C# / ASP.net

Is Flanagan’s “Rhino book”, the Petzold of the web era?

Sun, 09 Mar 2008 07:53:14 GMT

10 or so years ago, when one wanted to write a Windows application, you had a choice to make. Does one take the easy way, or the hard way? Were you a real Windows Software Engineer or a wanna be? Did you use Visual Basic, or did you take the time master all the nuances of HWNDs, HDCs, and SendMessage? Was Charles Petzold's seminal Programming Windows book on your bookshelf or not? Did you enjoy the Get a Mac - Gift Exchange ad in which PC gives Mac a copy of the "C++ GUI Programming Guide"?

Today, it seems the web programming world has a evolved into a similar dicotemy. It seems there are lot of ASP.net programmers who are more like the VB programmers of yore, than the C/C++ programmers of eras past.

There are those who avoid getting their hands dirty with Javascript and really don't understand the full power of the browser's DOM. You know the ones that don't even know what byte bloat ASP.net web forms can create, let alone how or why they should avoid it.

Granted, like old Visual Basic, ASP.net web forms is a great tool for writing applications quickly. But the native tongue of Windows is the C/C++ Win32 API, and the best application developers are fluent in it. Likewise, the native tongue of the Web is the Javascript HTML DOM API, and the best application developers exploit every byte of power the web platform can offer application developers and avoid platform abstractions. Like the Windows developers of yore, the best ASP.net applications are written a little closer to the metal than most people are able or willing to go.

I don't know if I really have a point, other than sometimes large frameworks filled with time saving abstractions get in your way, more than they help. Sometimes, you need to get under the hood and get your hands dirty. Sometimes, I wish more developers had the opprotunity to build fast applications, instead of merely developing applications fast.

Return of a Jedi

Wed, 13 Feb 2008 20:55:51 GMT

It was a long, long time ago… It was a time of a great civil war between the Outlook/Office and the Exchange teams… It was a time of great browser wars and much uncertainty... It was an era in which ancient languages such as C++ ruled the galaxy and web browsers weren't considered application development platforms.

It was during this time, I had the opportunity to work on a product that would help redefine web based e-mail and more importantly define what web applications were capable of. I was one of the first developers on the Outlook Web Access team (or as it was known back then, the Exchange Web Client). During 1996-1998, I worked with Bob Gering (R.I.P.) and Jim Van Eaton, where I created the original appointment / meeting request form, the contact form, and the Java date picker. Needless to say, it was the highlight of my professional career at Microsoft.

Unfortunately, during this great civil war, my career ended up following a different path, than that of my good friends, and I joined "the confederacy". During this period, I ended up working on random Office apps in native code, as I meandered around aimlessly from group to group, either working on products I wasn't passionate about or working for managers who were mediocre. After a few years of my career going nowhere, I left Microsoft.

During this time, my friend Qui-Gon Jim (Van Eaton) became the Jedi Master of the Outlook Web Access team, and under his stewardship OWA became the first web application to use the XMLHTTP technology, which is today referred to as AJAX and continued to grow its proud legacy into the great application you know and love today. Unless of course, you use a browser that doesn't suck, in which case you'll never know how good OWA really is, which brings us to the present day.

You see, Microsoft fumbled the ball during the dot com bust. After building a huge market share & mind share lead in the browser wars, Microsoft disbanded the IE team and essentially walked away from improving its client side internet technologies (fortunately, they invented .net during this time, and improved it's server side software, but IE was essentially trapped in a time capsule from 2001-2005). I suppose at the time it seemed like a smart move since AOL purchased Netscape, and neither AOL, Netscape nor the Mozilla foundation were going anywhere. Furthermore, Steve Jobs second coming at Apple was still in its early stages and Google was merely a good search engine and not yet a verb.

Except, at some point during that era, we hit a strategic inflection point. Firefox got invented, kept improving and kept innovating. All while the majority of the former IE team was trapped in the Vista tar pit. In a few short years, IE 6 went from first to worst in mind share, due to the Firefox team playing the tortoise to Microsoft's hare. Even worse, Google took advantage of Microsoft's internet client myopia and made a web e-mail client that worked great on IE and Firefox (and gave away gigabytes of storage space to sweeten the deal). Shortly afterward Apple released Safari, Google released Google Maps, Microsoft released Virtual earth, and the Web was re-born.

Anyway, the OWA team kept innovating during this era of uncertainty, and ended up with a great AJAX client that only worked on IE because when it was designed 1) there were no other browsers that supported AJAX / DHTML except IE and 2) there were no standards to follow because there were no other browsers that had implemented them yet. I suppose myopia played a role as well, but by the time the other browsers gained mind share, the OWA's development plans were already set in Carbonite.

When I was on the OWA team, we supported IE & Netscape equally well (perhaps equally poorly is a better choice of words, because web browsers and web applications were so much simpler & less complex back then). However, during the past 10 years, we've witnessed the rise and fall of Internet Explorer (and possible redemption) and the World Wide Web is once again a chaotic and exciting area of uncertainty and innovation.

So, with that back story, I am now announcing that this epic tale, is taking a new, if small, unexpected twist. Qui-Gon Jim has asked this former Jedi Knight to return to the Rebel Alliance, where we both hope we can defeat Darth Page and Darth Brin of the Google Empire. For the past few years, I've been peacefully living on Tatooine, but Qui-Gon Jim's call to battle was too compelling to resist.

With a lot of hard work, and a little luck, perhaps I shall become a Jedi Master and re-join the Jedi Council. If nothing else, perhaps I'll merely play Han Solo for a few months and pay off Jabba the Hutt.

One thing is for certain, the light saber fights with the Sith are going to be fun to watch and I'm looking forward to seeing something other than IE 6 bugs for next several months. Wish me luck in my old / new job on Microsoft's Outlook Web Access team!

Best ASP.net Interview Question Ever (Part 2)

Sat, 12 Jan 2008 17:59:39 GMT

Last time, I whined about ASP.net byte bloat. As long as I'm bitching about Microsoft's internet platform, I might as well hold nothing back.

Microsoft doesn't care enough about Internet Explorer. It is the red headed step child of Microsoft's internet platform. MS seriously lost a lot of client side credibility and goodwill by disbanding the Windows IE team for 3+ years after Windows XP / IE 6 shipped and letting the Mozilla / Firefox team catch up and surpass it.

I'm sure killing Mac IE & killing Unix IE didn't help matters either (not that anybody ever used them). Shipping a mediocre IE 7 along with a disappointing Vista last year, has further hindered Microsoft's ability to convince people that it does have a great server side web platform and annoyed its supporters. I'm also annoyed that after IE 7 shipped, the IE blog has been less informative during the IE 8 dev cycle than it was during IE 7's. I'm optimistic that after the recent IE 8 Acid Test post, the group is just being quiet instead of dead.

However, barring a Seahawk like comeback by the IE 8 team, my money is on Firefox 3 being the champ in the 2008 browser bowl. Ever since Coach Dave Massy left the IE team, I think they've taken a step backwards. Maybe they need to give IE to Coach Scott Guthrie (GM for all things IIS, ASP.net, Silverlight, and all other MS web technologies that don't suck) or perhaps the GM Windows Live team (Did you know Firefox development is almost completely funded by Google ad revenue?) All I know is that IE is too important to be left in the Windows group. Microsoft needs to show more forward progress and give the season ticket holders reason to be hopeful. Otherwise, IE will be like Shaun Alexander, a browser/back that has a great history and a disappointing present.

OK, I got the big 2 gripes off my chest. Here are some minor ones.

Why does ASP.net AJAX download so many Javascript files? I think there's a new ScriptManager on CodePlex that combines several embedded scripts on a single download. Still, it would've been nice if it was this way by default.

Why is HTTP compression the best kept secret of IIS? Seriously, it seems the vast majority ASP.net programmers don't know about HTTP compression on IIS. Maybe all of my friends read Dilbert instead of Jeff Atwood during their lunch break? OK, it is a pain to configure and providing some UI, like what Port 80 Software's ZipEnable does, would be welcome. People get nervous when I say edit the IIS metabase around them.

Why did I have to wait so long for a real FTP server? Oh well, at least things are better in IIS 7.

As I said, in my first post, on the whole, I'm pretty happy with Microsoft's internet platform. The ASP.net team is adding cool features at a good clip, Silverlight seems like a promising addition to the web developer's tool chest, and IIS 6 has been simple to use & rock solid in deployment. It seems like half of the ASP.net engineering team blogs, so getting that level of transparency is awesome. Visual Studio 2008 & SQL Server 2008 both seem like worthwhile upgrades.

And yet, despite all this coolness, I still have to code work-a-rounds for IE 6 bugs in my day to day life! To be fair to Microsoft, IE 6 was a great browser in 2001. Unfortunately, it's 2008 now and Microsoft fumbled away the web browsing technology dominance it once had. We're all stuck writing apps for a 7 year old web browser, that doesn't compare well to today's best players. Oh well, here's hoping that both IE & 37 will return to All-Pro form next season.

Best ASP.net Interview Question Ever (Part 1)

Sat, 12 Jan 2008 07:56:42 GMT

I recently I had a job interview w/ Costco Wholesale in the e-Commerce group. I thought the most interesting question they asked was "If you could change one thing about ASP.net, what would it be". It was a hard question, because on the whole, I'm pretty happy with it. Furthermore, on the whole, I'm pretty happy with the direction that Microsoft is going. However, it got me thinking about what I don't like about Microsoft's internet platform and I figured it would make a great blog post (or two), so here I go.

Viewstate + ClientID = HTML Bloat + Slow. I don't think the ASP.net forms model is bad; it just makes it much more difficult than necessary to produce small HTML markup in the typical case. For example, let's say I have ASP.net code something like this

<form runat="server">
<asp:Repeater ID="rptCards" runat="Server">
<ItemTemplate>
<asp:Image ID="CardFace" runat="server" /><br />
<asp:Label ID="CardName" runat="server" /><br />
</ItemTemplate>
</asp:Repeater>
</form>

And then I data bind a playing card to my repeater in the code behind file, which ASP.net proceeds to render it as this…

<form name="ctl00" method="post" action="form.aspx" id="ctl00">
 <div>
 <input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" 					
 value="/wEPDwULLTEyODIyNzUwMDAPZBYCAgEPZBYCAgEPFgIeC18hSXRlbUNvdW50AgEWAmYPZBYEAgEPDxY
 CHghJbWFnZVVybAUTL2NhcmRzLmFzcHg/Y2FyZD00NmRkAgMPDxYCHgRUZXh0BQ9RdWVlbiBvZiBIZWFydHNkZ
 GQAQrEoOi46tPS8NZ9nekUDim2+Mg=="/> 
 </div>
 <img id="rptCards_ctl00_CardFace" src="/cards.aspx?card=46" style="border-width:0px;" /><br />
 <span id="rptCards_ctl00_CardName">Queen of Hearts</span><br />
</form>

What's with the <div> surrounding the __VIEWSTATE control? Where did that style="border-width:0px;" come from? Why is there so much damn view state? Why do my Image and Label controls render IDs on the client? And why is it named rptCards_ctl00_CardFace instead of something shorter, such as rptCards_0_CardFace?

Sometimes I have nested repeaters, sometimes I don't. Sometimes I use HTML controls instead of Web Controls, but the issue is the same. The elements in question aren't getting changed on the client and only get changed on the server during the initial HTTP GET during data binding. Normally, the __VIEWSTATE just grows & grows as I add more stuff to the page. OK, you can avoid this by a few well placed EnableViewState="false" or disabling it altogether in web.config. Unfortunately, I don't always know when you really need it, so often times I end up disabling it on a control by control basis in a trial and error fashion, until my app works and my markup is small. Unless you truly understand viewstate, you could end up meeting a fatal end with ViewState-ious of Borg. Fortunately, I understand that problem.

What bothers me more is ID bloat, especially when you nest Repeaters, so an innocent looking <asp:Hyperlink> control ends up with an ID like...

rptMerchants_ctl01_rptShippingMethods_ctl00_rptLineItems_ctl00_ProductName,

That's ugly, so I end up using shorter IDs for Repeaters. Unfortunately, that's not good enough at times, so I usually end up replacing many of my server controls with <asp:Literal> controls and controlling my markup directly. Unfortunately, doing that stops you from using the server control you really wanted to use, and makes complex page development a huge pain.

Ideally, what I'd like is a RenderClientIDs="false" attribute for all ASP.net server controls. After all, the ID isn't sent to the server on the postback (just name / value pairs from form controls). You really only need it on the client if you are doing client side DOM/DHTML manipulation. I know you need a Control ID as a parameter to __doPostBack, but I usually don't need it on the client side HTML markup. It also seems odd that ASP.net is missing a RenderClientIDs attribute since they did have the foresight to create an EnableViewState attribute on server controls.

Most of the time, a Hyperlink control is just an <a> HTML tag, a Label control is just a <span> HTML tag, and an Image control is just an <img> HTML tag, so the ID attribute is just byte bloat running up my bandwidth bill. Why is it so hard to just get this instead?

<img src="/cards.aspx?card=46"/><br />
<span>Queen of Hearts</span><br />

Is there a diet control library I don't know about or some magic web.config setting to stop unneeded ClientIDs from rendering? How does one fight ClientID bloat? Should I just wait for an MVC version of ASP.net? I'm kind of lukewarm on the whole MVC thing because of ignorance and the lingering bad taste of classic ASP. I don't mind paying the ASP.net tax, when it adds more value than byte bloat. It just annoys me, that I have resort to <asp:Literal> controls to avoid paying the ASP.net tax in some cases.

So what are the downsides of MVC ASP.net vs Classic ASP.net? Will my favorite 3rd party ASP.net web control product work on it? Do I just need to read Phil Haack's blog and Scott Hanselman's blog more often? Any idea when an MSDN event will cover MVC ASP.net? Oh well, it beats tracking down memory or COM interface leaks in an ISAPI application for a living.

Toy with Sploggers w/ Dynamic Images

Sat, 12 May 2007 16:15:59 GMT

Over at my second home, I talked about how to annoy sploggers w/ a dynamic image. A dynamic image is merely any image generated programmatically at request time. So with a dynamic image, you have total control of the content that will get displayed when the url gets requested.

Typically, when a splogger copies a blog post, they often times leave all the original hyperlinks and images links intact. Sploggers are lazy folks. If they are too lazy to write their own blog post, they are usually too lazy to edit yours. So if they do hotlink to an image on your server, they are now dependent on your server to serve that image request. And this is why we can change the image out from underneath them and have fun with them.

If you're interested in more background on this sort of thing, I'd recommend you check out Scot Hanselman's Computer Zen blog post on HttpHandlers. Anyway, here's how my variation worked…

This first thing I did is write code to generate a text warning message… Nearly all modern web development frameworks have the ability to generate images on the fly, and put the generated bitmap on the request's response stream. So here's some C# code that draws some text in a solid colored rectangle.

public Bitmap GetSploggerWarning(string text)
{
    // Create the objects we need for drawing
    Bitmap bmp = new Bitmap(350, 200);
    Graphics gr = System.Drawing.Graphics.FromImage(bmp);
 
    // Create our background colored rectangle
    SolidBrush fill = new SolidBrush(Color.Purple);
    Rectangle rect = new Rectangle(0, 0, 350, 200);
    gr.FillRectangle(fill, rect);
 
    // Draw our text so it's big, centered & anti-aliased
    Font font = new Font("Arial", 24, GraphicsUnit.Pixel);
    SolidBrush textbrush = new SolidBrush(Color.White);
    gr.TextRenderingHint = TextRenderingHint.AntiAlias;
    StringFormat stringFormat = new StringFormat();
    stringFormat.Alignment = StringAlignment.Center;
    stringFormat.LineAlignment = StringAlignment.Center;
    gr.DrawString(text, font, textbrush, rect, stringFormat);
 
    // Clean up our mess and return the image
    gr.Dispose();
    return bmp;
}

OK, now that we have the images we want to use, we need to write code which will generate a different image depending on the circumstance. So, what I did is look at the HTTP_REFERER header from the current request. If a web browser requests an image from a web page, it will usually place the url of the page which is requesting the image in the HTTP_REFERER header. However if a web browser requests the image directly you may not get that header in the request. Also, I've read that Norton Internet Security strips out the header and I'm sure proxy servers that muck with the headers too. In short, you can't count on that header being there.

Also, it's important to note that the value in this header can't be trusted. If the image is being requested by web browser there's a good chance it'll have the value you expect. However, there's nothing preventing a hacker from creating an HTTP request that is identical to the one a page from your domain would create. So, it's is really only effective if they retrieve the image from a sploggers web page.

public void ProcessRequest(HttpContext context)
{
    HttpRequest Request = context.Request;
    HttpResponse Response = context.Response;
    Bitmap bmp;
    string message = String.Empty;       
    string hostingdomain = "raincityguide.com";
 
    if (Request.UrlReferrer == null)
    {
        // Handle the case of the image not being on a web page
        bmp = GetSploggerWarning("Don't SPLOG!\n Fight SPLOG!");
    }
    else if (!Request.UrlReferrer.Host.EndsWith(hostingdomain))
    {
        // Handle the case of another domain's page, using my image
        message = String.Format("{0} is a SPLOG! Please visit {1}.",
            Request.UrlReferrer.Host,
            hostingdomain);
 
        bmp = GetSploggerWarning(message);
    }
    else
    {
        // Handle the case my domain's page, using my image
        message = String.Format("This image was paid for by {0} " +
            "and I approve of its hosting.",            
            hostingdomain);
        bmp = GetSploggerWarning(message);
    }

    // To be continued… 

OK, now that we got our image, we gotta send it across the wire. The only tricky part is that we have to tell the browser not to cache the image, since otherwise; the browser will reuse the image regardless of the domain it's being hosted on. So if somebody visits your blog and then the splog, it's likely the browser would display the same image in both places because the browser cached the original image, and re-uses it if somebody else refers to it.

    // Set the content type and return the image
    Response.Clear();
    Response.ContentType = "image/png";
 
    // Check out http://www.hanselman.com/blog/ABoilerplateHttpHandler.aspx
    Response.Cache.SetExpires(DateTime.MinValue);
    Response.Cache.SetNoStore();
    Response.Cache.SetCacheability(HttpCacheability.NoCache);
 
    // To Save a bitmap as PNG, we need a seekable stream, otherwise we
    // get a GDI exception. Visit Asp alliance for more details 
    MemoryStream MemStream = new MemoryStream();
    bmp.Save(MemStream, ImageFormat.Png);
    MemStream.WriteTo(Response.OutputStream);
 
    // dispose of our objects
    bmp.Dispose();
}

Anyway, it's not an industrial strength approach but it's enough to stop the causal splogger from stealing content again. For an industrial strength solution, you'd have to combine this approach with IP black/white and IP geo-location and other tricks that products like Port 80 software's LinkDeny employ.

And if Mr. Haack reads this and gets around to creating a world class plug-in model for SubText, I'd be happy to contribute a basic anti-leach / anti-splog plug-in for it. It's not fair that the WordPress kids have all the fun.

Is there a better way to compute a Median in SQL?

Tue, 01 May 2007 15:38:58 GMT

I'm currently playing with random ideas I have for Nimitz (aka the next version of my NWMLS search tool), and one of the things I'm thinking about is displaying the Median value of properties that match an arbitrary search criteria. I already do something similar to this now on Zearch (the current version of my NWMLS search tool). with MIN, MAX, and AVG. So I wrote a Stored Proc (using MS SQL 2005 features), and came up with the following. (FYI - I was inspired by this blog post).

   1:  CREATE  PROC [dbo].[GetMedian]

   2:  (

   3:      @Col varchar(100),

   4:      @Table varchar(100),

   5:      @SqlWhere  varchar(1000)

   6:  )

   7:  AS

   8:  BEGIN

9:

  10:      DECLARE @Count AS INT, @MiddleRow AS INT, @Median AS INT

  11:      DECLARE @SqlAll nvarchar(MAX)

12:

  13:      SET @SqlAll = 'WITH MLSSTATS AS '

  14:      SET @SqlAll = @SqlAll + '('

  15:      SET @SqlAll = @SqlAll + 'SELECT ROW_NUMBER() OVER (ORDER BY ' + @Col

  16:      SET @SqlAll = @SqlAll + ' DESC ) AS RowNum , '

  17:      SET @SqlAll = @SqlAll + '(SELECT COUNT(*) FROM ' +@Table + ' '

  18:      SET @SqlAll = @SqlAll + @SqlWhere + ') As Cnt,'

  19:      SET @SqlAll = @SqlAll + @Col

  20:      SET @SqlAll = @SqlAll + ' FROM ' + @Table + ' ' + @SqlWhere

  21:      SET @SqlAll = @SqlAll + ') '

  22:      SET @SqlAll = @SqlAll + 'select AVG(' + @Col +') from MLSSTATS '

  23:      SET @SqlAll = @SqlAll + 'where rownum  IN((Cnt + 1) / 2, (Cnt + 2) / 2)'

24:

25:

  26:      EXEC sp_executesql @SqlAll

  27:  END

So if, let's say, I wanted to find the median value of all the houses currently listed in the city of Redmond, I'd do something like this...

   1:  GetMedian 'ListPrice', 'MLSTABLE', 'WHERE City in (''Redmond'')'

And then the proc would do it's dynamic SQL black magic and end up executing this...

   1:  WITH MLSSTATS AS

   2:  (

   3:  SELECT ROW_NUMBER() OVER (ORDER BY ListPrice DESC ) AS RowNum ,

   4:  (SELECT COUNT(*) FROM MLSTABLE WHERE City in ('Redmond')) As Cnt,

   5:  ListPrice

   6:  FROM MLSTABLE

   7:  WHERE City in ('Redmond')

   8:  )

   9:  select AVG(ListPrice)

  10:  from MLSSTATS

  11:  where rownum  IN((Cnt + 1) / 2, (Cnt + 2) / 2)

The SQL is ugly, but that's that nature of the beast. Anyway, the problem is that I really want do to this...

   1:  SELECT AVG(listprice), MEDIAN('ListPrice', 'MLSTABLE', 'WHERE City = ''Redmond''')

   2:  FROM MLSTABLE

   3:  WHERE City = 'Redmond'

Or better yet, try to implement Median as a user defined aggregate function in C# / CLR language so it's even easier to use like so...

   1:  SELECT AVG(listprice), MEDIAN(ListPrice)

   2:  FROM MLSTABLE

   3:  WHERE City = 'Redmond'

According the above blog post it can't be done in a CLR language (which I don't understand). I guess user defined aggregates written in a CLR language only get the values of a set one at a time, instead of the entire set (which you would obviously need to compute a median)? Either way, I'm wondering if there's a way to convert my ugly proc into an ugly function instead? I think what's tripping me up, is that I need to define a variable that's accessible from dynamic SQL and returnable from the function that calls it.