.Net Dojo: LINQ - A Skeptical Approach

In September 2007 I attended a Microsoft seminar on the new .NET 3.0 libraries.  One of the sessions was on a feature called Linq (pronounced link).  It is best described as a .NET query language that lets you connect to any source (sql, xml, etc) and easily place the data into a custom class.

I have since seen some LINQ tutorials and have played with it myself. I’ll admit that I am an avid .NET fan, but LINQ (to SQL) is just one of those things I thinks is cool but offers very little advantage in most scenarios. There’s a lot you can do with LINQ, but for the most part, plain old untyped datasets and ADO.NET with paramaterized queries/stored procs are just faster, easier, and more flexible.

Windows Home Server: Not for MSDN Subscribers

I have been waiting for Windows Home Server since Microsoft announced the product.  I have been anxious to download it through my MSDN subscription and test it out.  As long time user, fan, and programmer of Microsoft technologies, I like to investigate their products so that I can recommend products to fill the needs of my clients, friends, and family. 

Someone I work with was showing me his copy of Home Server, which he purchased.  Very excited to test it for myself, I went out to MSDN, only to find that it is not available on MSDN.  After a little searching, I found this blog that talks about why WHS is not available on MSDN.

.Net Dojo: Exception Handler

While running one or more ASP.NET websites, it is valuable to have a system where errors encountered by your users are automatically reported so that you can fix them. It is bad practice to let the user’s see the error and it is horribly evil to force them to report the errors themselves. The answer: an automatic exception handler. I developed this handler for use in websites so that any error encountered would be e-mail to a list of developers as well as recorded to the log if desired.

I also give the option of filtering out 404 (Page not found) and 403 (access denied) errors in case you only care about hard exceptions. It the past, I did see one application where we used 404 handling because the structure of the site changed. We implemented an automatic redirection for users who had bookmarks, and we caught 404 errors to find gaps in our redirector.

.Net Dojo: Data Validation

Validating data is a very important part of any application that takes user input. Without validation, users can enter whatever they feel like. This is especially bad when needing specific data, like an e-mail address.

To make things easy for myself, I have all my common validation methods in one library. Validating user input is done using regular expressions. While I do my validation on the backend, it is a common practice to use validators do do much of your validation on the client. This saves the user from having to do a postback to the server only to get an error back. I agree that this is a good practice, but for every javascript validation I do, I also validate it on the server. The reason behind this is that a user can download your html to their computer, strip out the validation, and post to your server. This was something I tested when working on websites for a certain polling and market research company. Because of this flaw, we developed a standard practice to only use required field validators for client side validation and test all other validation on the backend.

.Net Dojo: Forgot Your Password Workflow

As an experienced web developer, I have seen all kinds of crazy login workflows. The security question workflow, however, is the absolute dumbest workflow ever. Not only are most questions geared at public domain information, but how many people are actually going to remember what they typed in for their answer? Also, depending on how good (or bad) the programmers are, if the answer is case senstive, or miss-spelled, you are hosed. I can’t stand sites who use this workflow when there are much better, and more secure ways to allow users to regain control of their account. To learn more about why this type of authentication is bad, read Wish it was Two-Factor by Alex Papadimoulis. He discusses how the secret question does not fullfill two factor authentication by any means.