Rfc2898DeriveBytes

Gone are the days of salting and hashing users' passwords and storing the salt and salted hash next to each other in a database. .NET 2.0's new Rfc2898DeriveBytes class derives a pseudo-random key from a password, salt and a number of iterations - a so-called iterated and salted hash. And, apparently, it's more secure than just hashing a password and salt. More info here.

CAFEBABE

I just noticed while studying for tomorrow's exam that every Java class file begins with the so-called magic number 0xCAFEBABE! Quite funny, especially since the guys who penned it into the class file specification did so before the language was even called Java. You can find more information at Artima.

.NET 2.0 vs. Java 5

Type erasure, reification and synthetic bridge methods: yuck. I'm stuck on the proverbial consultants' bench so I decided - after 4 years of non-Java development - to upgrade my Java certification to the latest version in just five days. I honestly thought I was going to make the deadline until I hit the section on generics. Now I'm a half-day behind and my head hurts! C# is way easier to grasp, and from the looks of things performs a whole bunch better too (except for the JITed type instance "explosion" if you really care).

Anyway, since Java 5, the Class class in package java.lang is a generic class whose type parameter denotes the type that the Class object represents. Previously, compilers wouldn't let you compare an Integer and a String. Now (since Tiger) they won't even let you compare Integer.class and String.class! It stems back to the fact that (similar to C#) both GenericType<A> and GenericType<B> do not derive from each other, even though type B extends type A. There's a little bit of extra trickery in the Java though, because both GenericType<A> and GenericType<A> extend GenericType<?> (unlike C# where they derive from System.Object.) This means that you CAN compare a GenericType<capture of ? extends Object> with a GenericType<capture of ? extends String>! Madness.

I've moved

I've made a fresh start over at Revolución Análoga for all non-technical blogging. Follow the link, you know you want to.

Ramblings of a Bemused Consultant

If people believe that they get what they paid for - and they do, just look at the type of people who buy into the brand of Mercedes Benz - then a well known consultancy brand can leverage this fact to sell its consultants' time for a premium - and they do, just look at how much you pay for an hour with an Accenture consultant. Expanding on this, where should that additional revenue end up? Well, to grow the brand you really do need better consultants, and if your consultants are struggling to pay off mortgages and other financial debt then they certainly won't be able to give 100% of their attention to their work. There's logic in saying that the additional revenue should go back to the consultant: clients would see the exorbitant fees and similar lifestyle of the consultants and would be inclined to buy into the power of that consultancy's brand. In short, if you're running a consultancy, don't fall into the trap of paying your consultants less because you managed to "negotiate" a good deal with them - you will be destroying the power of your brand.

Angry Worm

"Tape worms that escape from the bottoms of mexicans just don't know how to smile."

HTTP Compression in IIS 6.0

The things that nobody told you about HTTP compression:
1. It only works when over HTTP 1.1; however Internet Explorer's default setting is to downgrade your HTTP version to 1.0 if you're accessing the server via a proxy so even though you may think you're compressing the .aspx pages - you are not.
2. Some client programs (i.e. Adobe Reader) don't behave correctly when opening up inline documents (i.e. opening up the document in the browser window) when the content has been transferred as a chunked/compressed stream.
So, when you're testing HTTP compression, use a product like ieHttpHeaders to verify that your results are actually being compressed (you'll see headers like Content-Encoding: gzip, and Transfer-Encoding: chunked), and make sure it works with and without a proxy.

IIS Worker Process Recycling and Prime Numbers

To prevent all your application pools from recycling at the same time ... you should follow the way of the cicada! No I haven't been smoking crack. The theory goes like this: if you have two application pools recycled every M and N hours respectively (where M and N are both prime) then their recycles will only coincide every M x N hours. So, for the default 1740 minutes (29 hours) and the next prime up (31 hours), you're only going to have the problem once every 37ish days!

WindowsPrincipal.IsInRole(...) and cached SID

There is something sinister here that I'm just not getting. There is an ASP.NET 1.1 application under IIS 6.0 with an application pool set to run under the context of a domain user. The application is removed so that we can upgrade it. The domain user is added to a machine local group with additional privileges. A new version of the application is installed and started up. Somewhere in its code the line
WindowsPrincipal.IsInRole(string) is called (the parameter is the name of the machine local group), but that call fails. The event log shows a success audit for a logon attempt using explicit credentials, but the user's group membership isn't refreshed (even after an iisreset) until the machine is rebooted. If a SID is being cached, it can't be IIS that's doing it, and I'm tempted to believe it's Windows.

SELECT TOP N

To return only the top N rows in a SQL select statement, it is possible to parameterize the number N in both SQL Server 2000 and SQL Server 2005; you don't have to select the whole result set into a temporary table and whittle down the rows by yourself.
For SQL2K:
SET ROWCOUNT @NumberOfRows
SELECT * FROM SomeTableOfYourChoice
SET ROWCOUNT 0
and for SQL2K5
SELECT TOP(@NumberOfRows) FROM SomeTableOfYourChoice

NTFS Access Control Lists and Inherited Permissions

When you deploy simple changes to your ASP.NET web application / XML web service (like copying in a new web.config file) watch out for cut-and-paste versus copy-and-paste! As it turns out, copying the web.config file will allow inheritable permissions to be applied to the new object - cutting and pasting the web.config will not. If IIS_WPG loses permissions to read the web.config file you'll see the error message: "Server Application Unavailable."

XML Web Service Authentication Failures

Ok, this is just because I'm a geek. Next time you get HTTP 401 errors when you try to invoke a web service call using a Visual Studio generated proxy, don't forget to assign System.Net.CredentialCache.DefaultCredentials to your proxy's Credentials property. Also, ensure that the Windows Integrated Authentication checkbox is selected in IIS, and that the .asmx and CodeBehind files of your web service have read and execute NTFS permissions for your client user. FYI: The best practice is to assign the permissions to the folder in which the virtual directory resides, and allow the children (i.e. the asmx files) to inherit the permissions.

Look at me!

Kelly, playing for Team 3

Preparing to play croquet in the sunshine

Another Welsh river

More rivers and mountains in Wales

Wales countryside, near Llanddewi Brefi

Stoff, the reigning time trial champion

Wales, the first holiday