Guathon 2011

Monday this week saw this years Guathon in London, a day of technical presentations from St Scott of Guthrie, ably assisted this year by Steve Sanderson. The event is free and held in a cinema - now I know how big I want my next monitor to be :-) Unfortunately, due to Microsoft's lack of organisation in changing the venue at the last minute, there were lots of empty seats and many more developers could have attended. This year Scott did the first and last sessions, with Steve covering the late-morning/early-afternoon shifts.

Build An App Using ASP.NET MVC 3, EF Code First, NuGet, and IIS

The first session (which due to National Express East Anglia's incompetence I missed the start of) was Scott covering some of the features of MVC3/Razor and Code-First Entity Framework. This was probably the session I got the most out of all day, as I haven't done any MVC/EF in anger yet there was a lot of value here for me. Key points I took away were:
Razor syntax
@ - starts a code block
@:  - is the prefix for a string literal e.g. if you want to output some HTML inside a code block
There is detection for the @ symbol inside an email address that means it automatically renders a mailto: link
@@ - acts as an escape character
@helper - one of the biggest things for me, I've never seen this before. @helper allows you to write a helper method that acts like a method but with Razor syntax so you can call the helper to display a canned piece of HTML. Helpers can be declared in-line or in a partial class within the App_Code folder. Scott also mentioned that David Ebbo (@davidebbo) has a project on his website that allows you to write helpers that are compiled into an assembly. It's actually now on CodePlex at http://razorgenerator.codeplex.com/.
@model -By default the Model variable in a page is of the dynamic type, which means at design-time you don't get (much) Intellisense from it, however an @model declaration at the top of the page allows you to specify the exact type of Model, and you then get proper Intellisense support. If you create the View as a strongly-typed view and select the concrete type the View will support, it puts an @model declaration in for you.
_ViewStart.cshtml - Allows you to setup defaults for a set of views, including setting the _Layout.cshtml page. Someone asked whether you can have multiple _ViewStarts, Scott didn't know but was surprised when someone else said that you can. Gunnar Peipman's blog makes this clear - a _ViewStart is scoped to the folder that it is in.
_Layout.cshtml - The Razor equivalent of an ASP.NET Master page.

Scott also showed off a couple of tools:
Modernizr.js - allows you to detect which HTML5 and CSS3 features are supported on the browser instead of detecting these from the User-Agent string. Scott also showed off some HTML5 features in his demos, to which somebody asked if you could use those outside Razor. Scott's reply? "Yes, you can open your project and start typing the HTML5 tags" :-)
Glimpse - "FireBug for your server" is the best description of this tool. It shows you on the client what is happening on your server, how your server is configured. And I confess I'm pleased to see this is currently available for ASP.NET only, I'd assumed it was something other frameworks had had for a while but it seems not.

Dynamic Web UIs with Knockout.js
Steve's first session covered Knockout.js, an MVVM framework that works with any JSON feed. I think I may have misunderstood the principle behind this, it seemed to me to be largely another jQuery templating framework, although looking on the website it says that you can use your choice of templating engine. Talking to others in the evening though, there seem to be other concerns around Knockout - lack of testability and accessibility were the principal ones, and no degradation support means for me I'm unlikely to use Knockout. Plus I'm primarily a server-side guy - I can do some jQuery but right now I don't have the bandwidth to learn another JavaScript framework.

C#5 and Asynchronous Web Applications
After lunch Steve was on again, demoing some of the asynchronous bits that are coming in C#5. Steve talked about polling, long polling and sockets. The difference between these is as follows (I've probably got these wrong, if I have someone please tell me so I don't look a complete Muppet):

• polling - call a service at a regular interval e.g. every second, the service returns any changes made since the last call.
• long polling - call a service, the call doesn't return until the service has some data to return to the client, however long this takes.
• sockets - opens a channel between the caller and a service and the service then returns data to the client whenever it has any, keeping the channel open.

Of these sockets is the best, however there is currently limited support for it on browsers so we won't see this go mainstream for a little while yet. 


Cloud Development
The last session of the day saw Scott back on the podium talking about developing for the cloud and Windows Azure. Scott has recently taken on management of the Azure team, although this was badly publicised as it sounded like Scott had moved away from ASP.NET and all the other things he was managing - this is not so, he's still in charge of ASP.NET and everything else, the Azure stuff is in addition to, not instead of. Scott talked about and showed off a lot of the infrastructure behind Azure, including fun facts like:

• the ratio of servers to staff in the data centres is 15 000:1
• the centres are constructed from containers
• the newer containers they are deploying don't have roofs which saves a lot of energy on cooling
• for every watt of energy that powers a server, they only use an additional 0.1 of a watt on ancillary usage such as heating/cooling etc

This gives you a much lower TCO when you use services in the cloud, however Scott came out with the quote of the day when talking about this:

"Developers don't care about money, we just care about developing cool stuff."

Employers, take note...

Scott demo'ed developing an ASP.NET application to be hosted in the cloud and showed the steps necessary to set this up. I was interested to hear that there is/will be a PowerShell commandlet for deploying solutions to your Azure setup.

Scott showed off some forthcoming technology on Azure, a Queuing service allowing you to de-couple parts of your business processes, which was interesting and made me wonder whether Microsoft might be thinking of putting some of the BizTalk infrastructure in the cloud. This would be a big win, I think, in terms of making BizTalk a more accessible technology and getting more take-up - we looked at BizTalk for a project a couple of years ago but the costs for setting up BizTalk on-site are currently prohibitive.

Scott presented a mini-case study on EasyJet - they host their applications in the cloud and then connect to them in airports using local WiFi, which saves them money on having to setup infrastructure in every airport they operate in.

Scott touched on the Azure AppFabric caching service, which I'm interested to know more about - I'm still fuzzy on the benefits. The throughput rate for the caching service is 4Tb/s - not too shabby. Scott also mentioned, almost, as my old German teacher would say, en passant, that Microsoft will shortly be rolling out a Content Delivery Network service on the Azure infrastructure, which is something I find really exciting. But maybe I'm just sad that way...

Thanks to Scott and Steve for presenting, Phil and Dave for organising it all, and Paul, Nathan, Johan and Dan for the conversation over dinner at TGIs!

Making a Hybrid Web Application Project Type

Like so many of my blog entries, I've been meaning to write this one for weeks. Ever since Scott Hanselman wrote Integrating ASP.NET MVC 3 into existing upgraded ASP.NET 4 Web Forms applications, in fact. Scott just wrote an updated post on using NuGet to bring the MVC bits into a WebForms application, which is a muc easier way to do it. But to me, Scott's still missing the final piece of the puzzle which is: do this once, create it a project type from it, and forget about it.



So, creating a hybrid project type. First of all, go do Scott's NuGet stuff and create your hybrid application. Oh, and add any of your other favourite references - NHibernate, CastleWindsor, whatever. It's OK, I'll wait.
 
Done that. Good.
 
Now click File|Export Template... and open the Export Template Wizard. Check the 'Project Template' radio button so we export the hybrid project as a template. Click Next.
 

On the second screen, enter a suitable name for the project type and description, and choose an icon if you want.

Click Finish and you're done!

A Good Day

Yesterday had an inauspicious start when the alarm went at 6am. I woke my wife up (again) when getting dressed. And when I got to the station I didn't have time to go to the shop and get a paper to read on the train.

But then...

The ticket inspector had an unexpected sense of humour.

A totally hot woman sat next to me on the train.

I wrote a StackOverflow answer on the hateful editor on my phone. 

And it was accepted.

Getting off the train I bumped into an ex-colleague I haven't seen for four or five years.

I got to spend the whole day getting my geek on watching ScottGu present on VS2010, ASP.NET 4, EF4 and MVC...

Amusingly, as I was waiting outside the cinema an American girl walked past and I heard her say 'must be a premiere' - I wonder how she'd have reacted if I'd told her we were all waiting to see a man from Microsoft...

VS2010 and ASP.NET 4

The first session was on what's in VS2010 and ASP.NET 4. As I've been using VS2010 since April I wasn't sure just how much I'd get from this session - the answer was, obviously, loads. 

I've already been using the HTML snippets, but now I know that there's a setting where I can turn off the requirement for an angle bracket before VS offers to complete the tag for me. What I didn't know is that there's a set of snippets for JavaScript as well. And a set for jQuery. 

We all learned that Scott doesn't like regions round his privates - cue much sniggering, I'm not sure it means quite the same thing in the States. But the learning point was that if you like regions done one way and your team mate prefers another, you can have regions that are private to you and won't show up when your colleague opens the file in VS. Ctrl + M, Ctrl + K is the keystroke to create one of these. 

Someone asked if there's a way to label these regions, to which the answer is no, however someone else pointed out that if you put a comment at the top of the region, it can work as a label when you hover over the collapsed region.

I picked up a bundle of new shortcut keys.

Collapse all regions - Ctrl + M, Ctrl + O

Incremental Search - Ctrl + I

Navigate files - Ctrl + Alt + Down Arrow

Navigate to - Ctrl + ,

View Call Hierarchy - Ctrl + K, Ctrl + T

Scott demoed some of the debugging features in VS2010, including pinning of watched variables, conditional breakpoints where the debugger only stops on a certain Boolean condition. And trace points, which allow you to write debugging messages to a TraceListener - optionally you can also continue executing your code, which neatly handles debugging a multi-threaded situation where breaking into the debugger hides the bug you're actually trying to find (the Heisenberg uncertainty principle in action!).
Scott showed how to use the ASP.NET Routing module in WebForms (the same one as used in ASP.NET MVC), and also showed off some of the deployment features, especially the Transforms which allow you to generate custom web.config files for different environments. Scott also told us that in the next couple of weeks there will be a new hosting gallery appearing on http://asp.net, which will allow you to search for a web host based on features they support.

MVC2 & EF4

I've seen a number of sessions in the last year on MVC and Entity Framework, but this was the first time I actually felt I was starting to 'get' it. I should have Scott sat next to me at work, think how much more productive I'd be!
Due to popular demand (and some well-publicised issues with the registration system for the day), Scott built a system based around developer events. For this session Scott started with a database, and built an entity model from it, then showed some of the features in MVC for displaying and editing data from the model. Highlights for me were the ease of allowing client-side validation - <% HTML.EnableClientValidation %>. That's it, one line of code!I was also very impressed with the scaffolding feature that allows you to build an editor page really quickly for a model. Whereas previously, you'd have written something like <% Html.TextBoxFor(fieldname) %> and the page will output a text-type INPUT tag (where field name is a string value), you can use the scaffolding to say <% Html.EditorFor(fieldname) %>, and the page will output a field appropriate to the data type of the field - a textbox for a string field, a checkbox for a Boolean field etc. And you can take this a level further - if you write <% Html.EditorFor(model) %>, ASP.NET iterates over the class and outputs the set of controls necessary to display and edit all the fields in the class - seriously cool.
In a large application, the number of controllers and views can grow so large as to make it difficult to pick a particular one out of the clutter, so Scott demonstrated how you can split an application up into Areas which allow you to group sets of controllers and views together to make it more manageable. Finally in this session Scott showed off some of the unit testing features. This included the gems that the 'Do you want to create unit tests' dialog when you create a new project is referred to as the 'Guilt' dialog, and the 'No I don't want to create unit tests' radio button is known as the 'I suck' button.

Windows Phone 7
After lunch, Scott took a (well-deserved) break and handed over to Mike Ormond to talk about Windows Phone 7. There are two programming models available for WP7, one in Silverlight and one in XNA. The Silverlight model should be used for event-driven type applications, the XNA one is more suited for time-driven apps e.g. game. However both types of apps can use features from the other if necessary. Mike also talked about how applications are distributed to a device, however what wasn't completely clear to me was how, as a corporate developer, if I write an app to be used internally to the company, I distribute the app and whether or not I have to release it to the marketplace. I was, mostly, quite intrigued about the platform as a whole - maybe later in the year I'll look more closely into developing for it.

Web Futures
The final session saw Scott back and talking about a number of the things that should be released by Microsoft later in the year, including IIS Express, MVC3, code-first Entity Framework and Razor. Of these, the ones that interested me most are IIS Express, and code-first EF. IIS Express I'm looking forward to as it will allow us to locally test our SSL pages (it comes with a local certificate). Code-first EF was interesting, although having not done any EF work I don't really know how much difference it would make. Similarly with Razor, I haven't done any MVC so I couldn't really appreciate the differences. Finally Scott showed off some TDD and in ten minutes explained Dependency Injection. I've been reading odd bits around DI over the last year, but I can honestly say I picked up more in that ten minutes than I did over the preceding 12 months!

And then we went to the pub with Scott to interrogate him, in which:

I learned that Dependency Injection and Inversion of Control are (more or less) the same thing. 

We were all amazed at how much of Microsoft ScottGu runs.

I learned the year the HTML 4 spec was ratified, though Dave Sussman says I can't tell anyone this.

It was A Good Day.

What I Learned Last Week

I went down to London twice last week for user groups; VBUG on Tuesday for 'How To Stop Your Website Being Stung', and DNUG on Thursday for 'WebForms vs MVC'.

How To Stop Your Website Being Stung

I was pleased to see this session from the ever-present Barry Dorrans as I'd wanted to see it at WebDD but went to Andy Westgarth's session instead. Barry took us through the OWASP Top Ten list of web application vulnerabilities, and demonstrated how to mitigate against them in code. This was a really good session for me as it's directly relevant to some security testing I've been involved with recently. Among the highlights were:

• Use the PrincipalPermission attribute to protect your code.
• When outputting user-entered content, HTMLEncode it - this protects you against persistent cross-site scripting that makes it past your input checking.
• Use the AntiXSS library's HTMLEncode method rather than the HttpServerUtility object's version as the AntiXSS library has more tests.
• Don't trust MIME types for uploaded files - I didn't know you could futz with this, although in retrospect I don't know why I'm surprised either.. And obviously never trust the uploaded file's extension (hangs head in shame).
• Use salts every time you do any form of encryption.
• Don't leak information. This could be through viewstate, or a YSOD.
• Pages have an OnError event, which you can use to call Server.Transfer to switch to your error screen, which doesn't indicate to the client that an error occurred.

And those are just the points I noted down, there was lots more good info. Barry's slides are available here, and the code samples are here.

WebForms vs MVC
I'd been looking forward to this meeting for a couple of weeks, and I wasn't disappointed. Billed as Clash of the Titans, this featured Phil Winstanley speaking for WebForms and Sebastian Lambla on the side of MVC. It was the first time I've seen Seb present, and he's, um, energetic :-) I thought Seb got sidetracked into more of a TDD demonstration halfway through rather than keeping on topic with MVC. It was interesting to see Phil do some ASP.NET testing with WaTiN - it's something I must look at. There's a DDD session waiting to happen for someone to do some comparisons between WaTiN, Selenium and the Lightweight Test Framework - ASP.NET Testing Smackdown anyone? Nice to see SessionPageStatePersister make an appearance too - everyone should use it!

As holder of the WebForms Thumb (you had to be there!) I'd love to report that Phil carried the day, however commentators agreed it was a draw, but it would be interesting (hint hint guys!) to see a 'rematch' once there is some guidance on what types of application suit either school of thought - this is definitely the weak spot with MVC right now.