Category Archives: software development

Ruby on Rails on .NET

Microsoft’s John Lam reports:

IronRuby dispatched some simple requests through an unmodified copy of Rails a few days ago. Today, we’re going to show off our progress live at RailsConf.

He adds that performance is terrible; so you might not want to migrate your project just yet. Why bother? Mainly, to get Rails productivity plus access to .NET libraries – in other words, integration with Microsoft’s platform.

Technorati tags: , , , ,

Danny Thorpe back at Microsoft

Danny Thorpe, best known for his work on Delphi at Borland, is returning to Microsoft:

I will soon be jumping back into the Microsoft maelstrom, this time in the Visual Studio / Developer Division (devdiv) team. I will again be telecommuting from Santa Cruz. I’ll be part of a new incubation team composed of Chuck and a few other legendary devdiv veterans (I’m not sure I can say who yet) working on stuff to make accessing Windows Live services easier for developers.

I have had great respect for Thorpe ever since reading his book on Delphi Component Design, which despite its age is still a good read if you want to know how the Visual Component Library in Delphi hangs together. His career has been a bit butterfly of late – from Delphi to Google to work on Gears, then Microsoft developing Live Services, then working on browser plugins at cooliris (makers of PicLens); and now back to Microsoft.

If Microsoft is to bring its Live Services into wide use, strong Visual Studio integration is a must; I guess this may be what his new role is all about.

What’s coming in Windows? Check the PDC 2008 agenda

Microsoft’s Professional Developer’s Conference is traditionally where it shows developers its forward plans. Sometimes these do not work out as expected. Notorious examples include Hailstorm web services, and pre-reset Vista, in which Windows Presentation Foundation was more at the core, and which included the WinFS smart file system.

It follows that the just published session list for the PDC should not be treated as an infallible guide to the future. Still, there are interesting snippets here:

  • .NET and ASP.NET for Windows Server Core
  • Silverlight for Mobile devices
  • Touch computing in Windows 7
  • A “new networking API with support for building SOAP based web services in native code”
  • and of course the Live Mesh developer platform

Who needs AIR? NY Times does desktop Silverlight app for Mac

The New York Times is porting its excellent Times Reader application to the Mac using Silverlight 1.0:

Times Reader for the Mac is a native Cocoa application, which uses the Safari toolkit and Silverlight to render the pages.

Follow the link for some screengrabs. Adobe’s AIR (which also uses the Safari toolkit) is the obvious choice for this kind of online app; it’s interesting to see the NY Times adapting Silverlight in a similar manner.

I spoke to developer Nick Thuesen about this at Mix07, so this is not news for readers of this blog; though I’d become sceptical about whether it would be delivered because of the delay. Now, I’m surprised that the NY Times is still using Silverlight 1.0 rather than waiting for 2.0.

The Silverlight version appears to have some compromises. In particular, it cannot flow text on the client:

We paginate the pages for the Mac version on our servers (the Windows version does this on the PC). When you sync, we send you pages for the four window and three font sizes described above.

Still, the screens look good and I look forward to trying it – especially as the public beta will be free, whereas you need a subscription for the full release.

There is a high level of hostility towards Silverlight in the comments to the post. Mostly these appear to be religious in nature – ie. Mac users hate all things Microsoft. It does illustrate the difficulty the company has in persuading the world to take its cross-platform ambitions seriously.

Thanks to Ryan Stewart for the link.

WinFS reborn: SQL Server as a file system

Fascinating interview with Quentin Clark, who led the cancelled WinFS project at Microsoft. Jon Udell is the interviewer.

Clark talks about how technology from WinFS is now emerging as the Entity Framework in ADO.NET (part of .NET 3.5 SP1) and the FileStream column type in SQL Server 2008 – a connection I’d already made at the Barcelona TechEd last year. He also mentions the new HierarchyID column type that enables fast querying of paths, the concept of rows which contain other rows. He adds that a future version of SQL Server will support the Win32 API so that it can support a file system:

In the next release we anticipate putting those two things together, the filesystem piece and the hierarchical ID piece, into a supported namespace. So you’ll be able to type //machinename/sharename, up pops an Explorer window, drag and drop a file into it, go back to the database, type SELECT *, and suddenly a record appears.

Put that together with the work Microsoft is doing on synchronization, and you get offline capability too – something more robust than offline files in Vista. Clark says SharePoint will also benefit from SQL Server’s file system features.

Note that Live Mesh does some of this too. I guess SQL Server is there in the Live Mesh back end, but it strikes me Microsoft is at risk of developing too many ways to do the same thing.

The piece of WinFS that shows no sign of returning is the shared data platform, which was meant to enable applications to share data:

… all that stuff is gone. The schemas, and a layer that we internally referred to as base, which was about the enforcement of the schemas, all that stuff we’ve put on the shelf. Because we didn’t need it.

Cenzic web app report highlights security problems

Will we ever get a secure Internet? There’s no cause for optimism in the latest Cenzic report into web app security. A few highlights:

  • 7 out of 10 Web applications analyzed by Cenzic were found vulnerable to Cross-Site Scripting attacks
  • 70% of Internet vulnerabilities are in web applications
  • FireFox has the most reported browser vulnerabilities at 40%; IE is 23%
  • Weak session management, SQL Injection, and poor authentication remain very common problems
  • 33% of all reported vulnerabilities are caused by insecure PHP coding, compared to 1% caused by insecurities in PHP itself.

OK, it’s another report from a security company with an interest in hyping the figures; but I found this one more plausible than some.

The PHP remarks are interesting; it would be good to see equivalent figures for ASP.NET and Java.

My high risk blog reader

I posted yesterday about the report from PC Tools saying that Vista is more prone to malware than Windows 2000.

The company kindly sent me its press release on the subject and is promising more information. According to the release, the figures are based on a tool called ThreatFire, available in free and commercial editions, which by default reports threats discovered back to PC Tools for analysis and statistics. ThreatFire is a behavioural tool; that is, it does not rely on signatures of known malware, but detects suspicious behaviour.

I thought I should try this tool on my own machine. I probably count as a high-risk user, since I frequently browse the web and download and run software, sometimes unsigned software. Would ThreatFire find any malware?

It did not take long:

The application is my own custom blog reader, a simple .NET app which calls the common feed list API and renders blog posts in the WebBrowser control.

Looks like a false positive to me. Still, I poked around in the dialog. The risk level is supposedly high. The Technical Details link does not tell you any more about what the app did that was suspicious, but identifies the files I can choose to quarantine. The link that says “Learn more about this threat” does a Google search on the file name.

By the way, doing a random web search on what is potentially malware strikes me as poor practice. Here’s what online help says:

Click the Learn more about this threat link to launch a quick web search on the threat.  In most cases the result of this search provides a clear indication of how to proceed.

Ever tried searching for the name of an executable or process? The bad guys and the scammers know we do this; and you will be offered all manner of “security” products some of which are likely spyware or malware themselves. A foolish thing to encourage. Further, how will a random web search provide “a clear indication of how to proceed”? It’s the wild web, no more, no less.

My blog reader is not very famous, so in this case Google found nothing. I’m puzzled that ThreatFire doesn’t tell you more about the supposedly malicious activity, like what data was sent and where, so that the user would have more chance of judging whether this is really a dangerous app.

I guess the “threat” is now in the PC Tools database, and my machine marked as Vista with malware. I’ll be interested to see what else it finds.

Technorati tags: , ,

Visual Basic returning to Mac Office

Microsoft will restore VBA to Mac Office:

The Mac BU [Business Unit] announced it is bringing VBA-language support back to the next version of Office for Mac. Sharing information with customers as early as possible continues to be a priority for the Mac BU to allow customers to plan for their software needs. Although the Mac BU increased support in Office 2008 with alternate scripting tools such as Automator and AppleScript — and also worked with MacTech Magazine to create a reference guide, available at http://www.mactech.com/vba-transition-guide — the team recognizes that VBA-language support is important to a select group of customers who rely on sharing macros across platforms. The Mac BU is always working to meet customers’ needs and already is hard at work on the next version of Office for Mac.

There’s a couple of ways to take announcements like this. The positive: the company is listening. The negative: what was it thinking when it cut the feature?

By the time Mac Office vNext is out of the door, I imagine many potential VBA users will have found other solutions.

The other point of interest: while Microsoft’s Mac BU is benefiting from Apple’s strength, I doubt that is enough to compensate for the lost Windows sales which are also implied.

Codegear sold to Embarcadero

CodeGear, Borland’s developer tools business, is to be acquired by Embarcadero; though to be more precise, CodeGear is being acquired by the owner of Embarcedero, a private equity company called Thoma Cressey Bravo.

Embarcadero has a range of database and data modeling products, including ER/Studio, EA/Studio, RapidSQL, PowerSQL and DBArtisan.

This is the end of a long road – CodeGear was put up for sale in 2006.

Good news? Insofar as it ends a long period of uncertainty, yes. On the other hand, I sense that many of CodeGear’s customers have valued its renewed focus on software development, as opposed to application lifecycle management, modeling, change management and all those other enterprisey things. Embarcadero just might take it back in that direction. From the press release:

Customers and partners will benefit from Embarcadero’s ability to help fully integrate their application development lifecycle, automate error-prone tasks and dramatically increase their productivity.

Talk of “dramatically increased productivity” is bound to strike fear into the hearts of those who like their dev tools mean and lean.

The problem from a business perspective is that enterprise sales are where the money is, and plain old IDEs and compilers are thoroughly commodotized. Eclipse, NetBeans, Visual Studio Express…

That said, CodeGear still has some interesting products, and increased resources for things like quality control and documentation would do them no harm at all.