Daptivate > by Kyle Beyer

Top 10 Best Practices for Production ASP.NET Applications

admin — Wed, 13 Feb 2008 05:55:00 GMT

In no particular order, here are the top ten things I've learned to pay attention to when dealing with production ASP.NET applications. Hopefully they will help you save you some time and headaches. As always, your thoughts and additions are welcome.

1. Generate new encryption keys

When moving an application to production for the first time it is a good idea to generate new encryption keys. This includes the machine validation key and decryption key as well as any other custom keys your application may be using. There is an article on CodeProject that talks about generating machineKeys specifically that should be helpful with this.

2. Encrypt sensitive sections of your web.config

This includes both the connection string and machine key sections. See Scott Guthrie's post for some good references. Note that if your application runs in a clustered environment you will need to share a custom key using the RSA provider as described in an MSDN article.

3. Use trusted SQL connections

Both Barry Dorrans and Alex Chang have articles which discuss this in detail.

4. Set retail="true" in your machine.config

configuration

system.web

deployment

retail

"true"

system.web

configuration

Scott Guthrie's post

MSDN reference

5. Create a new application pool for your site

When setting up your new site for the first time do not share an existing application pool. Create a new application pool which will be used by only by the new web application.

6. Set the memory limit for your application pool

When creating the application pool, specifically set the memory limit rather than the time limit which is set by default. Asp.net has a good whitepaper which explains the value of this:

By default IIS 6.0 does not set a limit on the amount of memory that IIS is allowed to use. ASP.NET’s Cache feature relies on a limitation of memory so the Cache can proactively remove unused items from memory.
It is recommended that you configure the memory recycling feature of IIS 6.0.

7. Create and appropriately use an app_Offline.htm file

There are many benefits to using this file. It provides an easy way to take your application offline in a somewhat user friendly way (you can at least have a pretty explanation) while fixing critical issues or pushing a major update. It also forces an application restart in case you forget to do this for a deployment. Once again, ScottGu is the best source for more information on this.

8. Develop a repeatable deployment process and automate it

It is way too easy to make mistakes when deploying any type of software. This is especially the case with software that uses configuration files that may be different between the development, staging, or production environments. I would argue that the process you come up with is not nearly as important as it being easily repeatable and automated. You can fine tune the process as needed, but you don't want a simple typo to bring a site down.

9. Build and reference release versions of all assemblies

In addition to making sure ASP.NET is not configured in debug mode, also make sure that your assemblies are not debug assemblies. There are of course exceptions if you are trying to solve a unique issue in your production environment ... but in most cases you should always deploy with release builds for all assemblies.

10. Load test

This goes without saying. Inevitably, good load testing will uncover threading and memory issues not otherwise considered.

Need a better way to manage your content?

An Experiment in Emotional Intelligence

admin — Thu, 31 Jan 2008 09:18:59 GMT

While flipping through some old notes, I was reminded of another idea that was discussed: Emotional Intelligence.

Over the course of the semester, we investigated the value of Emotional Intelligence through several exercises and were challenged to try them at work and discuss the results. I do remember one "experiment" in particular.

A Little Background

At the time, I was working on a software application which included a moving map component. The importance of this component, led our team to invest a lot of time and effort in finding the right solution. This included an inventory of similar software applications within our company and partner companies. We ended up choosing to partner with a company and integrate their map software into our application.

It worked very well. Their mapping software met most of our needs and they were willing to make changes based on our constraints, etc. In fact, we successfully performed several demonstrations of the application and developed a strong partnership with the mapping software provider.

Around the time our project started rolling along, another team within the division requested a meeting to discuss how they could leverage our new application. This sounded like a great opportunity. We could share the work we had done and allow another project to benefit.

The Cold Hard Truth

As I soon learned, they really didn't want to use our application at all. Sure, they were interested in the work we had done and what tools we had used, but they were most interested in showing off their ingenious software solution. They were most interested in trying to convince us to use their home brewed moving map application.

It was obvious that learning of similar projects and collaborating with other teams was not a priority. The effort to connect began after they had already started pouring the foundation of the project rather than before.

I was livid. This was the exact cultural behavior that our team had been trying to overturn ever since I started working there: the tendency for engineers to always start from scratch. The idea that the only way an engineer could prove themselves worthy was to re-engineer something that had already been proven successful. The mentality that if our company didn't build it, then it must be crap.

But what did I know? I was the new kid on the block.

The Experiment

As insulting as it was, and rather than draw quick conclusions, I simply soaked in all the information I could about their project and its "attractive" features. I asked lots of questions and tried to understand their perspective and their understanding of the problem. The bottom line is that instead of allowing my emotional reaction to close my reasoning I attempted to create space to respond.

This was the essence of the exercise the professor challenged us with: when you find yourself in a frustrating situation and you feel your emotions taking over reason, give yourself space. The idea wasn't that your emotional reaction is always wrong, but rather that giving yourself space enables clearer thinking.

So, I was experimenting with this Emotional Intelligence thing. I wanted to see if it had any value.

The Results

That evening, I couldn't stop thinking about the meeting. I just kept running over and over in my head how there must be an approach that would be a win win. An approach that would enable a common moving map component to be shared by both applications. An approach that, however counter-cultural, would be embraced by both teams.

The next day I had a fresh perspective and realized that I had been thinking about the problem from the wrong angle. Instead of getting so caught up in the moving map component, which my team had put so much energy into perfecting, the real focus should have been on the *integration* of the moving map into our software applications.

The reality was that our applications would be using the moving map in different ways. One was for a virtual simulation, and one was for real-time usage. This in turn, made us value features differently. For example, performance was very important for our application while map data configuration was more important for their application.

This change in perspective revealed an obvious way for our teams to work together and create synergy. Instead of allowing frustration to push us into creating yet another project island, we ended up developing a strong working relationship and continued our progress towards a more open and collaborative culture.

The Take-away

There are two simple lessons I hold onto from that experience.

Tear down those hidden information silos.
Give yourself the space to breathe.

Notes from Years Past

admin — Wed, 30 Jan 2008 04:05:48 GMT

I was cleaning out some files a while ago and came across notes from a leadership class I took several years back. The notes read:

* do the following once a day to reflect on the current status of a project *

DO - What have you done/observed so far?
STUDY/REFLECT - What did you learn from that event/observation?
CONNECT/SYNTHESIZE - How does this connect with what you already know?
PLAN - What will you do differently now?

Common sense really. And probably the natural way most of us approach continuous learning. Yet I find myself often following these steps:

Huh.

WHOA! You don't talk to me directly!

admin — Wed, 23 Jan 2008 19:28:59 GMT

A few days ago, the Daily Dilbert really resonated with me. They usually are pretty funny; and even funnier when you've directly experienced what Scott Adams is poking fun at.

When I read this, I was reminded of an experience I had while working at Lockheed. Lockheed had (and probably still has) a tradition of giving employees gifts on employment anniversaries. The one year gift was a nice pen with a fancy logo on it accompanied by a congratulatory letter.

Now, the thing that surprised me most about this gift was not the fact that we already had free pens available in our supply cabinet, but rather the contents of the letter. The letter was addressed directly to me from the Vice President of Engineering. And in it there was a personal invitation (quoted directly from the letter):

As your anniversary is recognized, I would like to take this opportunity to ask you for your honest and open feedback. Please take a moment to drop me a line with your comments and suggestions on ways we can improve our business and make our time spent at work more meaningful. These will help us in our pursuit of continuous improvement.

Quite honestly, she could have saved the $0.50 spent on the pen, and just sent the letter. The fact that she was directly asking for "honest and open feedback" was quite refreshing. Perhaps I was the only first year employee naive enough to think she was serious, but whether she expected it or not I was going to take her up on this offer.

You see, this was perfect timing. As long as I had worked for Lockheed, and likely much longer, shipping and receiving was a major bottleneck for quick and agile projects. If you placed an order through the proper channels you may get it in the next couple weeks, but more likely it would be more than a month!

We'd often call to check on the status of items and receive the same answer. Something along the lines of: "It is showing up as having been received, but we're really backed up and I don't know how long it will be until we find it and get it over to you."

Inevitably, this led to many workarounds from the formal system. Sometimes, we would find out when the item was going to arrive and then go pick it up ourselves. Or, we would simply order directly to our homes! But both of these options also presented problems due to security and other issues with procuring and moving property onto and around the facility. Smuggling is not a good solution.

Even though I understood that the VP of Engineering was probably already aware of this issue, I was still encouraged by the opportunity to get her first hand feedback on why it was not being addressed. It gave me hope that maybe she would have the power to press some buttons and get to the bottom of the problem -- the power that my boss lacked.

There was one small problem. Evidently she forgot to actually check if she had time to listen to the requested "honest and open feedback" before her secretary sent the letter.

It turns out I finally got an appointment to chat with her associate. Okay, that's fine, he was still at least four levels above me in the spaghetti of a corporate hierarchy and he could make things happen. He would have the power to push some buttons.

In the two weeks leading up to the meeting, I wasn't sitting on my hands. I was still actively involved in trying to figure out why it took so long to get things and how it might be fixed. Rather than trying to be a maverick, I was working together with my peers and my boss who was also well aware of the issue. His approach however was quite lax. Although he was open to discussion about it and said that he would try to resolve the issue, the actions he took sent a different message: that he'd dealt with this his entire career so why couldn't we; that it was just the way things were at a big defense company.

So I show up for the meeting and his secretary says he'll be there in a few minutes. That's fine, it gives me more time to check out his cool pictures of airplanes and the nice uni-directional screen cover on his monitor.

My first impression was that he was a really nice guy; that he actually really wanted to take the time to talk. After the niceties, we got down to business. I quickly talked through some of my first year impressions and then moved onto the issue that had been frustrating our team.

Everything was going well until I was done explaining the issue. You'll never guess how he responded. In a nutshell he said, "do you realize who you are talking to? Do you understand that I don't have time to deal with this and that you should have talked to your manager first?" He may as well have said from the start: "WHOA WHOA, you don't talk to me directly [about real issues]."

This after agreeing to meet and talk with me. This after explaining clearly to him the impact of the problem. That it was costing the company valuable time and money. That it was dulling the bleeding edge of his company. That we were ADP and it significantly impacted the agility of our projects.

In that moment I realized the curtain had been pulled back. I realized that he had just expressed what both he and his superior actually felt about first year employees.

But the story's not quite over. I have to reveal that a few weeks later the oddest thing happened. I received a call from the head of shipping and receiving. He was calling to check how they were doing. He wanted to see if things were going better and if there was anything he could do to speed things up.

If you don't subscribe to the Daily Dilbert, you should.

Follow the Community Server Developer Conference Live

admin — Sat, 20 Oct 2007 14:13:22 GMT

Kevin Harder is blogging the Community Server Developer Conference live! Check it out.

Fluid, a new Community Server Blog Theme

admin — Sat, 04 Aug 2007 19:23:32 GMT

If you haven't heard, the deadline for the Community Server Theme Contest has passed. The good news is that now you can vote on your favorite themes and download them for your site(s).

As part of the Theme Extravaganza, I submitted a single Blog Theme, Fluid, similar to the one currently used on daptivate.com (note that this is about to change, as I am currently working with a designer on a new theme). It is named Fluid for several reasons ... that is the name of the Arcsin template I used as a starting point, it won't cause problems with anti-virus software, and it simply makes a lot of sense for the name of a stretchy three column layout.

Details

Here are some more details about the Community Server Blog Theme called Fluid.

It is a very simple three column blog theme. Each column adjust to the width of the browser.
There are different pre-configured theme variations included: Pink, Blue, Red, and Green.
The title/description header can be easily shown or removed based on user preference.
The logo, text, and colors can be easily changed.
It is valid XHTML 1.0 Transitional.

Screen Shots

In order to give you a feel for what it will look like on your blog, here are two screen shots.

The pink theme variation (with header shown):

The blue theme variation (with header hidden):

As you can see, this theme puts a premium on actual content. Blog posts can be prominently displayed and easily accessible for users. It also enables easy customization to match your logo and preferences through the Community Server dynamic theming feature.

Get It

You can easily download the theme for your blog. Once you unzip the contents, follow the instructions in the readme.txt file to install.

Enjoy...

FeedBurner Users: Google Now Owns You

admin — Thu, 21 Jun 2007 23:18:11 GMT

In case you missed it. Well, it's really too late anyway...

NOTE: Service of FeedBurner publisher accounts will not be interrupted as a result of the acquisition by Google. You will have a 14-day interim period ending June 15, 2007 to opt-out of allowing Google to service your account. If you take no action by June 15, 2007, the rights to your data will transfer from FeedBurner to Google. Opting out will terminate your user agreement with FeedBurner, permanently delete your FeedBurner account, feeds, and all related statistical data and history, and prevent the transfer of your data rights to Google.

Twitter Clients Galore

admin — Wed, 13 Jun 2007 07:30:35 GMT

If you are looking for a stand-alone Twitter client for your Windows box, you've come to the right place. Sort of. I have a recommendation. Check out Teletwitter. A group of us at Telligent teamed up with others in the community, led by Jason, and decided to crank out a Windows Twitter Client. We came up with something that is definitely worth a spin. If that doesn't suit your fancy, Google will keep you busy for a while.

Finally, the point

But really, the purpose of this post is to announce the release a Twitter Client for Community Server. Not another Twitter Client application.

As I mentioned in the original non-technical teaser, this software component (specifically a Community Server Module) fills a niche by enabling Community Server to have automatic tweet capabilities. Currently, it supports automatically sending messages to Twitter whenever you post to your blog.

To use it, download the latest version and follow the simple installation instructions.

Oh, and Jose: I'm still waiting on my copy of Professional Community Server. :P

Seth, on the ending of Sopranos and expectations

admin — Wed, 13 Jun 2007 06:28:09 GMT

In The Expectation Paradox, Seth Godin writes:

"As word of mouth becomes an ever more important component of marketing, the scales are tipping. Undersell, overdeliver. It's the strategy that works in the long run."

As I think:

"When was underselling and overdelivering a bad strategy? Has one of the demigod's of marketing just now enlightened us to the value of integrity?"

Hey, you gotta love the first reactions of an ignorant software developer. Maybe TheBlackFin can clear this up...

[for bill]

Community Server Blog Twitter Client

kbeyer — Fri, 13 Apr 2007 21:56:25 GMT

Syndicating content on the web has never been easier. I would venture to guess that the Blog, in a general sense, has become the most popular way that users push content to the web. And most Blog software supports at least two methods of syndication: RSS and E-mail. Even if the Blog software doesn't there are sites like FeedBurner and FeedBlitz which enable these syndication options to be added or enhanced.

So, that's pretty cool. A person can type some text, push a button and boom! It is suddenly available not only through direct browsing of a web site and web search but also to users who have subscribed to that content via RSS or E-mail.

If you think that is sweet, buckle up. You may have heard of this cool new site everyone is talking about: Twitter. I won't attempt to explain the idea behind it, Co-Founder Evan Williams has already done a good job of that (via Jason Calcanis). The takeaway, in the context of content syndication, is that Twitter brings two more syndication options to the table: IM and SMS.

You heard right. Now you have the capability to syndicate new blog posts through IM and SMS. At least if you use Community Server as your blogging software.

How? Through a small little software component called a Community Server Module. The module acts as a Twitter client by updating your Twitter Status whenever you make a new post to your blog. Enabling all your Twitter followers to be the first to know about it.

Community Server 2007 is scheduled for release on April 16th. The module to enable this capability will be released shortly thereafter.

If you'd like to be a beta tester before then, drop me a note.

Or send me a tweet... http://twitter.com/kbeyer

Hacker's Challenge #2: Crack the AJAX Login Control (Plain text provided)

kbeyer — Tue, 03 Apr 2007 04:36:20 GMT

[This is a follow up to the first AJAX Login Control Hacker's Challenge. You will find more details and instructions there.]

Well, so far, the hackers are not doing so well. Here are some numbers. Out of ~517 downloads, ~108 accounts created on the test site, and ~617 page views over the past two weeks, the AJAX Login Control has yet to be cracked. Yes, I know, those aren't great numbers... but hey, at least there is some indication that the armour is being tested.

Okay. So, I've decided to cut you hackers a little slack. Give you a few little hints, if you will. As a matter of fact, I'm going to do all the hard work and provide the raw data that is transmitted during a successful login of the sample user, hacker@snipgen.com.

VerifyUserLogin : The first AJAX request.

POST
{"request":{"__type":"snip.SaltRequest","username":"hacker@snipgen.com"}}

RESPONSE
{"__type":"snip.SaltResponse","salt":"EIyMXOyus3TRGnP/MiWwhQ==","challenge":"wzLrnbxWivzNkbMPvksw8A==","success":true}

Login : The second AJAX request

POST
{"request":{"__type":"snip.LoginRequest","username":"hacker@snipgen.com","passwordHMAC":"ERkSrTM8EeD2rIzwE8TyxiPJyo8=","createCookie":false}}

RESPONSE
{"__type":"snip.LoginResponse","status":1}

$100 Award Remains

There it is. I've spilled the beans. And here's the best part. The $100 cash award to the first succesful hacker remains.

Once again, good luck and game on.

PageMethods Not Found (or Defined)?

kbeyer — Tue, 20 Mar 2007 05:01:25 GMT

If you are seeing this javascript error (or similar) while trying to use Page Methods with ASP.NET AJAX, here is a checklist that should save you some time.

The page method must have the System.Web.Services.WebMethod attribute.
[WebMethod] ...
The page method must be public.
[WebMethod] public ...
The page method must be static.
[WebMethod] public static ...
The page method must be defined on the page (either inline or in the code-behind). It cannot be defined in a control, master page, or base page.
<%@ Page Language="C#" %> <script runat="server"> [WebMethod] public static ...
The ASP.NET AJAX Script Manager must have EnablePageMethods set to true.
<asp:ScriptManager EnablePageMethods="true" For an example with full source see Calling static methods in an ASP.NET Web Page.
[Reader Tip] If all else fails, be sure you are seeing the correct error. A reader kindly reported that although they saw the "PageMethods not defined" error, the server-side code was still executing correctly. After switching to FireFox, they discovered the real error. Perhaps Firebug would also be quite useful while tracking down such scandalous errors. [Thank JohnL for the tip]

Note that you can use complex return types and parameters with page methods the same as with calling web services with ASP.NET AJAX.

Hacker's Challenge: Crack the AJAX Login Control

kbeyer — Tue, 20 Mar 2007 04:22:13 GMT

So, you think you are an expert AJAX hacker? Want to earn a quick $100? Then you've come to the right place.

Here's the challenge. Go to http://snipgen.com/secure and sign in as hacker@snipgen.com. Yeah, I'm even giving you the username. And I've given you a whole series of posts on how it works. Not to mention that the source is even available. How hard can it be.

In order to get the money, you have to successfully sign in with the afore mentioned email. In addition, you have to send me the plain text password and instructions on how you discovered it.

The first person to do this will get $100.

There is a time limit. I'll give you two weeks. If there isn't a winner by April 2nd, then I will drop the prize money and give the plain text that is transimitted while successfully signing in with hacker@snipgen.com.

Good luck. Game on.

Do you see what I see?

kbeyer — Wed, 07 Mar 2007 04:42:07 GMT

No comment.

[AJAX Login] Compatibility with ASP.NET Authentication

kbeyer — Tue, 27 Feb 2007 05:36:00 GMT

[Update: March 20, 2007] Before putting the finishing touches on this AJAX Login System / Control, I've decided to see just how secure it is by issuing a challenge. See if you can crack it...

In Simplifying the Sign In Experience with AJAX, I brainstormed about how an AJAX Login control could improve a user's web application sign in experience. If you have been following the more detailed posts of each attribute, you will remember that my last post was on making sure the functionality is accessible via URL. In addition, I gave a link to a live demo for you to give it a test drive.

Well, the next attribute in the list, #4, is Easy, Very Easy to Add to Web Pages. And although it is very close to being ready, I decided to skip ahead to attribute #6, Compatible with ASP.NET 2.0 Forms Authentication, as it turns out to be a pre-requisite to making the AJAX Login System easy to add to web pages. This is because, naturally, in order to be easy to add to ASP.NET web pages it needs to play well with applications that use the built-in ASP.NET membership system.

Now, I want to be clear, making sure the AJAX Login System is compatible with ASP.NET Authentication does not mean that it shouldn't be easy to add to other types of web pages, be it plain HTML, PHP, Ruby on Rails, etc. ... It just means that it needs to be easy to add to ASP.NET pages as well. We will cover compatibility with other technologies in a future post.

Community Server - A Use Case

In order to keep things simple, I decided to use this site, daptivate.com as a use case of the AJAX Login System's ability to work well with an ASP.NET application. This way you will be able to see it in action and it will be a good test of using it with an application, Community Server, that not only leverages the ASP.NET 2.0 Membership System but also extends it.

Feel free to create a test account and test it out on this site if you like. One benefit you will notice is that the Screen Name you choose will automatically appear in the Comment section. Additionally, you don't need to create a separate account if you already created one on SnipGen.com. Simply sign in with your existing account.

The Objective

The first step is to simply show that a user can sign into an application which uses the ASP.NET 2.0 Membership System. The second goal is to provide functionality that has come to be expected by users of ASP.NET (and really most) web applications; namely, auto-redirect when authentication is required, and remembering users through encrypted cookies.

The Solution

Blah, blah. Instead of a verbose description of how the objective was met, I've decided to simply release the code. This way if you are interested, you can get the source and see how it really works. If you aren't, then I won't be wasting your time.

There are two options for getting the code:

1) The AJAX Login Google Code Project - This will allow you to use subversion to get the latest code and optionally contribute to the project.

2) A zip file - Simple, zipped up version of an example website.

In either case, here are the basic steps for getting the project running:

Modify connections.config to point to a database with the ASP.NET 2.0 membership schemas. This could be an existing ASP.NET 2.0 application's DB for which you want to use the AJAX Login functionality.
Setup a virtual directory or website for the folder AjaxLogin.Web.
Checkout your local version of the site.

There may be a few extra steps / checkpoints to get it to integrate seamlessly with Community Server and other custom web applications. However, I will leave that for another post.