would take:
- 1 line of ASPX code for textbox
- 1 line of ASPX code for Save button (including Save_Click() call).
- 3 lines of code-behind:
void Save_Click() {
BusinessLayer.Save(Input.Text);
}
Total: 5 lines of code.

How many lines of code that task would get in MVC?

2) Now about why it's important to minimize number of lines of code:
Lines of code is the best available metric of project complexity.
Yes I know that different lines have different complexity attached to it, but by default I assume that complexity of Web Forms’ line is about the same as complexity of MVC's line of code.

3) Many developers say that it's good to know MVC even if you don't use it (just to be familiar with available options to be ready to jump on it).
I agree. Sort of.
The trick is to know what to learn. There are so many technologies out there so it's not possible to learn them all.
How do I know that MVC would have good return on my time invested?
I don't know it yet. Many developers are passionate about MVC, but relying just on buzz around new technology methodology is too risky: for example, RUP (Rational Unified Process) is nowhere now after all that buzz 10 years ago. Learning it (aside of the most basic concepts) would be mostly waste of time.
And lines of code overhead really kills my enthusiasm about MVC.

I'm open to change my mind though. Especially considering that MVC is getting more mature every year.

See also: Scott Guthrie chimed in with great "About Technical Debate" post and even better follow up comments about advantages of Web Forms vs Advantages of MVC Framework

-

Unable to obtain public key for StrongNameKeyPair

2009-09-26T22:24:00.003-04:00

You are using Visual Studio 2008 (SP1 or not -- doesn't matter).
You have test project that is signed with strong key and that strong key has a password on it.
You are trying to create a unit test for private method and are trying to create accessor.
You have an error like that:
"Creation of the private accessor for Xyz failed"

You have that error because you excluded "Test References" folder and YourProject.accessor file from your test project.

The reason why you excluded YourProject.accessor file from your project is that you were getting a compilation error:
"Unable to obtain public key for StrongNameKeyPair".

The reason why you are getting that error is that VS 2008 SP1 and even VS 2010 Beta 1 have a bug.

Workaround for that bug is to turn off strong key signing on your test project.

Read more here:
Unable to obtain public key for StrongNameKeyPair

SQL_Latin1_General_Cp850_BIN

2009-05-29T15:49:00.005-04:00

While working on Auto-Moderator for PostJobFree.com I encountered the following problem: my C# code considered ‘3’ and ‘３’ as different words, but SQL Server considered them the same.
That expressed itself in the following error:

Cannot insert duplicate key row in object 'dbo.Word' with unique index 'IX_Word'.

That was a little bit surprising, considering that I defined Word as Unicode column (nvarchar).

While searching for the solution, my first thought was to make 'IX_Word' index not unique. That worked, but would have introduced other problems with spam filtering business logic down the road.

The solution should have been about making SQL Server to compare strings exactly the same way C# code does.

I started to look into SQL Server Collations, and finally found the solution: use SQL_Latin1_General_Cp850_BIN collation.

Basically the solution is about to declaring 'Word' column with SQL_Latin1_General_Cp850_BIN collation:

Create Table Word(
 WordId bigint identity(1,1) not null,
 Word nvarchar(50) COLLATE SQL_Latin1_General_Cp850_BIN not null,
 JobPostCount int not null DEFAULT 0,
 JobLogSpamCount int not null DEFAULT 0,
 CreateDate datetime not null,
 UpdateDate datetime not null,
 CONSTRAINT PK_Word Primary Key Clustered
 (
  WordId ASC
 )
)
GO

Create Unique Index IX_Word ON Word
(
 Word
)
GO

Possible drawbacks of the solution: using SQL_Latin1_General_Cp850_BIN collation may cause weird sorting in SQL queries, but sorting collation can be easily redefined like this:

select * from Word
order by Word COLLATE SQL_Latin1_General_CP1_CI_AS

Moreover, the sorting it provided by binary collation (SQL_Latin1_General_Cp850_BIN) looks quite reasonable.

You may also use SQL_Latin1_General_Cp850_BIN2 collation for better sorting.

Here’s SQL sample to you to play with:

--drop table t;
select N'３' as Word
into t;

insert into t
select '3' as Word;

select * from t
where Word = N'3';

select * from t
where Word = N'３' 

select * from t
where Word = N'3' collate SQL_Latin1_General_Cp850_BIN;

select * from t
where Word = N'３' collate SQL_Latin1_General_Cp850_BIN

Enjoy!

web.config in IIS 7.0

2009-04-05T17:30:00.003-04:00

IIS 7.0 treats Web Application differently from how IIS 6.0 treats Virtual Directory connected to Application pool.
The difference is in how web.config properties are inherited from parent application.
If Virtual Directory in IIS 6.0 is physically located outside of parent web application, then web.config properties are not inherited. Even if logically Virtual Directory is inside parent web application.
So, even if from end user URL looks like this:
http://www.parentwebapp.com/virtualdirectory -- virtualdirectory web app does not inherit web.config properties from parentwebapp.com

IIS 7.0 is smarter than IIS 6.0.
Even if parentwebapp.com and virtualdirectory from above example are mapped to different physical folders like this:
http://www.parentwebapp.com/ -- c:\parentwebapp
http://www.parentwebapp.com/virtualdirectory/ -- c:\virtualdirectory

IIS 7.0 still recognizes that http://www.parentwebapp.com/virtualdirectory/ inherits all web.config settings from http://www.parentwebapp.com/

Such inheritance sometimes causes undesired effects.
For example, if you added HttpModules to parent web app code, but didn't add them to child virtual directory, you may end up with "Could not load type ..." run-time error.

In order to get rid of this error you need from inherited settings.
You can do it like this:


 <system.web>
  <httpModules>
   <remove name="DenyIpAddressModule"/>
  </httpModules>
 </system.web>
 <system.webServer>
  <pages theme="">
  <modules>
   <remove name="DenyIpAddressModule" />
  </modules>
 </system.webServer>

Note, that in this example I remove "DenyIpAddressModule" twice.
The reason for that is that I added "DenyIpAddressModule" module to parent web.config twice: once as regular httpmodule, and another time as integrated pipeline module.

Google Maps API team joke

2009-04-01T15:10:00.003-04:00

Google Maps API rolled out unpleasant joke on April 1st day.
Google Maps javascript stopped working today.

There is a quick fix available: switching back to older, more carefully tested version.
(from "v=2.x" to "v=2").

There is a good lesson here: don't use the latest "bleeding edge" version of the code in production environment. Even if it comes from Google.

Technical details are here:
http://groups.google.com/group/Google-Maps-API/browse_thread/thread/193fbebd8066f19f/7fecbfed5908d29e

Serialize and Deserialize objects in .NET

2009-03-03T12:36:00.007-05:00

I'm not sure why XML standard doesn't allow certain characters to be encoded into XML... and it causes problems.

This C# code:


            XmlSerializer xs = new XmlSerializer(typeof(T));
            using (MemoryStream memoryStream = new MemoryStream(StringToUTF8ByteArray(objString)))
            {
                obj = xs.Deserialize(memoryStream);
            }

crashes with exception:

System.InvalidOperationException: There is an error in XML document (1, 50). ---> System.Xml.XmlException: '', hexadecimal value 0x0C, is an invalid character. Line 1, position 50.

Here's the fix and the fully working version (note that XmlTextReader is used in between MemoryStream and XmlSerializer:


        [TestMethod()]
        public void SerializeDeserializeObjectTest()
        {
            SerializeDeserializeObjectTest("test");
            SerializeDeserializeObjectTest("\f");
        }

        private void SerializeDeserializeObjectTest(string input)
        {
            string serialized = Serializer.SerializeObject(input);
            string deserialized = Serializer.DeserializeObject<string>(serialized);
            Assert.AreEqual(input, deserialized, input);
        }


    public static class Serializer
    {
        public static string SerializeObject(Object obj)
        {
            MemoryStream memoryStream = new MemoryStream();
            XmlSerializer xs = new XmlSerializer(obj.GetType());
            XmlTextWriter xmlTextWriter = new XmlTextWriter(memoryStream, Encoding.UTF8);
            xs.Serialize(xmlTextWriter, obj);
            memoryStream = (MemoryStream)xmlTextWriter.BaseStream;
            return UTF8ByteArrayToString(memoryStream.ToArray());
        }

        public static T DeserializeObject<T>(string objString)
        {
            Object obj = null;
            XmlSerializer xs = new XmlSerializer(typeof(T));
            using (MemoryStream memoryStream = new MemoryStream(StringToUTF8ByteArray(objString)))
            {
                XmlTextReader xtr = new XmlTextReader(memoryStream);
                obj = xs.Deserialize(xtr);
            }
            return (T)obj;
        }

        private static string UTF8ByteArrayToString(byte[] characters)
        {
            UTF8Encoding encoding = new UTF8Encoding();
            return encoding.GetString(characters);
        }

        private static byte[] StringToUTF8ByteArray(string xmlString)
        {
            UTF8Encoding encoding = new UTF8Encoding();
            return encoding.GetBytes(xmlString);
        }

    }

Thanks to Tom Goff for XML Serialization Sorrows article.

Thanks to Andrew Gunn for XML Serialization in C# article.

Troubleshooting SqlCacheDependency in SQL Server 2008 and SQL Server 2005

2009-01-09T00:31:00.010-05:00

"Getting immediate notification from SQL Server when data changes" is a very attractive feature, but unfortunately it's not easy to implement.
(It took me full day to identify and fix all issues...).

SQL Server Query Notification framework is quite fragile and may not work for multiple reasons.
If you get error messages -- consider youself lucky. Sometimes there will be no error messages, but notifications simply would refuse to work.

There are two major steps in troubleshooting SqlCacheDependency notifications:
Step 1: Make SqlCacheDependency clean up ASP.NET Cache item.
Step 2: Prevent SqlCacheDependency from cleaning up ASP.NET Cache item when it's inapropriate.

Both steps are hard, but Step 1 is the hardest.

I strongly recommend iterative approach: implement the easiest possible solution first, and then make it more advanced one small step at a time. Test every little step.

Business context

In this example I use SqlCacheDependency in order to get list of blocked IP addresses on my web site PostJobFree.com.
From time to time I delete bad users and write their IP addresses into BlackListIpAddress table.

I can retrieve the list of recently blocked IP addresses like that:

CREATE Procedure spGetBlockedIpList
@cutDate datetime
AS

set nocount on
select IpAddress
from BlackListIpAddress with (nolock)
where (DecisionDate > @cutDate)
group by IpAddress
having count(1) > 1
GO

When anybody opens web page -- I check if current web page request came from that list of blocked IP addresses.
I created C# function that does that check:

public static bool IsBlackListed(string ipAddress)
{
bool cached;
if (GetBlockedIpAddresses(out cached).Contains(ipAddress)) return true;
return false;
}

Because I run IsBlackListed() on every page, I don't want to run spGetBlockedIpList without need.
So, I keep database results in ASP.NET Cache object and use SqlCacheDependency to clean up Cache object as soon as new IP address is blacklisted in BlackListIpAddress table.

Implementation

public static List GetBlockedIpAddresses(out bool cached)
{
HttpContext context = HttpContext.Current;
List blockedIPs = (List)context.Cache["BlockedIPAddresses"];
if (blockedIPs == null)
{
SqlCommand cmdDependency = new SqlCommand(@"select IpAddress from dbo.BlackListIpAddress where DecisionDate > @cutDate",
SqlUtilities.GetSqlConnection("PostJobFreeConnectionString"));
SqlUtilities.AddInputParameter(cmdDependency, "@cutDate", DateTime.UtcNow.AddMinutes(-1), SqlDbType.DateTime);
SqlCacheDependency dependency = new SqlCacheDependency(cmdDependency);
SqlUtilities.ExecuteNonQuery(cmdDependency, "PostJobFreeConnectionString");
blockedIPs = LoadBlockedIPsFromDatabase();
// Cache retrieved blockedIPs in ASP.NET Cache object:
context.Cache.Insert("BlockedIPAddresses", blockedIPs, dependency);
cached = false;
}
else
{
cached = true;
}
return blockedIPs;
}

Note, that almost always blockedIPs will be retrieved from ASP.NET Cache.
But if Cache["BlockedIPAddresses"] is empty -- I execute two SQL queries instead of one query.

I run simple query "select IpAddress from dbo.BlackListIpAddress where DecisionDate > @cutDate" in order to make SqlCacheDependency work.
I then run more complex query LoadBlockedIPsFromDatabase() (it runs spGetBlockedIpList) in order to get data I need.
spGetBlockedIpList is too complex to work with SqlCacheDependency.

Simple query is not smart enough to give me the data I need.

When you debug your own code -- dump more complex query and use only simple one.
Remember -- first step is to make SqlCacheDependency clean up ASP.NET Cache item.
If SqlCacheDependency cleans up your ASP.NET Cache -- you are about 70% done.

You may even start with even simpler SQL query. For example: "select IpAddress from dbo.BlackListIpAddress". You would polish it later.

Preparations

1) Make sure that when your Web Application start, you run SqlDependency.Start().
I do it this way:

public sealed class DenyIpAddressModule : IHttpModule
{
void IHttpModule.Init(HttpApplication application)
{
string connectionString = WebConfigurationManager.
ConnectionStrings["PostJobFreeConnectionString"].ConnectionString;
SqlDependency.Start(connectionString);
}
}

If you forget to do that, you would get "When using SqlDependency without providing an options value, SqlDependency.Start() must be called prior to execution of a command added to the SqlDependency instance." error message.

2) Enable Service Brocker on your database.
I do it like this in SQL Server Management Studio (SSMS):

use PostJobFree;
alter database PostJobFree set ENABLE_BROKER;

The trick here is to kill all existing connections prior to altering your database.
Use these SQL commands in SSMS:

sp_Who2
kill 52 -- or whatever SPID is

You may check your Service Broker setting like this:

use PostJobFree;
select is_broker_enabled from sys.databases where database_id=db_id()

1 - Enabled; 0 - Disabled (default).

3) Make sure that permissions in your database are not out of whack. SQL Server 2005 and SQL Server 2008 have unpleasant bug that [almost] silently kills Queue Notifications:
"You cannot run a statement or a module that includes the EXECUTE AS clause after you restore a database in SQL Server 2005" http://support.microsoft.com/kb/913423

I fixed it by running this command:

use PostJobFree
GO
sp_changedbowner [MyServerName\dennis]

You may check current database settings by this command:

sp_helpdb PostJobFree

Troubleshooting

1) If you are still unable to make SqlCacheDependency to invalidate your ASP.NET Cache, I recommend you great article "Using and Monitoring SQL 2005 Query Notification"
http://www.simple-talk.com/sql/sql-server-2005/using-and-monitoring-sql-2005-query-notification/
Sanchan explains how to use SQL Profiler to see what's going on with query notifications.
2) Using Profiler helped me to find the following errors in SQL Profiler:
- An exception occurred while enqueueing a message in the target queue. Error: 33009, State: 2. The database owner SID recorded in the master database differs from the database owner SID recorded in database 'PostJobFree'. You should correct this situation by resetting the owner of database 'PostJobFree' using the ALTER AUTHORIZATION statement.
- Cannot execute as the database principal because the principal "dbo" does not exist, this type of principal cannot be impersonated, or you do not have permission.
That gave me an idea to run:

sp_changedbowner [MyServerName\dennis]

3) These couple of queries would let you take a look at what active Query Notification Subscriptions you currently have:

select * from sys.dm_qn_subscriptions
select * from sys.transmission_queue

4) I didn't need that step, but while troubleshooting I did it anyway.
Grant these permissions to the user account that runs your web application (it's usually either "aspnet" or "NT AUTHORITY\NETWORK SERVICE").

use PostJobFree
GRANT CREATE PROCEDURE TO [MyServerName\aspnet]
GRANT CREATE QUEUE TO [MyServerName\aspnet]
GRANT CREATE SERVICE TO [MyServerName\aspnet]
GRANT SUBSCRIBE QUERY NOTIFICATIONS TO [MyServerName\aspnet]
GRANT SELECT ON OBJECT::dbo.BlackListIpAddress TO [MyServerName\aspnet]
GRANT SELECT ON OBJECT::dbo.T TO [MyServerName\aspnet]
GRANT RECEIVE ON QueryNotificationErrorsQueue TO [MyServerName\aspnet]
ALTER DATABASE PostJobFree SET TRUSTWORTHY ON

Clean up Cache only when needed

I assume that at this point you are done with the hardest part ("Make SqlCacheDependency object clean up Cache").
There is still some work ahead.
For example I noticed that my SqlCacheDependency code when I was playing with it -- always invalidated ASP.NET Cache. It didn't matter if I updated underlying BlackListIpAddress table or not.
By using trial & error approach I found that the problem was caused by using inapropriate version of SQL query.
I found that:
- "group by" doesn't work no matter what.
- "top 10" doesn't work.
- "with (nolock)" hint doesn't work.
- passing @cutDate parameter to the query _does_ work.

See documentation on SELECT statements that are supported by Query Notification: http://msdn.microsoft.com/en-us/library/ms181122(SQL.90).aspx

Other useful resources

1) More tips about SQL Server Query Notification:
http://rusanu.com/2006/06/17/the-mysterious-notification/

2) Troubleshooting Query Notifications
http://msdn.microsoft.com/en-us/library/ms177469.aspx

3) If you are lucky and expect everything to go smooth - use this articles:
SqlCacheDependency using ASP.NET 2.0 and SQL Server 2005
SQL 2005 and SQL2008 Enabling Notifications. SQL Chache Dependancy Part-I

Keywords:
ASP.NET 2.0, ASP.NET 3.5, C#

Cross Site Scripting and Cross Site Request Forgery

2008-09-24T11:09:00.001-04:00

Jeff Atwood wrote a good article explaining the danger of XSRF and XSS

1) I want to confirm that checking UrlReferrer [hoping to prevent XSRF attack] is a waste of time. UrlReferrer can be spoofed by malicious user. Such spoofing can be done by combination of XSS and XSRF attack: injecting javascript into HTML output (XSS) on one web page and producing forged request (XSRF) pointing to another page of the same web site.
Jeff is also correct that legitimate users may have empty UrlReferrer. Rejecting such users is a mistake.

2) I agree that introducing parameters cuts off the most obvious XSRF attacks.
But if one of your pages is XSS vulnerable (allows javascript injection), then even if you have dynamic parameters to prevent XSRF (on another page), javascript can still read these dynamic parameters and re-submit them, so the request would succeed.
That's how Gmail was hacked -- the hacker used XSS vulnerability on some obscure Google's web site site in order to exploit XSRF vulnerability in Gmail).

Cure for "deadlocked!": learning to use proper SQL hints

2008-08-25T11:20:00.002-04:00

Jeff Atwood's article Deadlocked! made me recall my painful experience with default locking settings in SQL Server.
Default select queries with (readcommitted) just don't work reliably in real life (because they cause deadlocks on regular basis).

It was hard to ignore scary stuff from SQL theoreticians about "dirty data", but eventually I've learned to use "with (nolock)" hint for most of my SELECT queries.
That doesn't mean that all queries should be written with nolock, but most of SQL queries should.
Especially if I'm writing web app.

In some situations I want to be sure that the data is consistent no matter what. In this case I use different locking hints. Which hints to use heavily depends on particular situation.

It's important to clearly understand what exactly locking does.
The locking model is relatively simple, however most of SQL Server locking tutorials are just terrible.

How-To learn SQL Server locking Tutorial

The best approach to learn about locking is to experiment:

1) Open three separate windows in SQL Management Studio.
Window One: for lock diagnostic sp_lock
Window Two: for pending transaction with Update/Delete/Insert query.
Window Three: for SELECT statements with different locking hints.

2) In Window One write and execute:
exec sp_lock
Take a look at the results.
Note what locks are there (these locks are generated by sp_lock itself).
Learn about what these locks mean (Google is your friend).

3) In Window Two (that's separate connection to SQL server) write and execute:
============
begin transaction
update MyTestTable set MyColumn = 1
-- rollback transaction
============
Note, that "rollback transaction" is commented out, so transaction won't complete.

4) Return back to Window One and execute sp_lock.
Note what additional locks you see in sp_lock results.

5) In Window Three execute:
select * from MyTestTable with (updlock)
The query won't complete, because it's locked by pending transaction in Window Two.

6) Switch to Window Two and cancel transaction by executing "rollback transaction"
Make sure that SELECT transaction in Window Three is completed now.

7) Try different combinations of locks (readcommitted), (nolock), (updlock), (repeatableread), (serializable), ... in Window Three.
Try other different update/insert/delete statements in Window Two.

8) Try to use "commit transaction" instead of "rollback transaction" in Window Two and see how it would affect SELECT results in Window Three.

9) Try to run:
begin transaction
select * from MyTestTable with (updlock)
in Window Two and:
select * from MyTestTable with (serializable)
in Window Three.

10) Keep monitoring locks using sp_Lock in Window One.

11) Do free-style experimenting and research problem on Google when you are getting unexpected results.

RackSpace - are they really the best web hosting?

2008-08-02T12:17:00.002-04:00

About a month ago I switched from Virtual Private Hosting on webhost4life to dedicated hosting on RackSpace.
It was definitely an improvement, but I'm still dissatisfied.

Here are painful parts of my experience with RackSpace:

1) RackSpace wanted me to sign paper contract (WebHost4Life didn't require that). That paperwork took almost a day (several hours of my efforts + some wait time). Sales guy couldn't open several versions of "Microsoft Office Image Writer" that I emailed to him, so I had to resend the document in different format.

2) It is a little unpleasant to deal with RackSpace sales guys. They forget (or "forget") to answer some of my questions; use some slightly unpleasant pushy sales techniques. Is it typical for any sales reps, not only RackSpace's sales?

3) After the contract was signed, it took RackSpace almost 4 days to install the server. I signed the contract Wednesday July 3rd 2008 and was hoping that on Saturday-Sunday night I'll be able to move my web site (www.postjobfree.com) to RackSpace. But RackSpace set up my server only on Monday - not convenient time for me and my users to do the move.

4) RackSpace promised me that they would help with the migration. They gave some tips, but not all of them were good. For example, they suggested me to shut down my web site for few hours while I will copy my database. Not a good approach for 24/7 service. So, basically I was mostly left on my own with the migration.
Fortunately, I used advise of Omar Al Zabir about smooth web hosting migration
Ironically -- it was Omar's recommendation to use RackSpace for web hosting that made me pick them.

5) Average response to my ticket requests is about few hours (2-3 may be?). Sometimes ticket response time is shorter; sometimes it's longer (up to a day or even more in some cases). It's an improvement in comparison with WebHost4Life, but is that really the best in hosting industry?

6) Most of the time responses are good, rarely great, and in some cases responses are incompetent :-(
For example, I asked RackSpace if it would be a good idea to run SMTP server on separate IP address (same physical machine). A RackSpace guy replied that it would be a good idea. So we did the switch. But it turned out that RackSpace cannot monitor ports on another IP addresses (only on primary IP address). So we updated SMTP server settings again to allow listen both IP addresses. That caused SMTP server to use primary IP address to send emails, but at this point smtp.postjobfree.com DNS record was pointing to second IP address, and this caused painful issues with spam filters on some servers. In the end we returned back to using primary IP for SMTP, but went through some pain because of incompetent advice.

7) RackSpace seems to be not really good in analyzing past problems. They simply ignored my request about digging into this incompetent SMTP advice. Nothing like "sorry, we screwed up and would do this and that to prevent it in the future". Nothing like "sorry, it was misunderstanding and you (me) should do this and that to avoid problems in the future". I would understand if cheap hosting provider would skip such "past failure analysis". But if hosting provider claims "fanatical support" - I expect to do a little better.
Well, may be it happenned because I still didn't have a chance to talk with my account manager. RackSpace doesn't have one for me yet (after being with RackSpace for a month):

8) Rackspace's ticketing system creates unneeded noise. For example, after I create a ticket on my.rackspace.com, it adds meaningless auto-response to the ticket and sends me notification email. If I update a ticket, I get notification email again. Why would I need notification about ticket updates I made myself? That's distracting.

9) Maintenance downtime. :-(
I mentioned already that RackSpace considered few hours web site downtime during migration as "ok" practice. That attitude goes toward other maintenance things too. Today they installed hardware firewall on my server. They brought down my server for almost an hour (!). Could anybody explain me why installation of hardware firewall should bring server down for almost an hour? It should be less than a minute downtime, or preferably zero downtime. That was disappointing. I managed to migrate web server from different hosting with no downtime (I copied 4 GB database between WebHost4Life and RackSpace and still managed to avoid downtime) and now trivial installation of hardware firewall caused almost an hour downtime:

10) The hardware firewall installation caused another issue as well -- my web site was not able to send out emails after the firewall installation. RackSpace didn't notice that, because their SMTP port monitoring didn't catch the issue. We noticed it few hours later and reported in a ticket. We got no reply for couple of hours, so I had to call RackSpace and remind that the issue is still there. They were not very good in pinpointing the issue. They were trying to re-test SMTP server and it worked. So we (at PostJobFree) had to find it out the problem ourselves. The problem was that smtp.postjobfree.com could be pinged from every computer, but not from my server itself, because hardware firewall didn't resolve the request from my server back to the server itself.
RackSpace techies couldn't grasp that for a while even after I pointed them into that direction. Eventually they recommended to update my application and made it use my new 192.168.x.x IP address for sending emails. Imagine that: update and redeploy my application web app to accommodate to hardware changes. And do it in the hurry after(!) hardware firewall is installed.
I suggested better solution: simply add one record to C:\WINDOWS\system32\drivers\etc\hosts:
127.0.0.1 smtp.postjobfree.com
RackSpace techies still cannot grasp that solution and comment on it. Fortunately my solution works so far.

11) There were few other minor issues, but I think my saga is getting too long already.

On the bright side:

1) When my server works (and it usually works) it works really fast. I'm happy with the speed so far. Though I'm not sure if I should attribute it to RackSpace or to dedicated server. With WebHost4Life SQL server was shared with 4 other clients and in the end I was getting 50+ timeouts/day.

2) Some RackSpace folks taught me some useful stuff, for example about DNS [re-]configuration.

3) RackSpace is expensive, but it's not THAT expensive. I got my server + SQL Server license + hardware firewall for a little over $600/mo (with 1 year contract)

So, what do you think, is it typical to have issues like these with any hosting provider, or there are better hosting providers out there?

Any other comments?

Update (2008 August 03):
Problems with RackSpace are getting worse.

RackSpace technician configured my SMTP server as open relay
:-(

That's how it sounded on the ticket:
"We did find a setting in your SMTP that was set incorrectly, and we corrected that."

In fact, SMTP server was configured properly and the problem was with DNS configuration. Instead of fixing DNS (after installing Hardware Firewall) RackSpace guys made the problems much worse by turning my SMTP server into spam-machine and enabling prompt access to all spammers through newly installed hardware firewall.

Crazy stuff.

TechCrunch pushes Start-ups to fail

2008-04-03T19:18:00.001-04:00

If you want to announce your start-up on TechCrunch50 the only thing you need to do is to ~~sell your soul to the Devil~~ deny your prospective customers access to your web site. Here's the quote:

Rules of participation in TechCrunch50
Until its presentation on stage at the conference, a company will keep its site password protected with limited private access to alpha or beta users for testing purposes.

That means that you have to decrease your popularity, get less testing and less feedback, get less word of mouth, and ultimately get less revenue.

On the other hand, your participation in TechCrunch50 would be free.

Free is good, isn't it?

Encrypt App.config

2008-03-26T19:51:00.000-04:00

// Run "Encryption.EncryptConnectionStrings();" in the beginning of your winservice or winforms app.
// You need to add .NET reference to System.configuration.dll
using System.Configuration;
public static class Encryption
{
public static void EncryptConnectionStrings()
{
Configuration configuration = ConfigurationManager.OpenExeConfiguration(ConfigurationUserLevel.None);
ConfigurationSection section = configuration.GetSection("connectionStrings");
if (!section.SectionInformation.IsProtected)
{
section.SectionInformation.ProtectSection("DataProtectionConfigurationProvider");
section.SectionInformation.ForceSave = true;
configuration.Save(ConfigurationSaveMode.Modified);
}
}

public static void DecryptConnectionStrings()
{
Configuration configuration = ConfigurationManager.OpenExeConfiguration(ConfigurationUserLevel.None);
ConfigurationSection section = configuration.GetSection("connectionStrings");
if (section.SectionInformation.IsProtected)
{
section.SectionInformation.UnprotectSection();
section.SectionInformation.ForceSave = true;
configuration.Save(ConfigurationSaveMode.Modified);
}
}
}

How to encrypt and decrypt string in .NET application

2008-03-26T19:48:00.001-04:00

using System;
using System.IO;
using System.Security.Cryptography;
using System.Text;

namespace MyCompany.Library
{
public class Encryption
{
public static string EncryptString(string valueToEncrypt)
{
return EncryptString(valueToEncrypt, "My password key");
}

public static string DecryptString(string valueToDecrypt)
{
return DecryptString(valueToDecrypt, "My password key");
}

public static string EncryptString(string valueToEncrypt, string secretPhrase)
{
CryptoStream encryptStream = null; // Stream used to encrypt
RijndaelManaged rijndael = null; // Rijndael provider
ICryptoTransform rijndaelEncrypt = null; // Encrypting object
MemoryStream memStream = new MemoryStream(); // Stream to contain data
byte[] key;
byte[] IV;
GenerateKey(secretPhrase, out key, out IV);
try
{
if( valueToEncrypt.Length > 0 )
{
// Create the crypto objects
rijndael = new RijndaelManaged();
rijndael.Key = key;
rijndael.IV = IV;
rijndaelEncrypt = rijndael.CreateEncryptor();
encryptStream = new CryptoStream(
memStream, rijndaelEncrypt, CryptoStreamMode.Write);

// Write the encrypted value into memory
byte[] input = Encoding.UTF8.GetBytes(valueToEncrypt);
encryptStream.Write(input, 0, input.Length);
encryptStream.FlushFinalBlock();

// Retrieve the encrypted value and return it
return Convert.ToBase64String(memStream.ToArray());
}
else
{
return "";
}
}
finally
{
if (rijndael != null) rijndael.Clear();
if (rijndaelEncrypt != null) rijndaelEncrypt.Dispose();
if (memStream != null) memStream.Close();
}
}

public static string DecryptString(string valueToDecrypt, string secretPhrase)
{
CryptoStream decryptStream = null; // Stream used to decrypt
RijndaelManaged rijndael = null; // Rijndael provider
ICryptoTransform rijndaelDecrypt = null; // decrypting object
MemoryStream memStream = null; // Stream to contain data
byte[] key;
byte[] IV;
GenerateKey(secretPhrase, out key, out IV);
try
{
if( valueToDecrypt.Length > 0 )
{
// Create the crypto objects
rijndael = new RijndaelManaged();
rijndael.Key = key;
rijndael.IV = IV;

//Now decrypt the previously encrypted message using the decryptor
// obtained in the above step.

// Write the encrypted value into memory
byte[] encrypted = Convert.FromBase64String(valueToDecrypt);
memStream = new MemoryStream(encrypted);

rijndaelDecrypt = rijndael.CreateDecryptor();
decryptStream = new CryptoStream(memStream, rijndaelDecrypt, CryptoStreamMode.Read);

byte[] fromEncrypt = new byte[encrypted.Length];

//Read the data out of the crypto stream.
decryptStream.Read(fromEncrypt, 0, fromEncrypt.Length);

// Retrieve the encrypted value and return it
string decryptedString = new string(Encoding.UTF8.GetChars(fromEncrypt));
return decryptedString.TrimEnd(new char[] {'\0'});
}
else
{
return "";
}
}
finally
{
if (rijndael != null) rijndael.Clear();
if (rijndaelDecrypt != null) rijndaelDecrypt.Dispose();
if (memStream != null) memStream.Close();
}
}

/// Generates an encryption key based on the given phrase. The
/// phrase is hashed to create a unique 32 character (256-bit)
/// value, of which 24 characters (192 bit) are used for the
/// key and the remaining 8 are used for the initialization vector (IV).
private static void GenerateKey(string secretPhrase, out byte[] key, out byte[] IV)
{
// Initialize internal values
key = new byte[24];
IV = new byte[16];

// Perform a hash operation using the phrase. This will
// generate a unique 32 character value to be used as the key.
byte[] bytePhrase = Encoding.ASCII.GetBytes(secretPhrase);
SHA384Managed sha384 = new SHA384Managed();
sha384.ComputeHash(bytePhrase);
byte[] result = sha384.Hash;

// Transfer the first 24 characters of the hashed value to the key
// and the remaining 8 characters to the intialization vector.
for (int index=0; index<24; index++) key[index] = result[index];
for (int index=24; index<40; index++) IV[index-24] = result[index];
}
}
}

Generate Sequential GUIDs for SQL Server 2005 in C#

2008-03-11T00:00:00.000-04:00

Why generate sequential GUID in C#?

Originally, uniqueidentifier (GUID) column in SQL Server was not supposed to be sequential. But in my case, having sequential GUID is quite useful.
My application needs to know, what record was inserted first.

Fortunately, SQL Server 2005 supports "default newsequentialid()" constraint, that makes uniqueidentifier column grow sequentially [with every inserted record].

That worked quite well for me, until I decided to generate sequential GUID in C#.
(I needed it, because I use SqlBulkCopy and try to save two tables that share the same generated GUID key).

That turned out to be a tricky task. The reason -- .NET and SQL Server treat GUIDs quite different. In particular, they sort them quite differently.

Searching for solution

Alberto Ferrari's post How are GUIDs sorted by SQL Server? gave me a good idea about how to handle the problem.

I used modified Alberto's SQL code to find out what C#.NET GUID bytes are more [or less] significant from SQL Server 2005 ORDER BY clause perspective.

With UIDs As (
Select ID = 3, UID = cast ('01000000-0000-0000-0000-000000000000' as uniqueidentifier)
Union Select ID = 2, UID = cast ('00010000-0000-0000-0000-000000000000' as uniqueidentifier)
Union Select ID = 1, UID = cast ('00000100-0000-0000-0000-000000000000' as uniqueidentifier)
Union Select ID = 0, UID = cast ('00000001-0000-0000-0000-000000000000' as uniqueidentifier)
Union Select ID = 5, UID = cast ('00000000-0100-0000-0000-000000000000' as uniqueidentifier)
Union Select ID = 4, UID = cast ('00000000-0001-0000-0000-000000000000' as uniqueidentifier)
Union Select ID = 7, UID = cast ('00000000-0000-0100-0000-000000000000' as uniqueidentifier)
Union Select ID = 6, UID = cast ('00000000-0000-0001-0000-000000000000' as uniqueidentifier)
Union Select ID = 8, UID = cast ('00000000-0000-0000-0100-000000000000' as uniqueidentifier)
Union Select ID = 9, UID = cast ('00000000-0000-0000-0001-000000000000' as uniqueidentifier)
Union Select ID = 10, UID = cast ('00000000-0000-0000-0000-010000000000' as uniqueidentifier)
Union Select ID = 11, UID = cast ('00000000-0000-0000-0000-000100000000' as uniqueidentifier)
Union Select ID = 12, UID = cast ('00000000-0000-0000-0000-000001000000' as uniqueidentifier)
Union Select ID = 13, UID = cast ('00000000-0000-0000-0000-000000010000' as uniqueidentifier)
Union Select ID = 14, UID = cast ('00000000-0000-0000-0000-000000000100' as uniqueidentifier)
Union Select ID = 15, UID = cast ('00000000-0000-0000-0000-000000000001' as uniqueidentifier)
)
Select * From UIDs Order By UID

Note, that first line with ID=3 corresponds to:
new Guid(new bytes[16]{ 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }
That means:
(new Guid("01000000-0000-0000-0000-000000000000").ToByteArray()[3] == 1)

Now, when I run modified Alberto's query, I'm getting the following sequence:
3, 2, 1, 0, 5, 4, 7, 6, 9, 8, 15, 14, 13, 12, 11, 10

That means, that GUID's byte #3 is the least significant and GUID's byte #10 is the most significant [from SQL Server ORDER BY clause perspective].

Final solution

Now we're ready to write C# code, that would sequentially increment any given GUID.
I also made it more convenient to increment GUID, by using "++" operator.
Here's how it's used:

private void Test()
{
SequentialGuid = new SequentialGuid(Guid.Empty);
SequentialGuid++;
}

and C# code that increments GUIDs sequentially:

public class SequentialGuid
{
Guid _CurrentGuid;
public Guid CurrentGuid
{
get { return _CurrentGuid; }
}

public SequentialGuid()
{
_CurrentGuid = Guid.NewGuid();
}

public SequentialGuid(Guid previousGuid)
{
_CurrentGuid = previousGuid;
}

public static SequentialGuid operator ++(SequentialGuid sequentialGuid)
{
byte[] bytes = sequentialGuid._CurrentGuid.ToByteArray();
for (int mapIndex = 0; mapIndex < 16; mapIndex++)
{
int bytesIndex = SqlOrderMap[mapIndex];
bytes[bytesIndex]++;
if (bytes[bytesIndex] != 0)
{
break; // No need to increment more significant bytes
}
}
sequentialGuid._CurrentGuid = new Guid(bytes);
return sequentialGuid;
}

private static int[] _SqlOrderMap = null;
private static int[] SqlOrderMap
{
get
{
if (_SqlOrderMap == null)
{
_SqlOrderMap = new int[16] { 3, 2, 1, 0, 5, 4, 7, 6, 9, 8, 15, 14, 13, 12, 11, 10 };
// 3 - the least significant byte in Guid ByteArray [for SQL Server ORDER BY clause]
// 10 - the most significant byte in Guid ByteArray [for SQL Server ORDERY BY clause]
}
return _SqlOrderMap;
}
}
}

SqlBulkCopy in CLR SQL Stored Procedure

2008-01-10T19:49:00.000-05:00

When I was trying to run SqlBulkCopy in CLR (C#) SQL Stored Procedure, I've got at exception:

System.InvalidOperationException: The requested operation is not available on the context connection.
System.InvalidOperationException:
at System.Data.SqlClient.SqlBulkCopy.CreateOrValidateConnection(String method)
at System.Data.SqlClient.SqlBulkCopy.WriteRowSourceToServer(Int32 columnCount)
at System.Data.SqlClient.SqlBulkCopy.WriteToServer(DataTable table, DataRowState rowState)
at System.Data.SqlClient.SqlBulkCopy.WriteToServer(DataTable table)

It seems that it's impossible to run SqlBulkCopy within "context connection" ...

Here's the only tip I was able to find:

http://www.sqlmonster.com/Uwe/Forum.aspx/sql-server-clr/9/SqlBulkInsert

> Does SqlBulkInsert not run in CLR? Why does not?

Nope. It (BulkInsert) uses a different provider library if I'm understanding
things correctly.

Not much ... I guess CLR Stored Procedures work fast enough already...

Batch Update doesn't work in CLR Stored Procedures [on context connection] either.

When I tried to execute this code:

SqlDataAdapter da = new SqlDataAdapter();
cmd.UpdatedRowSource = UpdateRowSource.None;
da.UpdateCommand = cmd;
da.UpdateBatchSize = 1000;
da.Update(table);

I got this exception:

"Batching updates is not supported on the context connection."

Note the grammar: "... updates IS not supported ..."

It seems that nobody really cares about batch functionality in CLR SP.

What do you think? Please, let me know.

Let's count errors

2007-12-14T16:46:00.000-05:00

Did you count how many mistakes developers of http://www.pepperidgefarm.com/ProductDetail.aspx?catID=730 page made?
I found 4:
1) No custom error page.
2) They compiled and deployed ASP.NET project in Debug mode (had to deploy in Release mode).
3) They didn't set error notification by email and don't look into production error log. That's why this errors is hanging there for so long.
4) ProductDetail.aspx page cannot handle missing item.

Do they have any excuse for that?

Web site in production

2007-08-13T23:19:00.001-04:00

Omar Al Zabir wrote great article about his experience dealing with web site production issues:
13 disasters for production web sites and their solutions

Web site in production

2007-08-13T23:19:00.000-04:00

Omar Al Zabir has great article about his experience dealing with web site production issues:
13 disasters for production web sites and their solutions

Why Common Bus projects fail

2007-06-09T17:35:00.000-04:00

What is "Common Bus" project?

"Common Bus" project is such project which does not implement business requirements directly, but helps other projects to implement business requirements.

Examples of "Common Bus" projects:
1) Programming language.
2) Development environment.
3) Database management system (like Oracle or SQL Server).
4) COM (Component Object Model).

Reasons why Common Bus projects usually fail

1) Common Bus project is more abstract than regular projects.
More abstract means more complex.

2) When you design Common Bus project, you must not just understand Common Bus project itself, but also design or all business projects consuming Common Bus project.

3) It's harder to test abstract projects, because such projects don't have clear goals.

For example:
What are the goals of Development Environment project?
How would you test it?

It's hard to come up with test cases for "Common Bus" projects.

4) Because Common Bus project is hard to understand, development can easily go into wrong direction for months or even years unnoticed. That drains money from the budget and eats time.

Can Common Bus project be successful?

Implementing "Common bus" projects is possible, but it requires the following:
1) Very bright business analysts.
2) Very strong developers and architects.
3) Very strong testers.
4) Experience with developing similar "Common Bus" projects.
Note, that custom software development is considerably different from "Common Bus" software development.

I got Common Bus project. What do I do?

What to do if you are not good enough for "Common Bus" project, but
you have to do it anyway:
1) Simplify business requirements as much as possible.
2) Drop all "Common Bus" / "Abstract" requirements unless they are absolutely vital for your customer.
3) Build clear plan of how you are going to test your project.
Every test case must be easy to understand and test.
If you cannot come up with the set of clear test cases for your project -- that's quite reliable sign that your project is doomed. Find another project and cancel your Common Bus project ASAP.

Receive and parse email in .NET

2007-05-10T23:45:00.000-04:00

How to: Receive email through pop3 and parse mime message into From, To, Subject and Body parts

This task is not as trivial as it seemed to be.
Reasons:
1) .NET framework does not have classes which handle POP3
2) Email is sent in MIME format, which is quite tricky. In particular, email can have recursive attachments embedded into raw MIME email.

So far my research recommends two approaches:

Approach 1: Use an open source project.

It seems that the best open source MIME project is
LumiSoft .NET MIME parser.
You may browse all content here
Lumisoft Forum

Pop3 client retrieval & parsing sample
using(POP3_Client c = new POP3_Client()){
c.Connect("ivx",110);
c.Authenticate("test","test",true);

POP3_MessagesInfo mInf = c.GetMessagesInfo();

// Get first message if there is any
if(mInf.Count > 0){
byte[] messageData = c.GetMessage(mInf[0]);

// Parse message
Mime m = Mime.Parse(messageData);
string from = m.MainEntity.From;
string subject = m.MainEntity.Subject;
// ...
}
}

Approach 2: Buy a component

It seems that the best .NET Mime component available on the market so far is:
MIME4NET "True .Net Mime Parser".
The cost: $50

This report requires a default or user-defined value for the report parameter

2007-03-06T20:48:00.000-05:00

I just spent couple of hours fighting "This report requires a default or user-defined value for the report parameter" error.
Report worked fine in report designer, but refused to properly render in serverReport.Render(...) method.

I tried Google Search and all voodoo magic, including:
- Renaming my parameter;
- Set default value for my parameter;
- Restarting VS.NET;
- Re-creating my report from scratch.
Nothing helped.
I even though about manual rebuilding OLAP cube in Analysis Server ...

But then I simply changed "Available values" [for my parameter] from "From query" to "Non-queried".

That helped.

Enjoy!
:-)

Keywords: VS 2005, VS2005, Visual Studio .NET 2005, OLAP, Microsoft Reporting Services, Microsoft Analysis Services, Microsoft SQL Server 2005, C#, VB.NET.

Google Desktop can be hacked

2007-02-23T00:39:00.000-05:00

This very interesting article explains in details how cross site scripting can be used to hack google desktop (if new version of Google desktop in not installed yet):
Overtaking-Google-Desktop.pdf

This demo shows how potential hacker can operate:
Demonstration of Google Desktop vulnerability

The article is pretty impressive and made me think about XSS vulnerability of my own postjobfree.com web site.

Keywords: XSS, Web site security, javascript, hacker attack, XSS, RegEx, hack, Google Desktop.

Geeks Rule and MBAs

2007-02-22T19:40:00.000-05:00

Eric Sink (SourceGear) recommends to start software company with developers only.
====
Geeks Rule and MBAs Drool

It is common to see software companies starting out with two founders, a geek and an MBA. Do you really need the MBA?

If I were to oversimplify the message of this article, I would make two statements:

Developers add more value to a software company than anybody else.
The truth of statement 1 is inversely correlated with the size of the company.
When a company is very small or just getting started, nobody can add value as well as a developer because there isn't really much other stuff that needs to be done. You don't have customers yet.
====

Health Monitoring in ASP.NET 2.0

2007-01-25T11:41:00.000-05:00

Health Monitoring in ASP.NET 2.0 helps monitor problems in your application. Here's nice MSDN article about it:
How To: Use Health Monitoring in ASP.NET 2.0
In particular,
System.Web.Management.SqlWebEventProvider works quite good out of the box.

Note, that Health Monitoring designed for web forms applications and does not target winforms applications.
For example, if you want logging Windows Services, Log4Net 3rd party component, or through embedded System.Diagnostics.EventLog component are the ways to go.

If you want to get error messages from your site through email, read this:
How to: Send E-mail for Health Monitoring Notifications

Note, however, that SimpleMailWebEventProvider has some unpleasant limitations:
1) You cannot send emails using SSL SMTP, so Gmail's SMTP is not available for you. The reason here is that uses standard SMTP ASP.NET provider, and standard SMTP ASP.NET provider is not fully configurable through web.config.
There is no way for you to specify:
smtpClient.EnableSsl = true;
As a result, emails sent through Google's SMTP are simply dissappear.

2) You cannot override SimpleMailWebEventProvider provider, because it's sealed.
So, you have to write your own mail provider from scratch.

Implementing your own isn't very hard.
I tried to inherit my EmailEventProvider from MailWebEventProvider, but I couldn't even make the code compile. It seems that MailWebEventProvider if poorly written (yeap, not every developer at MS is good).

But inheriting from BufferedWebEventProvider worked like a charm.
Here's the C# code:
=======================
using System;
using System.Text;
using System.Web;
using System.Web.Management;
using System.Configuration;
using System.Collections.Specialized;

namespace MyNameSpace
{
sealed class EmailEventProvider : BufferedWebEventProvider
{
private string _to;
private string _subject;

public override void Initialize(string name, NameValueCollection config)
{
GetAndRemoveStringAttribute(config, "to", ref this._to);
GetAndRemoveStringAttribute(config, "subject", ref this._subject);
if (string.IsNullOrEmpty(this._to))
{
throw new ConfigurationErrorsException(string.Format("Recipient must be defined for {0}provider", name));
}
base.Initialize(name, config);
}

private static void GetAndRemoveStringAttribute(NameValueCollection config, string attrib, ref string val)
{
val = config.Get(attrib);
config.Remove(attrib);
}

public override void ProcessEventFlush(WebEventBufferFlushInfo flushInfo)
{
StringBuilder sb = new StringBuilder();
// Write flushInfo.Events:
foreach (WebBaseEvent wbe in flushInfo.Events)
{
sb.AppendFormat("{0}\r\n", wbe.ToString(true, true));
}

SendMail(DateTime.Now.ToString(), _to, _subject, sb.ToString());
}
}
}
=======================

Here's web.config's code:
----------------
<healthMonitoring enabled="true" heartbeatInterval="0" >
  <providers>
    <add name="MyEmailEventProvider" type="MyNameSpace.EmailEventProvider" buffer="false"
         to="xxx@gmail.com"
         subject="Crash in MyAspNet app" />
  </providers>
  <rules>
    <add name="All Errors by Email" eventName="All Errors" provider="MyEmailEventProvider" />
  </rules>
</healthMonitoring>
----------------

Intelligent Job Search

2006-12-28T20:05:00.000-05:00

www.ijsearch.com allows searching for jobs from several major job portals simultaneously.

ReportViewer Control

2006-12-11T17:33:00.000-05:00

Reporting Made Easy is a nice article about new ReportViewer Control in Visual Studio 2005.
ReportViewer Control allows to create good-looking and robust reports in ASP.NET 2.0.

Also article discusses relationships between ReportViewer Control and SQL Server 2005 Reporting Services.

Technologies: ASP.NET 2.0, C#, VB.NET, SQL Server.

Scott Guthrie on history of ASP.NET

2006-11-20T16:57:00.000-05:00

ARCast - Scott Guthrie - the man, the myth, the legend
Scott Guthrie talks about history of developing ASP.NET, importance of prototyping, and more...

Inside the ASP.NET user profile mechanism

2006-11-07T19:57:00.000-05:00

This is nice article about handling user's profile in ASP.NET 2.0:
Inside the ASP.NET user profile mechanism

The article explains:
- How to enable profile functionality in ASP.NET 2.0 application.
- How to deal with anonymous profile (anonymousIdentification), and migrate anonymous settings to registered user.
- How to handle Role-based profiles.
And more.

Keywords: C#, ASP.NET 2.0, VB.NET 2.0.

ASP.NET 2.0 Remote debugging

2006-10-20T20:45:00.000-04:00

How to implement remote debugging in Visual Studio 2005
Remote debugging setup is greatly simplified in Visual Studio 2005. Although the DEBUG verb is still sent to the Web site to ensure that the remote process is running, all remote debugging scenarios except T-SQL debugging use the Remote Debugging Monitor (Msvsmon.exe).

Keywords: VB.NET, C#.

Visual Studio for Database Professionals

2006-10-18T12:12:00.000-04:00

Scott Guthrie announces
Visual Studio for Database Professionals and other Cool Data Management Tools for .NET
"VS for Database Professionals has been getting rave reviews, and includes support for database refactorings, schema and data comparisons, database unit testing, and automated data generation."

Visual Studio .NET 2005 automatization script

2006-10-18T12:05:00.000-04:00

Scott Allen explains how to automate SiteMap generation by VB script macro.

Technologies: ASP.NET 2.0, C#.NET, VB.NET, Web Site Map.

Beware of HtmlEncode in GridView DataBound fields

2006-10-12T20:42:00.000-04:00

I tried to use asp:BoundField DataFormatString="{0:d}" in asp:GridView for displaying date in short format.
Unfortunately it didn't work - I still was getting long date format, completely disregarding DataFormatString property value.

After some googling I found out that HtmlEncode needs to be set to false, in order to allow DataFormatString property work.

Read this
MSDN HtmlEncode note:
"When the HtmlEncode property is true, the value of the field is HTML encoded to its string representation before the formatting string is applied. For some objects, such as dates, you might want to control how the object is displayed with a formatting string. In those cases, you must set the HtmlEncode property to false."

Technologies: ASP.NET 2.0 ASP.NET 2005 C# VB.NET GridView control DataBound field.

Concurrency problem with auto-binding GridView

2006-10-04T11:48:00.000-04:00

I always was suspicious about using ObjectDataSource as data source for ASP.NET 2.0 controls. It saves you some C# (or VB.NET) coding, but adds lots of automatically generated ASPX stuff, which is hard to maintain. Plus flexibility of the code is just not there.

Now I have another good reason not to use ObjectDataSource and automatic binding, because such approach has serious concurrency issues.
Basically if two users are using the same page simultaneously, they could delete rows which they didn’t intend to delete.

This ugly bug caused by the fact that datagrid is trying to delete rows based on row index, not based on row ID.
Read more details about the issue in: Concurrency issues with GridView by jdcrutchley.

Scott Mitchell provides a workaround (hack) to this problem, so you still can use ObjectDataSource. However the need of using hacks just kills the whole idea of using ObjecDataSource with automatic GridView binding. The advantage was to make coding easier. Now the coding with ObjecDataSource is getting more complex than straitforward approach which I like to use:
============
<asp:GridView ID="gridView" runat="server" AutoGenerateColumns="false">
  <Columns>
    <asp:TemplateField HeaderText="Delete">
      <ItemTemplate>
        <asp:LinkButton ID="Delete" runat="server" Text="Delete" OnCommand=" Delete_Command" CommandArgument='<%# Eval("RowId") /%>' />
      </ItemTemplate>
    </asp:TemplateField>
  </Columns>
</asp:GridView>

protected void Page_PreRender(object sender, EventArgs e)
{
  gridView.DataSource = MyBusinessClass.GetMyData();
  gridView.DataBind;
}

protected void Delete_Command(object sender, CommandEventArgs e)
{
  int rowId = int.Parse(e.CommandArgument);
  MyBusinessClass.DeleteRow(rowId);
}
============

Microsoft "Atlas" Control Toolkit

2006-09-19T22:39:00.000-04:00

Microsoft "Atlas" Control Toolkit
That's a nice Atlas (Microsoft AJAX) demo.

Though I still prefer to delay starting using it, because Atlas isn't reliable solution yet.
Chances are that Atlas wouldn't work nice with IE7 :-)

Keywords: ASP.NET C# VB.NET Web UI

CSAML: C# Application Markup Language

2006-08-26T02:03:00.000-04:00

Enjoy this comparison of C# and XML as a programming language
---
C# Application Markup Language (CSAML): An Evolutionary Leap by Charles Petzold
Several weeks ago, Microsoft Corporation began a limited circulation of a specification and beta compiler for the new C# Application Markup Language or CSAML (sometimes pronounced "scammel"), and I’m pleased to say I find it fascinating. This merging of C# and XML is an important evolutionary leap for both standards, and represents a profound advance in the Xmlization of all textual data.
---

:-)

Keywords:
Microsoft C# XML joke parody
XML as Declarative programming language

Log4Net for ASP.NET 2.0

2006-08-25T18:15:00.000-04:00

This article might help to setup Log4Net in ASP.NET application:
Log4Net: The Definitive(?) How-To for Those Who Have Already Experienced Some Degree of Frustration Trying to Set It Up the First-Time Around by Chad Finsterwald.

Learning from Catastrophic Database Design Failures

2006-08-25T17:48:00.000-04:00

Great presentation about database design by Kevin Loney:
Learning from Catastrophic Database Design Failures

- There is no such thing as a harmless logical read.
- Tune the application, not the statistics.
- Time spent testing is never wasted.
- Most application performance problems are the result of deliberate design choices.
- "No production database will run in Third Normal Form."
The data must ultimately be stored in a format that is as close as possible to the users’ needs. You must never place data normalization above the business needs.
- Avoid active use of remote data.

Seriously evaluate the impact of design changes.
Test rigorously.
And ask for directions – but be careful whom you ask...

VSS 2005 over Internet and VS.NET 2005 over HTTP

2006-08-17T20:38:00.000-04:00

Ufff... that was a challenge: I tried to setup VSS database on Internet server and connect my machine over Internet.

The mistake was to try to connect from my DEV machine to //Server/VSS share directly.
Such solution doesn't fly: it's painfully slow and insecure.

Right approach is to properly setup VSS over HTTP.

Start with Alin Constantin's article:
Installing and configuring Microsoft Visual SourceSafe for Internet (Remote) access

But Alin's article There are still few tricks.
For example, my server (which I use for hostin VSS database) has multiple web sites (and multiple IP-addresses) associated with the server, so as a result I had to manually create VssUpload_db1 and VssDownload_db1 virtual folders.
(VSS admin creates these folder in Default web site, which doesn't work in my "multiple web sites" case.)
See:
There was a failure uploading the URL topic.

Another problem was about language mismatch between client and server VSS on different machines.
I was getting error: "The current source control operation cannot be completed.

The Visual SourceSafe Web Service returned the following error:
"The SourceSafe Web service was unable to process your request.
The selected language for non-Unicode programs in your computer does not match the one selected on the server."

This problem was discussed here:
Visual Studio Source Control and SourceSafe - selected language for non-Unicode programs
In my case I had to setup English as default language on my DEV (VSS client) machine. That's not good, but at least it works.

Unfortunately "View History" functionality doesn't work in VS.NET with Internet plug-in

Keywords:
VSS 2005 over HTTP
VS.NET 2005
Visual Source Safe 2005
Visual Studio .NET 2005
C#.NET, VB.NET

Best practises for ASP.NET web sites developers

2006-08-04T12:35:00.000-04:00

Good article by Jeff Prosise explaining typical ASP.NET development pitfals:
Keep Sites Running Smoothly By Avoiding These 10 Common ASP.NET Pitfalls

Here's the bottom line from the article:
- Does your app use LoadControl to load user controls dynamically? If so, make sure this is done in such a way that LoadControl will work both with and without output caching.
- Are you using kernel-mode output caching and session state in the same page? If so, remove the OutputCache directive to avoid caching that page or turn kernel-mode output caching off for the entire app.
- Are you calling FormsAuthentication.RedirectFromLoginPage in your ASP.NET 1.x-based app? If so, either change the second parameter to false or modify the Expires property of outgoing persistent forms authentication cookies to a more appropriate timeout.
- Do any of your pages generate inordinate amounts of view state? If so, turn off view state for individual controls or keep it on the server.
- Does your app use SQL Server session state? If so, make sure you disable sessions in pages that don’t use sessions.
- Does your app use the ASP.NET 2.0 role manager? If so, enable role caching to increase performance.
- Does your app use custom data types as profile properties? If so, you'll avoid problems by creating custom data types that are compatible with XML serialization or by attributing the types as serializable and using the binary serializer to serialize and deserialize types.
- Does your app do database queries that take a long time to return? If so, consider whether the pages are candidates for becoming asynchronous.
- Does your ASP.NET app use client impersonation? If so, simple authentication in ASP.NET might enforce ACL-based permissions with less hassle.
- Have you profiled your app’s database activity? Examining communication between the app and database is a good first performance-tuning step.

Multiline HTML buttons

2006-08-01T21:37:00.000-04:00

Here's HTML code to Multiline caption buttons:
====
<button>multiline<br>button<br>text</button>

<input type="button" value="Carriage
return
separators" style="text-align:center;">
====

Actual buttons:

---
Keywords: HTML DHTML Multi-line Multy line button caption. Web Forms. IE Internet explorer FireFox Opera