If you host your ASP.NET 1.x website with a hosting company that allows the use of Microsoft Access databases and SQL Server and you host in a shared environment then take some time to consider how secure your SQL data is, or rather possibly isn't.
I have shared hosting accounts with a couple of very well known ASP.NET hosting companies. To discover how secure the shared ASP.NET environments were I found that I was able to traverse out of my web folder to other users web directories and read their web.config files (and of course their SQL Server connection strings and other such goodies).
To use Access databases you generally utilise the data access classes in System.Data.OleDb. There's an unfortunate shortcoming about System.Data.OleDb which is that you need to be running ASP.NET under Full Trust to use it. The security impact of this in a shared hosting environment is that users can exploit this, as I did, to begin touring other customers website folders in search of secrets such as SQL connection strings.
In a shared hosting environment each website runs under it's own unique IUSR_<xxx> anonymous user account and ASP.NET is set to impersonate that account for each request that is handled by the site. The <identity/> impersonate attribute is set to 'true' in the server's machine.config file like this -
<identity impersonate="true" userName="" password=""/>
The web folder, which is the root of your website, also has at least the following NTFS permissions on it - read/write access for the IUSR_<xxx> account and Read access for the ASP.NET worker process account (NETWORK SERVICE if running Windows 2003 or ASPNET if running under Windows 2000). As you can see, the worker process account has read access to every site on the shared server. The reason for this is that ASP.NET needs to be able to monitor the web folders for file changes and to be able to read your ASP.NET files (.aspx, .ascx, dll's etc) to be able to compile them.
If you execute this page script on in your website you can discover what your anonymous user account is:
<% @ Page language="c#" runat="server"%>
<%@ Import Namespace="System.Security.Principal" %>
<script runat=server>
void Page_Load(Object sender, EventArgs e) {
Response.Write("<b>Identity:</b>" + WindowsIdentity.GetCurrent().Name + "<br/>");
}
</script>
Let's modify the script to this:
<% @ page language="c#" runat="server"%>
<%@ Import Namespace="System.Security.Principal" %>
<%@ Import Namespace="System.Runtime.InteropServices"%>
<script runat=server>
[DllImport(@"C:\WINDOWS\system32\advapi32.dll")]
public static extern bool RevertToSelf();
void Page_Load(Object sender, EventArgs e) {
Response.Write("<b>Identity:</b>" + WindowsIdentity.GetCurrent().Name + "<br/>");
RevertToSelf();
Response.Write("<b>Identity:</b>" + WindowsIdentity.GetCurrent().Name + "<br/>");
}
</script>
If your server is running ASP.NET under Full Trust then the RevertToSelf() function ends the impersonation and the remainder of the request executes under the worker process identity, otherwise you'll get an exception thrown (to obtain the path to the system32 directory examine value of the System.Environment.SystemDirectory property).
So what does this mean? The worker process account has read permission to every website folder on the server so it's possible (and I did) to write a script to traverse these folders and harvest web.config files. In fact it's also possible to harvest critical information from every folder that the worker process account has read rights on.
To mitigate this issue you could run each website in it's own application pool and give each application pool it's own identity and each web folder would have NTFS permissions for each of those identities. However this is not really a practical or manageable solution because in a shared hosting environment there can be anything between 500 to 1000 websites. Can you imagine managing up to 1000 application pools and worker processes on the web server? Can you imagine the ACL management for all of those areas that ASP.NET likes to touch? Also your $10.00 a month hosting company is unlikely to give you your own application pool and identity, no matter how nicely you ask, because it's just not economically viable for them. They are more likely to suggest that you buy one of their dedicated server solutions.
So the bottom line is this. If you're hosting on a shared environment and your hosting company allows the use of Access databases then beware that your sensitive SQL data is at risk because -
- to use Access means ASP.NET 1.x has to run at Full Trust
- Full Trust means that the user can call RevertToSelf() to end impersonation and run as the worker process identity
- most likely all the websites run in the same worker process under the same identity
- the worker process identity will have read access to your web folders
Fortunately in ASP.NET 2.0 the Full Trust issue is more or less fixed (System.Data.OleDb and System.Data.Odbc can run under Medium Trust) but if the server is running both ASP.NET 1.x and ASP.NET 2.0 you're still not secure.
Thanks to Dominick for the time spent discussing this.
Update:
I did some poking around and found this article by K. Scott Allen which is worthwhile taking a look at.
I just finished K-Pax III: The Worlds of Prot the third and final installment about the mysterious 'prot' character who claims to be from the planet K-Pax. It's a pretty light hearted affair and has all the welcome familarity of the characters and settings of the previous two books about Gene and prot. That said I didn't feel there was as much substance in this encounter with prot as the original K-Pax but it's still a good read if you're in between a couple of heavier tomes. 7/10.
This got me for a while today. If you're running your web application under Medium Trust (recommended) and you encounter the following exception when trying to read custom application configuration settings in your web config -
System.Security.SecurityException was unhandled by user code
Message="Request for ConfigurationPermission failed while attempting to access configuration section 'someSettings/theSettings. To allow all callers to access the data for this section, set section attribute 'requirePermission' equal 'false' in the configuration file where this section is declared."
Source="System.Configuration"
StackTrace:
[snipped]
Then re-read the exception message again -
"To allow all callers to access the data for this section, set section attribute 'requirePermission' equal 'false' in the configuration file where this section is declared"
i.e.
< configSections>
<sectionGroup name="someSettings">
<section
name="theSettings"
type="Tollon.ConfigSettings.SomeConfiguration, Tollon.ConfigSettings, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"
requirePermission="false" />
</sectionGroup>
<configSections>
The last day of DevWeek 2006 was probably my favourite. The day started off with an excellent keynote by Tim Ewald on the state of web services. The second session of the day was a bit disappointing - Understanding .NET Through Patterns by Paul Besly. I'm afraid his card trick analogies just didn't quite cut it and I'm pretty certain that many people with some familiarity with patterns went away feeling less than satisfied.
The first session of the afternoon was Extending ASP.NET 2.0 with Custom Providers by Jeff Prosise and as usual Jeff's excellent oratory skills held everyones attention. The last session of the day was Inside the ASP.NET 2.0 Compilation Model by Dino Esposito. This session was a pretty indepth look at the new compilation model and how to extend it using custom build providers - 10/10.
This was my second DevWeek and again it was a very worthwhile conference with great speakers, great topics and quite informal and friendly.
This week I'm down at DevWeek 2006 which I also attended last year. It's quite good value for money and the quality of the speakers and topics is good again this year. The sessions I've attended so far are:
Tuesday:
Keynote - Dave Wheeler
Power ASP.NET 2.0 Programming - Jeff Prosise
Exploring Unit Testing with Visual Studio Team System - Kevin Jones
Writing Extensible Applications Using Reflection - Jason Clark
Wednesday:
Understanding Threads and Thread Synchronisation - Jason Clark
Distributed .NET - Ted Neward
Extending System.Xml - Ted Neward
ASP.NET, AJAX, and you: Introducing MS AJAX - Jeff Prosise
It's nice to know from sessions such as the Jason Clark ones that I'm doing all the right things :-)
More later.
Scott Guthrie announced the release of the second preview of the Web Application Project type for VS05. You can read about it here and download it from here.
If you're developing Visual Studio 2005 ASP.NET 2.0 websites on Windows 2003 server and you're creating a separate IIS website for each project then there's a new gotcha I discovered today.
I prefer developing on Windows 2003 because at the very least you can organise your web projects more sensibly (and sanely) rather than lumping everything into the Default website. There are also many projects we undertake where we need the whole of an existing site on the dev box when we're adding new functionality - often we find absolute urls to scripts or images and unless the darned code gets to live in its own website it can be a bugger to work with.
I know there's a hack to coerce IIS on XP to have more than one Website but it's inconvenient especially when you need to switch between projects quickly (a current project is having a bunch of new functionality added to two sites which will be shared) and lets face it, it's a dirty hack.
Anyway if you start debugging a VS05 website created under IIS (you really shouldn't use the cassini based thing for anything other than knocking up quicky snippets of code, see: Cassini considered harmful (leastprivilege.com) and you encounter the error: "Unable to start debugging on the web server. Logon failure: unknown user name or bad password" then check out this kb article -
You receive error 401.1 when you browse a Web site that uses Integrated Authentication and is hosted on IIS 5.1 or IIS 6.
You also need to start the Visual Studio Remote Debugging Monitor and make sure your logon is added to the Permissions for Remote Debugging under Tools->Permissions. This seems to be a new thing because VS02/03 worked just fine without it in the past. Now please can I have the last 4 hours of my life back?
Update:
I forgot to add that the following event is logged when the vs 2005 login failure occurs -
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 537
Date: 10/02/2006
Time: 01:40:21
User: NT AUTHORITY\SYSTEM
Computer: UKM-W2K3-003
Description:
Logon Failure:
Reason: An error occurred during logon
User Name: Kevin
Domain: MYSERVER
Logon Type: 3
Logon Process: O
Authentication Package: NTLM
Workstation Name: MYSERVER
Status code: 0xC000006D
Substatus code: 0x0
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.168.100.59
Source Port: 0
This is a hilarious take on the meaningless hyperbole that is 'Web 2.0' - BileBlog - Web TwoPointSchmoe
I couldn't agree more with his closing paragraph -
"There's no doubt that ajax, tagging, semantic fappery and all that other gibberish have some potential. Ultimately though, there is no revolution, nor even an evolution. It's simply the ability to toss in a few more tools in the toolbox. Specialised tools, that can be effective when used against the right obstacle. Nothing more, nothing less."
Jings, crivvens, help ma boab it's announced already here but not shipping until Q3.
I shouldn't laugh but the method of destruction in the style of Frank Spencer left me with tears of laughter. What topped it off for me was the polite letter from the museum asking Mr Flynn not to return in the near future. There is the making of a mastercard advert -
Bus fare into town - £2.80
Two tickets for the museum - £8.40
Nice cup of tea and a biscuit in the museum tearoom - £3.40
Forgetting do up your shoe laces, tripping on them and taking out two rare Chinese vases - Priceless
http://news.bbc.co.uk/1/hi/england/4671450.stm
In the evenings I tend to have the laptop on the coffee table and tippy tap away at stuff whilst the telly's on. But it gets uncomfortable sitting on the settee crouched over the laptop and I miss the dual monitors and beefy workstation power that's in my office.
So today I invested in a TV card for a spare PC + monitor and ran a coax cable from the Sky box in the lounge into the office. I gotta say I wish I'd done this ages ago, it works a treat. All I need now is a remote kit for the Sky box handset so I can channel hop without having to run to the lounge and flick.
The card is a Hauppuage WinTV-HVR 1100 which I bought because it had a built in digital terrestrial TV decoder and remote control. But sadly Perth for some reason hasn't made it to the digital age for telly (even though we do get DAB) so I might exchange it for a cheaper model.
I just noticed that VMware have introduced a free version of VMware server. It's in beta at the moment but they expect to release the finished version in the next few months. You can grab it here. You can also download a bundle of pre-built appliances and virtual machines here which will run using the server, existing products or on the free VMplayer.
David Wang is a member of the IIS team and he can be found in the IIS related newsgroups. His blog has loads of good stuff about IIS based on questions asked in the newsgroups and privately. I've been subscribed since September last year, you should too.
As part of an exercise to see if I can reclaim some tax, I went back through all the invoices I have for IT book purchases since 2002. It comes to £1234.61. 2003 seems to have been a good year for Computer Manuals where I managed to spend £470 with them.
I'm missing a batch of invoices from 2001-2002 and I know I spend a serious pile of dosh with them as I gaze across my lounge at the straining bookshelves.
I was going to post some pics of the steps involved during the mod chip install. However I loaned my digital camera to a mate Andy to take to Chile on his company trip to Concha Y Toro's vineyards so I haven't got any pics of the XBox's insides and dodgy looking solder work and that's probably a good thing :).
There's quite a good guide to installing the mod chip here
Anyhoo if you're going to undertake a mod that requires soldering a few things spring to mind:
1. Get a decent soldering iron and decent solder. The temperature of the gas fired thing I bought was difficult to control and there was a severe risk of lifting the delicate tracks on the XBox PCB. I'd recommend investing in a good temperature controlled professional soldering iron such as a Weller.
2. Practice your solder work on a scrap PCB, especially one that is multilayered and has the same fine trackwork as the XBox.
3. It turns out there are 8 PCB revisions ranging from v1.0 -> 1.6b. Mine was a v1.0 PCB and unfortunately holes for the LPC bus were filled with solder and that had to come out before fitting the pin header assembly. The LPC bus holes newer revisions of the motherboard are fortunately solder free.
4. If you have a v1.6 or v1.6b motherboard be sure that your soldering skills are really good because MS made some slight but significant modifications to the outputs on the LPC bus which means you have to patch the underside of the PCB with jumper wires to get the correct outputs. Some of the newer kits such as the Xecuter 3 CE include a PCB rebuild assembly that reduces the some of the pain. There's still a high risk of accidentally creating a solder bridge between one of the solder points and an adjacent tiny (< 1mm x 1mm in dimension) surface mount resistor and from bitter past experience these little buggers are a bitch to put back on if dislodged by accident when trying to clear the solder bridge. I have a 1.6 XBox as well (that's another story) and didn't even consider trying to fit the rebuild PCB simply because the iron and solder I had weren't of sufficient quality to do the job. I'd get a pro to do it for you.
5. If you have a v1.1 - v1.5 board then the installation should be plain sailing and the only difficult soldering task is soldering the D0 wire in the D0/LAN LED/HDD LED harness to a tiny wee solder point on the underside of the mainboard (v1.0 requires this too). A magnifying glass would've been handy for this task.
More later and how I thought I'd fluffed the install.
I decided it was time to do something interesting with my XBox (std). So begins the story of how I turn it into something more useful than the black brick that sits under the telly that gets used occassionally for that snowboarding game...erm..what's it called again..oh oh aye...SSX Tricky....
Anyway...here are the bits...(cheers Dave for the motivation)....
The XBox:
Ooops...no that's a train from New Zealand.
OK...These are the bits...(really)...
One XBox -
One Xecuter 3 CE Kit from XBox Mod Chips (apologies for the crap photo, not quite got the hang of my new Fuji FinePix camera for indoor work):
One butane soldering iron..some dodgy looking butane fueled thing from B&Q's plumbing dept. It's redeeming features were a small pointy solder bit, heat control and it's reasonably ok to handle for electronic work such as IDC headers, consumer PCB's and the like (I lost my Weller Soldering Station in a house move...grrrr). Anyway...as I said the bit is reasonably fine and after some practice on an old PCB to get used to and control the bit temperature it should do the trick. I might need to order a desoldering tool (again another lost item) if the location where the IDC header goes is filled with solder on the XBox PCB.
Ok.....it's late, I've had some friends round with some decent chunky Chilean red wine (sadly no Wine Makers Lot) and a bit of pizza and it's time to hit the sack before getting drunk and disorderly on my XBox with firey hot tools and pliers...tune in for part two soon......
Kev
Been a while since I posted a playlist so here's the one from last week:
Hayseed Dixie - Whole Lotta Love
Led Zeppelin - When the Levee Breaks
The Fall - Pacifying Joint
Spizzenergi - Where's Captain Kirk
Per Ubu - Non Alignment Pact
The Damned - New Rose
X-Ray Spex - Oh Bondage, Up Yours
Dead Kennedys - A Growing Boy Needs His Lunch
Stereolab - Vonal Declosion
Manitoba - Crayon
Four Tet - Smile Around The Face
Beck - Girl
Dirty Beatnicks - Suicide Mission
Ladytron - Destroy Everything You Touch
Go! Team
The Disposable Heroes of Hiphoprisy - Television the Drug of a Nation
Roots Manuva - Witness (1Hope)
Silo - Those Adopted By People
Mogwai - Sine Wave
Muse - New Born
Lush - Undertow
Doves - Firesuite
Amorphous Androgynous - The Galaxial Pharmaceutical
Boards of Canada - Into The Rainbow Vein + Chromakey Dreamcoat
FC Kahuna - Hayling
Engineers - New Horizons
Also ordered these CD's this week and hopefully they'll arrive on time for the show this Friday -
Thunder, Lightning, Strike - Go! Team
There Goes Concorde Again - Native Hipsters
And in my post christmas spree on Amazon I ordered myself a replacement copy of Tracy Kidder's Soul of a New Machine which I read 20 years ago. It's the story about the team who built Data General's first 32 bit minicomputer to hit the market (the Eclipse MV/8000) and as I remember it was a damn fine read. I used to have a DG CS-200 in my parents dining room when I was at college until they managed to persuade me to give it back to the DG shop I worked part time at. It consisted of 2 19" racks, one rack had an Eclipse S/130 (see pic below) and the other had 2 x 10MB+10MB Gemini disk drives and a 1600bpi reel to reel tape unit. This was back when real computers had switches, dials and keys on the front:
As I remember it was big noisy and sent my folks electricity bill through the roof. The one I had even had a user programmable microcode board so you could write your own custom machine code instructions. I wrote one to clear one of the accumulators but it took weeks to get it working. Hooray for .NET and C#.
Anyway here's another gratuitous shot of a DG box:
Geeky isn't it :)
Just spent the last few days immersed (drowning?) in ASP and PHP scripting on some legacy code maintenance.
Response.Write debugging.....mmmmmm!
Briefly....been back from NZ for a week. Decided to ditch blogging when I was there and the last week has been hellish with a bit of flu + jetlag so I couldn't be arsed.
Anyway NZ is ace.
Here's a couple of photo's :
This is looking up Milford Sound towards the west coast. They do a pretty ace boat trip and submarine thing. The weather was pretty amazing, it usually rains quite a lot:
Got through quite a lot of this too:
Anyway....more later.
There's been a bit of blog drought the last fortnight. Didn't write down my playlists for the last couple of shows and the recordings are off being ripped by a mate for my forthcoming trip to NZ - apparently my neices and nephew are big fans :). However I do remember playing these last Friday:
Neds Atomic Dustbin - Kill Your Television
The Go Team - Bottle Rocket
Ladytron - Destroy Everything You Touch
Blackbox Recorder - It's Only the End of the World (sounds a bit ominous given the 24hr plane ride to NZ next week)
Pure Reason Revolution's - The Intention Craft
The Fall - Clasp Hands
The Fall - Telephone Thing
The Research - C'mon Chameleon
Subway Sect - Ambition
Electralane - Eight Steps
I did an outside broadcrast thingy for the station on Sunday too with my mate Eric for the Pitlochry 10km run. That was a laugh and a half but also technically interesting as well to see how a radio station gets a mobile unit (bloke chasing/commenting on the runners in a radio car), their outside broadcast unit (read as stage like a radio 1 roadshow but with the behind the scenes stuff full of all sorts of mixing, switching and relay kit) and the studio all to hang together in an apparently seemless way to the listener...fascinating in a geeky sort of way.
Anyway....it's hard to believe it's only 5 days to go before Dave (long time pal from primary school) and me head off to NZ and right down to the bottom on South Island to a place near Wyndham in Southland NZ.
The intinerary is - Edinburgh -> Heathrow -> Los Angeles -> Auckland -> Christchurch. The original plan was to fly down to Invercargill from Christchurch but I decided that the chance to catch some NZ scenery would be better placed by renting a one way car rental from Christchurch down to Invercargill over three days. The plan now is to drive from Christchurch to Lake Wanaka where my wee bro's (Steve) wife's folks have a place and stop off and hit the pubs and generally soak up the NZ atmosphere.
Then we head my down to Wyndham and the rental gets dropped off on Sunday lunchtime at Invercargill airport. After that we're picking up Steve's motor from Invercargill airport (they're leaving it there for us - Dad's been over a couple of times this year and that seems to work quite well) and then wending our way up to Steve and Kath's place on Friday or Saturday. Although I'm a crap flyer - I've only been to the States (once), Germany (once - business), France (school trip), Amsterdam (a few times on business when I worked for Telecity) and Copenhagen (also with TeleCity on my RIPE registry training course) - I'm really looking forward for getting lost in NZ when we get there. I'm looking forward taking wrong turns, wierd map layouts and basically stumbing our way to Steve's in such a far away place that it might as well seem like going to the moon at the moment.
Anyhoo....the excitement hasn't quite kicked in yet. I'm a bit rubbish at handing my life over to a glorified metal tube with sticking out bits packed full of aviation fuel and jet engines that might as well, as far as I'm concerned, appear to be left overs from the 1950's space race. That whole bit fills me with apprehension and outright bloody fear.
The oddest/fearful/awesome thing I reckon will be flying several thousand miles over the pacific with barely a landmass below and then crossing the international dateline. The dateline malarky has got me totally confused. But all I care about is touching down in Christchurch and jumping into the rental and doing some exploring next Wednesday? Thursday? UK Time ? NZ time? I've no idea.
I'll also be spending some time down in Stewart Island at a place called Halfmoon Bay where Kath (Steve's wife) comes from. The connection to the internet is stonking for the residents (10Mb connectivity apparently) which is good because although I'm over in NZ for 6 weeks, four of those weeks are working remotely and two weeks are actual holiday.
Anyhoo...stay tuned for photo's and general rambling about the trip.
Kev
I recently stopped drinking tea and coffee after some recent unpleasant side effects. I've been drinking coffee for years and just all of a sudden I became intollerant to anything with caffeine in it. Pretty damn annoying since I love coffee.
Anyway a friend John suggested a replacement - Red Bush Tea. Lets face it drinking just water all day is pretty boring, I'm not a big fan of sugary drinks and decaf just doesn't taste right. It takes wee bit of getting used to but if made in a pot and allowed to infuse for at least 5-6 minutes it's actually pretty damn good. Good for you too apparently because it's high in anti-oxidants etc and it's very refreshing. The trick is also to have a tea pot just for Red Bush and not use it for regular tea because normal tea leaves (no pun intended) tannins and goop in the pot that affects the taste of RB and it's healthy goodness (apparently).
The new American Analogue Set release finally turned up. Damn good it is too so it deserved having two tracks played from it. I never like to make comparisons like this but there's a definite My Bloody Valentine and Stereolab sounding thing going on there and I'm not complaining.
The Doors - Queen of the Highway
Neil Young - Heart of Gold
Iron and Wine - Woman King
The American Analogue Set - Born on the Cusp
The Postal Service - The District Sleeps Alone Tonight
Massive Attack - Black Milk
Television - Marquee moon
Ambulance Ltd - Yoga is Union
Silver Apples - Program
The Egg - Angel of My Soul
Howie B - Hopscotch
Dirty Beatniks - Suicide Mission
Boards of Canada - 1969
Fluke - Squirt
The American Analogue Set - Cool Kids Keep
Dinosaur Junior - Quicksand
Gomez - Rie's Wagon
Revolting Cocks - D'ya Think I'm Sexy
Frank Zappa - Titties and Beer
Amorphous Androgynous (FSOL) - Mello Hippo Disco Show
Hawkwind - Space is Deep
I usually can't be bothered following a whole TV series like The West Wing or 24 on a week to week basis and prefer to wait until the latest season appears on DVD and then have a binge. However....'Lost' is something I've really got hooked into each week and I gotta say the one that aired on E4 tonight had an ending that creeped me out just a bit. I really love the drip feed approach to the story. Well recommended.
Ok...this is a bit of a Whyte and MacKay moment....
It's been 25 years since the Dead Kennedys 'Fresh Fruit for Rotten Veg' album was released so I decided to have a DK's night (annoyingly, Fresh Fruit is the only DK's vinyl I'm missing and as I remember it from my early teens it was a gatefold album with 'Fuck Facts' newsletter...anyone still got one and want to sell me one for a sensible price?).
Anyway...
I decided to not play anything from FFFRV mostly because 'We've Got a Bigger Problem Now' from In God We Trust captures the essence of California Uber Alles and reflects so timeously upon the election/re-election of GW Bush as it did when Ronald Reagan was first elected as US president in 1981.
'Holiday In Cambodia' could've been played as an alternative but I really wanted the un-initiated to hear tracks from later material in:
'In God We Trust (EP)'
'Plastic Surgey Distasters'
'Frankenchrist'
...and 'Bedtime For Democracy'.
Many of the lyrics from of those records are as poignant today as they were back in the 80's.
The DK's were often seen as a punk band but they were far more than that. With their soured west coast surf sound they were a bona-fide anti-establishment band and for good reasons too...check out their lyrics and see why.
A future blog entry may discuss them in more detail.. however...messrs Whyte and Mackay have some overwhelming control over my keyboard tonight so I'll leave it at that...anyhoo...here's last Fridays playlist...nighty nite.
Doves - Firesuite
Mercury Rev - Tides of the Moon (Thanks Chris)
Grandaddy - Collective Dreams of Upper Class Eligance
Dead Kennedys - We've Got a Bigger Problem Now (from In God We Trust)
Beta Band - It's Not Too Beautiful
Electrelane - Film Music
Caribou - Bee's
Dean Kennedys - Moon Over Marin (from Plastic Surgery Disasters)
Super Discount - Prix Choc
X-Ray Spex - Oh Bondage Up Yours
Family Of God - Goodnight Picadilly
Nucleus - Song For The Bearded Lady
Faust - It's a Rainy Day, Sunshine Girl
Sons And Daughters - La Lune
A Growing Boy Needs His Lunch (from Frankenchrist)
Death In Vegas - Aladdins Story
Royksopp - What Else Is There
The Orb - Once More
Fischerspooner - Ritz 107
Dead Kennedys - Cesspools In Eden (from Bedtime For Democracy)
ps: lucky listeners :-) to next weeks show might hear a track from Jello Biafra's spoken word album 'No More Cocoons'...if you're in the area (Perth and Pitlochry) tune into 97.5FM - Heartland FM between 10pm and 12am...I'm your weekend starter (apparently the schedule says so).
A few years back Jakob Nielson's Alertbox published an article that hilighted the many usability deficiencies of Flash or Shockwave or whatever it's called these days. Tonight while researching a band for the show on Friday (Pure Reason Revolution) I took a look at their website. I think just about every rule of usability has been broken on their site. There's every damn thing from mystery meat buttons to nonstandard scroll-bars and this obsession by 'designers' to cram the whole site onto a postage sized Flash applet...yoohoo...my browser has vertical scrollbars can resize and wrap text. All these gimmicks totally distract the user from quickly gleaning information about the band. This is a good example of a web site that sucks. It's a shame because the tune I plan to play is cool but sadly I can't link to the page on the site which has their discography because of flash abuse.
VS.NET/C#/ASP.NET are our main development tools, however over the last couple of weeks I've had to add new functionality to a site that still runs classic ASP code. It's the first time in three+ years since I've written any ASP for any serious purpose and I have to say it's been a painful experience going back to Response.Write debugging - yeh ok it's possible to coerce Interdev, IIS and MTS|COM+ into some kind of configuration to allow debugging of ASP script but I could never utter the incantations properly, balance on one leg long enough and my jaw hurt at that angle. Anyway....I wasn't paying attention and in an include file I had absent mindedly written code that looked something like....
Dim response
response = SendPaymentToGateway(amount, cardnumber, ...blah...)
...for a few seconds it puzzled me as to why calling methods on the Response object, such as Response.Redirect, started throwing the strangest errors:
Microsoft VBScript runtime error '800a01a8'
Object required: 'Response'
ASP just sat there quietly and handed out the rope..... :-)
Tonights show started off looking a bit dodgy because of time constraints this week to get it together, but now looking back at the playlist I think it turned out ok. The strangest track of the night was Basil Kirchin's Sketch 1 from the recently issued Charcoal Sketches/States of Mind CD. The CD comes complete with a recording error from the original masters which upon playing the first time sounded like the CD was knackered. The sleeve notes make a mention of this fault which actually ocurred in the studio when the album was recorded. My fav track of the night was 'Everything is Fixed' by Family of God. It comes from their self-titled album Family of God which sat on my CD shelf for 6 years never getting a proper listen until I dug it out again this week. It's music that's hard describe except to say that it cross cuts mellow ambient trippyness with 60's psychedlia. I think I'll be playing a few more tracks from it over the coming weeks. Rather annoyingly the CD I'd been looking forward to playing this week was the new album 'Set Free' by The American Analogue Set which was released on Monday. Unfortunately play.com, who seem to be the only retailer actually making the effort to stock American Analogue Set releases, are still awaiting stock. Play are a funny bunch. They look and feel like your usual big online retailer and you kinda expect just to see the usual big-label-mainstream-artists in their store but often surprise me by stocking releases that other retailers often won't go near. Anyhoo...here's the playlist for tonight:
Jesus and Mary Chain - Teenage Lust
Tad - Grease Box
Mudhoney - You got It (Keep It Outta My Face)
Stooges - I Wanna Be Your Dog
Stephen Malkmus - No More Shoes
Editors - Blood
Arab Strap - The First Big Weekend
Mogwai - Dial: revenge
Low - If You were Born Today
Silo - Those Adopted By People
Nurse With Wound/Stereolab - Simple Headphone Mind
Super Discount - Prix Choc
King of Woolworths - Delia Derbyshire
Basil Kirchin - Sketch 1
Tangerine Dream - Moments of a Visionary
The Egg - Angel of My Soul
The Postal Service - The District Sleeps Alone Tonight
Engineers - New Horizons
Family of God - Everything Is Fixed
Amon Duul II - Wie Der Wind Am Ende Einer Strasse
Banco De Gaia - Last Train to Lhasa
Well it's been six months since I started doing the radio show. I was reckoning I'd got the measure of the knobs and dials and gotcha's on the studio desk and had the beginning feelings of competancy doing this thing. Then some blob of discrete matter bloody well had to attach itself to the underside of a CD when I wasn't looking. My attentions were elsewhere prefading in another track in my headphones then I realised that there was no sound coming from the on-air monitor...two minutes in, The Egg got stopped in it's tracks then there was the deafening sound of dead air...all 20 seconds of it...ouch.
Anyway this is tonights playlist. I think my fav tracks were 13th Floor Elevators and Silver Apples.
Pere Ubu - Non Alignment Pact
Butthole Surfers - I Saw An X-Ray of a Girl Passing Gas
Mercury Rev - Something For Joey
Malka Spigal - Antimatter
Curve - Chinese Burn
The Knife - Pass This On
Lightning Bolt - Ride The Friendly Skies
Boris - Ibitsu
Stereolab - Moogie Wonderland
Four Tet - Sleep, Eat, Food, Have Visions
Julian Cope - Mystery Trend
Grandaddy - A.M. 180
Electrelane - Film Music
Comets on Fire - Brotherhood of the Harvest
13th Floor Elevators - Slip Inside This House
Quantic - Apricot Morning
Captain Beefheart - I Got Love On My Mind
Nick Drake - Sunday
Wagon Christ - Bend Over
Wire - Pink Flag
Ozric Tentacles - Disolution
The Egg - Angel of my Soul
Silver Apples - Program
Royksopp - What Else Is There?
Took a night off to do normal stuff like drinking beer! Back to normal this week though. If you're in the area (Perth) then tune into 97.5FM at 10pm for 2hrs of top tunes.
This was last night's playlist. Played quite a few 8-10 minute tracks which I couldn't really get away with when it was just a 1hr show. Fave track of the night? Belle and Sebastian's 'Sleep Around The Clock' and Electrelane's 'Film Music'.
Bert Jansch - Strolling Down The Highway
Belle and Sebastian - Sleep Around The Clock
Malcolm Middleton - Loneliness Shines
Television - Marquee Moon
Wolfgang Press - Kansas
Tom Vek - C-C (You Set The Fire In Me)
Ladytron - Sugar
Electrelane - Film Music
The Fall - Hilary
Stephen Malkmus - No More Shoes
Joy Division - Transmission
The Sensational Alex Harvey Band - Framed
The Rezillos - I Can't Stand My Baby
Alien Sex Fiend - I Walk The Line
The American Analogue Set - Hard To Find
The Egg - Angel of My Soul
Tangerine Dream - Stratosfear
Nurse With Wound/Sterolab - Simple Headphone Mind
Kraftwerk - Spacelab
Curve - Chinese Burn
Frank Zappa - Peaches en regalia
Kinda had enough of the .Text wierdness which I'm sure wasn't instrinsic to the .Text code but it just wouldn't work properly here. So I've bitten the bullet and defected to dasBlog.
All in all quite nice. It's also nice having comments back again and dasBlog has HIP-CAP built in too so hopefully no more comment spam.
Another handful of tunes played on the show. Fav track(s) of the night were The Widow/L'Viaquez by The Mars Volta (you should listen to the lyrics...mind bending) and Grandaddy's Collective Dreams of Upper Class Elegance.
Stephen Malkmus - No More Shoes
Low - California
Mogwai - Dial: Revenge
Mogwai - You Don't Know Jesus - Bonus extra track because of finger trouble :)
Black Mountain - Don't Run Our Hearts Around
Explosions In the Sky - Your Hand in Mine
Iron and Wine - Woman King
The Postal Service - The District Sleeps Alone Tonight
The Orb - Perpetual Dawn (Album Version)
The American Analogue Set - Hard To Find
Goldfrapp - Utopia
Arcade Fire - Neighbourhood 2
Polygon Window - Polygon Window
Boards of Canada - In A Beautiful Place Out In The Country
Hawkwind - Master of the Universe
The Mars Volta - The Widow
The Mars Volta - L'Via, L'Viaquez
Tom Vek - The Lower The Sun
Grandaddy - Collective Dreams of Upper Class Elegance
Magoo - East Polar Opposites Meet
The Polyphonic Spree - Light and Day/Reach For the Sun
A bit late but if you're interested this is the playlist from the show a couple of Fridays ago. If not...move along...
The Stooges - I Wanna Be Your Dog
Jesus and Mary Chain - Teenage Lust
Sparkle Horse - It's a Wonderful Life
Malcolm Middleton - Loneliness Shines
Spiritualised -Ladies and Gentlemess We are Floating In Space
Royksopp - What Else Is There
Black Mountain - Don't Run Our Hearts Around
Boards of Canada - Music is Math
Caribou - Bees
Like a Stuntman - King Kongs
The Orb - Ghost Dancing
System 7 - Gliding on Duotone Curves
Kraftwerk - Kling Klang
Grandaddy - A.M. 180
Revolting Cocks - Do Ya Think I'm Sexy
Can - Pinch
Egg - Angel Of My Soul
Engineers - New Horizons
Killing Joke - Like Like Blood
Portishead - Mourning Air
Lush - Light From a Dead Star
I just treated myself to a new toy (excuse the fuzzy photo). It's a Creative Zen Micro which is compatible with Napster To Go which I am about to upgrade to (more on that in a later post). Anyway...the 5GB disk might not seem huge compared to the Zen Touch, iRivers or the rather nice looking Toshiba Gigabeat, but it's enough storage for roughly 1200 tracks at around 3 to 5MB a track. Plenty to keep me entertained whilst cycling, walking and my forthcoming trip to see my wee bro in NZ in October...anything with a bigger disk was another 100GBP and the dimensions became less than comfortable for my pockets.
Another selling point is the built in FM radio (I missed listening to the radio on public transport) which works a treat even in my office which has more RF generating kit than Edinburgh Airport. The unit is solidly put together and I'd even go so far to say that the quality of the built is at least as good if not better than Apple's iPod range.
When re-charging (either from the mains adapter or USB cable) the Zen emits a gentle pulsating blue glow which is aesthetically pleasing to the eye and is a nice touch.
The touch sensitive controls initially took some getting used to, however switching to the least sensitive mode got me past my initial finger trouble. There's also a reassuring click from a built in speaker to give you an audible cue when you've selected a menu option, track etc, though this can be turned off.
The sound quality is also excellent and the headphones that come out of the box are comfortable to wear and give a good sound reproduction. There is also a range of preset EQ settings but you can also customise your own EQ settings from a 5 band graphic equaliser.
Finally, the retail box I bought came with a bonus rigid case with belt clip and desk stand.
All in all I'm well pleased with the Zen Micro and it's huge improvement on my bulky old Zen DAB
Score: 8/10
Despite rebuilding and extensively testing on my dev workstation, .Text still persists in displaying January in the LHS post archive on the deployment box. Wierd...I've checked SQL and all sorts of stuff to make sure that the date formats, localisation etc are correct but this needs more than an hour or so to investigate and fix. I also re-enabled comments with HIP-CAPTCHA but it's not working right either ...the wheels have definitely come off the bus with comments, new or historical.
Time to move on and get my blogging module completed for DotNetNuke I think.
So little time.
Not just content with polluting blogs with comment spam, I just took a look at my referrer list....jeez referrer spam now, heaps of it.....sigh.
Spence continues his take on undocumented interfaces. I'd also like to extend the argument to the use of reflection to get at values and data-structures that, for reasons known only to themselves, designers of libraries chose to remain private.
Before casting any stones, I'll confess that for one project due to the lack of machine parsable data from the XML Validating Reader Schema Exception (lets face it, the Message property is totally unparsable) I had to resort to reflection in the callback to access data in the schema exception that wasn't and still isn't exposed (in FW 1.1) (res and args[]) to enable me to generate both machine and human friendly parse failures. I've haven't checked FW2.0 to see if these values are still present and if not this may present a problem for the dev's maintaining this code under FW2.0 in the future.
Anyone else for humble pie?
Seems I rattled through and fair old set on Friday. If you heard the show then I hope you enjoyed it.
Marilyn Manson - Disposable Teens
Editors - Blood
Ladytron - Sugar
David Holmes - My Mate Paul
Nurse With Wound/Stereolab - Simple Headphone Mind
Boards of Canada - In a Beautiful Place Out in the Country
Silo - Prime Movers
Dead Kennedy's - Winnebago Warrior
The Fall - Black Monk Theme
At The Drive-In - One Armed Scissor
Tom Waits - Hang on Saint Christopher
Fischerspooner - Ritz 107
Manitoba - Hendrix With KO
Battles - HI LO
Hawkwind - Golden Void
Wire - Pink Flag
King Crimson - Starless
King Crimson - Red
Mudhoney - You Got It
Royksopp - What Else Is There?
Boredoms - (spiral)
Boris - Ibitsu
Stephen Malkmus - Pencil Rot
Amon Duul II - Wie der Wind Am Ende Einer Strass
Sadly I've had to turn off comments due to the amount of comment spam. Contact me on k e v i n . k e n n y _a t_ z y g o n i a . n e t if you want me to tack on a comment.
A house move and rejig of some of my IT bits seemed to have unsettled .Text and I finally got round to sorting it. Anyway...moving along...
Spence has a very good article on reasons why you don't go messing with underlying implementations and undocumented API's. I couldn't agree more. You just end up delivering fragile systems to your customer and when the next hotfix, SP or upgrade comes along the rod for your back arrives a-knocking at your door. If the functionality ain't there in the API then let the vendor know and live with it until it does.
If you're in the Perth/Pitlochry/Aberfeldy area then you can tune into my 2 hr slot of eclectic (dare I say) tunes every Friday night from 10pm onwards. The frequency is 97.5FM and the station is Heartland FM . We're also holding an open day tomorrow (30/7/05) from 10am to 4pm where you can come visit the station meet the the folks involved, get a tour and see how things work. I do believe there's a BBQ and liquid refreshments to be had too. I'll be there from about 1pm.
Be sure to visit all the options under "Configuration" in the Admin Menu Bar above. There are 16 themes to choose from, and you can also create your own.
Downloaded over the weekend, and finally got around to installing into a fresh Virtual Server build. Kicked off the install over an hour ago and its still going...but so far so good. Looking forward to getting stuck in later this week. All I can report so far is that the installer looks polished :)
Yep...just noticed the summary of posts by date control is broken always showing January.
Wednesday 23rd Feb
Transactions in .NET 2.0 - Ingo Rammer - http://www.thinktecture.com/staff/ingo/weblog/
Ingo's session covered the present methods of coding transactional components (explicit transactions, implicit transactions using Enterprise Services) and a quick refresher on the DTC and Two-Phase Commit. The .NET 2.0 framework has a new namespace called System.Transactions which provides enhanced support for distributed transactions without the need to inherit from ServicedComponent. The session described the new TransactionScope class which is used in local and distributed implicit transactions and the Transaction class which provides support for explicit transactions. All in all a very good session.
Extending the VS.NET IDE - John Robbins - http://www.wintellect.com/about/instructors/default.aspx#2
The session starting with an intro to building VS.NET macros to automate simple tasks in the IDE. Next we moved onto the IDE extensibility model and all the IDE objects that can be got at e.g. solution and project access, output windows, text manipulation and so on. The session also covered the different types of events that macros and AddIns can be notified of when things happen in the IDE. The last part of the session then covered building fully fledged VS.NET addins and importantly how to overcome some of the hurdles the VS.NET team put in your way when getting started doing this. Another good session and I left with plenty of food for thought on building some addins of my own....yet another SQL Stored Procedure Parameter code generator maybe :) ?
ASP.NET 2.0 Configuration and Instrumentation - Jeff Prosise - http://www.wintellect.com/about/instructors/default.aspx#1
Excellent session covering the new ASP.NET MMC snap-in and WebAdmin.axd tools for configuring ASP.NET which should take the pain out of managing the machine.config and your app's web.config files. We then moved onto the new configuration API features which provide the ability to read and write configuration settings. This API is used by the MMC and WebAdmin.axd tools and gives the programmer strongly typed access to configuration sections. There are too many new neat things to list but I recommend digging around the expanded System.Configuration and System.Web.Configuration namespaces. Next in the session we got into the new ASP.NET 2.0 instrumentation capabilities that provide enhancements such as new perf counters (25 new ones), Windows Event Tracing which facilitates end-to-end tracing of requests through the ASP.NET system and application tracing improvements. We then covered the new config section and HeartBeat event which can be fired at user defined intervals and can be used to gather vital info about the state of your app. The session ended with a couple of demo's on building custom web events that can be wired up to the health monitoring features. One neat one was to ensure that your web.config section (new) was always encrypted.
Script it With ASP.NET 2.0 - Dino Esposito - http://www.wintellect.com/about/instructors/default.aspx#5
Last session of the day and my first proper ASP.NET 2.0 one. Dino covered new features such as script callbacks that allow a page to update it's content without performing a full page refresh, cross page scripting that allow one page to post form values back to a different page, the new HtmlHead class which allows easier access to the tag and its contents, the enhanced HttpBrowserCapabilities class, the new Page.ClientScript property which is used to inject script into ASP.NET pages and finally the new SetFocus() method of the Page class which permits the programmer to assign the initial input focus on a page to the control of his choice..
All in all a pretty interesting day.
|