Broken Thoughts

I have been waiting for Windows Home Server since Microsoft announced the product.  I have been anxious to download it through my MSDN subscription and test it out.  As long time user, fan, and programmer of Microsoft technologies, I like to investigate their products so that I can recommend products to fill the needs of my clients, friends, and family. 

Someone I work with was showing me his copy of Home Server, which he purchased.  Very excited to test it for myself, I went out to MSDN, only to find that it is not available on MSDN.  After a little searching, I found this blog that talks about why WHS is not available on MSDN.
Read more »

While running one or more ASP.NET websites, it is valuable to have a system where errors encountered by your users are automatically reported so that you can fix them. It is bad practice to let the user’s see the error and it is horribly evil to force them to report the errors themselves. The answer: an automatic exception handler. I developed this handler for use in websites so that any error encountered would be e-mail to a list of developers as well as recorded to the log if desired.

I also give the option of filtering out 404 (Page not found) and 403 (access denied) errors in case you only care about hard exceptions. It the past, I did see one application where we used 404 handling because the structure of the site changed. We implemented an automatic redirection for users who had bookmarks, and we caught 404 errors to find gaps in our redirector.

Read more »

Validating data is a very important part of any application that takes user input. Without validation, users can enter whatever they feel like. This is especially bad when needing specific data, like an e-mail address.

To make things easy for myself, I have all my common validation methods in one library. Validating user input is done using regular expressions. While I do my validation on the backend, it is a common practice to use validators do do much of your validation on the client. This saves the user from having to do a postback to the server only to get an error back. I agree that this is a good practice, but for every javascript validation I do, I also validate it on the server. The reason behind this is that a user can download your html to their computer, strip out the validation, and post to your server. This was something I tested when working on websites for a certain polling and market research company. Because of this flaw, we developed a standard practice to only use required field validators for client side validation and test all other validation on the backend.
Read more »

As an experienced web developer, I have seen all kinds of crazy login workflows. The security question workflow, however, is the absolute dumbest workflow ever. Not only are most questions geared at public domain information, but how many people are actually going to remember what they typed in for their answer? Also, depending on how good (or bad) the programmers are, if the answer is case senstive, or miss-spelled, you are hosed. I can’t stand sites who use this workflow when there are much better, and more secure ways to allow users to regain control of their account. To learn more about why this type of authentication is bad, read Wish it was Two-Factor by Alex Papadimoulis. He discusses how the secret question does not fullfill two factor authentication by any means.
Read more »

A best practice in .Net development is to have as much of your code in reusable libraries as possible. This cuts down on development time and helps enforce business standards across all applications. One problem however is that sometimes reusable libraries need to have a few customizations. The easiest way is to create a Settings file and set each property through the use of the app.config or web.config.

A more complicated solution is to create your own custom configurations. In my case, I have an enormous library that consists of different parts. I have database tools, data caching, encryption, cookie management, querystring management, Infocard support, email wrappers, as well as several other useful tools. Being a perfectionist, I like to have my settings split out by the piece they belong to. Sure, there is more xml in the config file, but, if I only want to use one section of my code I don’t need to have the whole configuration. Plus, having the configurations split out means I can easily split my library up into multiple DLL’s down the road.
Read more »