Services Share Schema and Contract Not Implementations

It hit me like a 10 ton truck, while trying to architect an grid computing framework for Microsoft .NET that will be service-oriented. It is wrong for a client of a service to depend on any behaviour of its own implementation of, for argument’s sake, an input parameter. The initial grid’s design saw heavy usage of the Command pattern to pass not only data but behaviour across the service boundary. It all falls apart however as soon as you have to make the service boundary more explicit (i.e. J2EE servicing .NET clients) – at that point I realized I needed to revisit the four rules for service-orientation. I now know why wsdl.exe generates you a new set of data transfer objects ... and why SOAP defines request and response messages the way it does. And it's all becoming very clear to me, and funnily enough typing this blog reminded me that this was an interview question I was asked over a year ago by Josh! I’m going to stick the four tenets of service orientation on Post-It notes to my monitors.

Boundaries are explicit
Services are autonomous
Services share schema and contract, not class
Service compatibility is based upon policy

Other Side of the Fence

Phew! I've passed the Java certifications in JSP, Servlets and EJB and can now return to the normal way of life using Microsoft technologies to my heart's content. I'm keen to get back to IIS although I wouldn't mind working with some of the J2EE application servers to see value-add features that each vendor has been able to provide (all my exposure so far has been to Sun's bare bones reference implementation). Expect more Microsoft-related posts soon!

Throttling Paradox

Who would have thought that you might need to throttle an application server in order to maintain a performance-level contract? I've seen the option inside IIS but couldn't for the life of me think why anyone would want to turn it on. However, in the context of an application that's been through some sort of capacity planning process (so we have a rough idea of how many requests/responses the application can process), and where all requests need their responses within some limited duration (think high-volume/low-latency trading platforms), you can apply throttling to help enforce the performance level. Without throttling, additional requests might be satisfied only to the detriment of other requests already executing on the application server. Ideally, it should be used in conjunction with load-balancing across a cluster of servers, so that throttled requests aren't queued, but rather dispatched to another less-busy machine.

Rfc2898DeriveBytes

Gone are the days of salting and hashing users' passwords and storing the salt and salted hash next to each other in a database. .NET 2.0's new Rfc2898DeriveBytes class derives a pseudo-random key from a password, salt and a number of iterations - a so-called iterated and salted hash. And, apparently, it's more secure than just hashing a password and salt. More info here.

CAFEBABE

I just noticed while studying for tomorrow's exam that every Java class file begins with the so-called magic number 0xCAFEBABE! Quite funny, especially since the guys who penned it into the class file specification did so before the language was even called Java. You can find more information at Artima.

.NET 2.0 vs. Java 5

Type erasure, reification and synthetic bridge methods: yuck. I'm stuck on the proverbial consultants' bench so I decided - after 4 years of non-Java development - to upgrade my Java certification to the latest version in just five days. I honestly thought I was going to make the deadline until I hit the section on generics. Now I'm a half-day behind and my head hurts! C# is way easier to grasp, and from the looks of things performs a whole bunch better too (except for the JITed type instance "explosion" if you really care).

Anyway, since Java 5, the Class class in package java.lang is a generic class whose type parameter denotes the type that the Class object represents. Previously, compilers wouldn't let you compare an Integer and a String. Now (since Tiger) they won't even let you compare Integer.class and String.class! It stems back to the fact that (similar to C#) both GenericType<A> and GenericType<B> do not derive from each other, even though type B extends type A. There's a little bit of extra trickery in the Java though, because both GenericType<A> and GenericType<A> extend GenericType<?> (unlike C# where they derive from System.Object.) This means that you CAN compare a GenericType<capture of ? extends Object> with a GenericType<capture of ? extends String>! Madness.

I've moved

I've made a fresh start over at Revolución Análoga for all non-technical blogging. Follow the link, you know you want to.

Ramblings of a Bemused Consultant

If people believe that they get what they paid for - and they do, just look at the type of people who buy into the brand of Mercedes Benz - then a well known consultancy brand can leverage this fact to sell its consultants' time for a premium - and they do, just look at how much you pay for an hour with an Accenture consultant. Expanding on this, where should that additional revenue end up? Well, to grow the brand you really do need better consultants, and if your consultants are struggling to pay off mortgages and other financial debt then they certainly won't be able to give 100% of their attention to their work. There's logic in saying that the additional revenue should go back to the consultant: clients would see the exorbitant fees and similar lifestyle of the consultants and would be inclined to buy into the power of that consultancy's brand. In short, if you're running a consultancy, don't fall into the trap of paying your consultants less because you managed to "negotiate" a good deal with them - you will be destroying the power of your brand.

Angry Worm

"Tape worms that escape from the bottoms of mexicans just don't know how to smile."

HTTP Compression in IIS 6.0

The things that nobody told you about HTTP compression:
1. It only works when over HTTP 1.1; however Internet Explorer's default setting is to downgrade your HTTP version to 1.0 if you're accessing the server via a proxy so even though you may think you're compressing the .aspx pages - you are not.
2. Some client programs (i.e. Adobe Reader) don't behave correctly when opening up inline documents (i.e. opening up the document in the browser window) when the content has been transferred as a chunked/compressed stream.
So, when you're testing HTTP compression, use a product like ieHttpHeaders to verify that your results are actually being compressed (you'll see headers like Content-Encoding: gzip, and Transfer-Encoding: chunked), and make sure it works with and without a proxy.

IIS Worker Process Recycling and Prime Numbers

To prevent all your application pools from recycling at the same time ... you should follow the way of the cicada! No I haven't been smoking crack. The theory goes like this: if you have two application pools recycled every M and N hours respectively (where M and N are both prime) then their recycles will only coincide every M x N hours. So, for the default 1740 minutes (29 hours) and the next prime up (31 hours), you're only going to have the problem once every 37ish days!

WindowsPrincipal.IsInRole(...) and cached SID

There is something sinister here that I'm just not getting. There is an ASP.NET 1.1 application under IIS 6.0 with an application pool set to run under the context of a domain user. The application is removed so that we can upgrade it. The domain user is added to a machine local group with additional privileges. A new version of the application is installed and started up. Somewhere in its code the line
WindowsPrincipal.IsInRole(string) is called (the parameter is the name of the machine local group), but that call fails. The event log shows a success audit for a logon attempt using explicit credentials, but the user's group membership isn't refreshed (even after an iisreset) until the machine is rebooted. If a SID is being cached, it can't be IIS that's doing it, and I'm tempted to believe it's Windows.

SELECT TOP N

To return only the top N rows in a SQL select statement, it is possible to parameterize the number N in both SQL Server 2000 and SQL Server 2005; you don't have to select the whole result set into a temporary table and whittle down the rows by yourself.
For SQL2K:
SET ROWCOUNT @NumberOfRows
SELECT * FROM SomeTableOfYourChoice
SET ROWCOUNT 0
and for SQL2K5
SELECT TOP(@NumberOfRows) FROM SomeTableOfYourChoice

NTFS Access Control Lists and Inherited Permissions

When you deploy simple changes to your ASP.NET web application / XML web service (like copying in a new web.config file) watch out for cut-and-paste versus copy-and-paste! As it turns out, copying the web.config file will allow inheritable permissions to be applied to the new object - cutting and pasting the web.config will not. If IIS_WPG loses permissions to read the web.config file you'll see the error message: "Server Application Unavailable."

XML Web Service Authentication Failures

Ok, this is just because I'm a geek. Next time you get HTTP 401 errors when you try to invoke a web service call using a Visual Studio generated proxy, don't forget to assign System.Net.CredentialCache.DefaultCredentials to your proxy's Credentials property. Also, ensure that the Windows Integrated Authentication checkbox is selected in IIS, and that the .asmx and CodeBehind files of your web service have read and execute NTFS permissions for your client user. FYI: The best practice is to assign the permissions to the folder in which the virtual directory resides, and allow the children (i.e. the asmx files) to inherit the permissions.

Look at me!

Kelly, playing for Team 3

Preparing to play croquet in the sunshine

Another Welsh river

More rivers and mountains in Wales