Tobin Titus

Run-in with Beaver, PA Police Department

tobint — Sat, 09 May 2009 06:37:00 GMT

I'm writing after a very long and scary night in an encounter with the Beaver police department in Pennsylvania.

My dad and I attended the 10pm showing of Star Trek at the Cinemark Center Township Theater near Beaver Valley Mall. All went well until our trip home. On the way home, I took my normal exit to cut through Vanport and Midland to take my dad home in Ohio.

View Larger Map

Directly off of the exit, I encountered something I have never seen before. Having lived in Ohio, North Carolina, South Carolina, and Washington State, I have never encountered a "sobriety check point". Am I the only one who has reached the age of 33 without this “pleasure”? It was a foreign concept to me so when I approached the officer and he asked me for my license, I was taken aback. I hadn't done anything wrong, and my "sobriety" can be ascertained without my license. I looked at the officer for a moment strangely and before I could react he immediately barked, "give me your license or I'll arrest you". I pulled my license out and handed it to the officer reluctantly. He then asked me something, which I cannot remember exactly. The question was effectively asking why I hesitated to give him my license. The question seemed strange and obvious to me. I answered, "Have you not heard of the fourth amendment?" Obviously the officer was not happy with the answer because he put his hand on his gun, leaned in toward me and started barking at me "Your F*$%ing 4th amendment rights?! Say something again and I'll arrest you!" The police officer went on and on for what seemed like an eternity but was likely shorter than I remember. I literally feared for my life. I was among a dozen or so "peace officers" and I feared for my life as a law-abiding citizen. For what? For answering the question that he asked. Granted, my response was in a tone that was not respectful, but it was not taunting or belligerent either. The situation was so bazaar to me that the question just seemed absurd. It would be like an officer pulling you over to ask you if you know how to drive. The obvious fact that he pulled you over would indicate your ability do drive. Therefore, you might likely respond, "Umm. Seriously?" That’s how I felt.

My dad at this point looked shocked too and we were both scared. The man was clearly out of control. I gazed at the other officers at the checkpoint. They all had a very confused look on their faces too. At this point, I was scared – not so much for me but for my dad. He has two bad knees and all I could imagine was the police pulling him from the car and slamming him to the ground – all because I answered his seemingly silly question.

I picked up my ‘mini computer’. I didn't even care that it wasn’t recording. I just wanted to get the device out and visible. I figured the police, thinking they were possibly recorded might be enough to deter him from making an unwise decision. Worst case scenario – if I did manage to record anything that the recording might serve as evidence if anything “happened” to my dad and I. Apparently, this decision worked in my advantage. I didn't even have to tell him the device was on or that I was recording. His actions ever so slightly changed from “Who’s your daddy now” to “just get the hell out of here.” He just handed my license back and started yelling, saying "Go ahead and say something again." I kept my mouth shut and he said, "Just go". So as I turned my gaze back toward the road ahead of me, I didn't even inch forward a foot from the checkpoint before he started cussing at me and yelling. It was disturbing. This man has a gun -- and is sanctioned to carry AND use one by the city. He was dangerous and frightening. This was only the beginning of a long night.

After making it through the stop, I pulled over and called 911. I told them what happened and they directed me to go to the police department in Beaver to file a report. My dad, knowing the area better than I do, advised that I go around the checkpoint a different way so I didn't instigate that officer further. The 911 officer, still on the phone at this point, seemed to indicate that going the alternate route wasn't a bad idea.

My dad and I drove to the Beaver police department the back way and got into town where I was greeted with a darkened police station. (see Google street view below)

View Larger Map

I used the telephone outside the station to contact the police. The individual on the phone asked for my name, and said someone would be there shortly to take my report. My dad then said, “They aren’t going to be happy about you reporting one of their own.” I felt this was a slight risk, but was unlikely – something that only happens in movies. Boy was I wrong.

I went back to my truck for a minute and my dad stayed on the stoop of the police station. Just as I got into my truck, an officer pulled up. I got out of the vehicle and so did the officer. We met together and I began telling him what happened, my dad chiming in occasionally with his perspective and agreement that the officer was acting recklessly. The officer was very courteous and listened intently and seemingly concerned. He was a fairly young looking guy so I wondered if he was able to take the report or had to report to someone else first. The officer started to give me his perspective on the legality of sobriety checks and the reason for being able to side-step the 4th amendment (see the previously linked Wikipedia article for more information – essentially, it was decided that violation of constitutional rights is OK because its effective… hmm). I told him that at this point I wasn’t as concerned about that as I was with the officer’s very inappropriate actions and temper at the checkpoint. The officer may normally be OK. Maybe he had a bad day. Whatever the case, I didn’t think he needed to be at that station tonight. That said, I expressed my concern that all I wanted was to file the report and go home. Just as I did, another officer pulled up and started listening from his car. The second officer, also a young guy with a shaved head, stayed in his car for some time. After I while further into my story, the officer in the car told me “You know what, If I go and get that officer and he tells me it didn’t happen, I’m going to arrest you!” At that point, I told both officers that I was fine with that and I would prefer they got the officer so he could be present while I gave the report. I also told them that I might have been able to record the incident in question and really wanted to file my report. I could suddenly sense the mood change and the officer in the car looked visibly upset. Scared what may happen, I told the officer that I may have uploaded the recording already. I didn’t want them thinking that if they took the device, they could make it go away – and therefore the problem too.

The officer in the car said, “Go ahead and record me and put it on YouTube!” Based on his facial expression and the tone with which he said it, I thought he was being serious. I said “really?” “Yeah,” he said, “Put it up on YouTube. You’ll be arrested for wire fraud.” I then realized he was not serious at all. He was trying to threaten me. He got out of the car and kept saying, “go ahead and record me. But you can’t record anyone without their consent.” I said, “As far as I understand, you can record anything that is out in the public without consent. Reporters do it all the time. He said, “How much do you want to bet?” I said, “Well, nothing because unsanctioned gambling IS illegal, but I still contend recording in public is not.” At this point, I hadn’t even acknowledged that I HAD ACTUALLY recorded anything. I simply indicated that I might have been able to – but was uncertain yet. So I pulled the device out again and asked, “You did say I can record you then?” He said “No. I didn’t say that.” He changed his story -- a flat-out lie. I asked him, “How can I even trust you to give you a report if you are already lying to me?”

At this point, another car pulled up and the bald-headed officer said, “There’s the chief of police right there! We can ask him!” I said, “Great, let’s go talk to him.” So I started walking toward the chief and the bald-headed officer started shouting, “Don’t say anything, he’s recording this whole thing!” I never affirmed or denied it to the captain or anyone. The captain then started concentrating on my device despite my request to file a report. He didn’t care about the report. He wanted that device away from me. He kept demanding it from me. “Give me that phone. I want to see if it’s recording.” “No!” I exclaimed. “I never said it was recording, HE did,” as I pointed at the bald officer. The captain said, “Well, give me the device, I want to see. You have turned something very simple into something very difficult.” I thought, why was it *me* making this difficult? I just wanted to file a report. They were the ones getting very interested in what devices I had and making the issue about me, rather than simply taking a report. Were citizens that used to rolling over and giving up their rights? Am I really the only person they’ve ever seen who has indicated they had rights? Do they really not care?

I simply held my device and occasionally looked at it. I was afraid at this point. I realized it was the Serriff’s office against my dad and me. The only defense I had was that the police had no idea what technological capability my device had. They also weren’t certain if I had uploaded a recording or streamed it somewhere that others could see. They weren’t certain if my device was a phone and I had someone listening/watching/reading to an open call/video feed/text-to-speech for an witness. That device felt like my only defense against what was increasingly looking like a completely corrupt police department. “Give me the phone,” the captain said assumingly. “No. See, if I WERE actually recording you, and it is actually against the law, I have a right to not turn that over to you and incriminate myself. That is the 5th amendment.” At this point, another few officers had shown up and had circled. There were 6 surrounding me. Other officers were now looking in the windows of my truck and running my license plates. They were just looking for a reason to arrest me. One of the additional officers on duty said, “You think because you read a few law books you know what’s going on? It’s called wire fraud in PA. You can record video, but you can’t record audio. I need to see what you are recording“, insisted the captain. The officers were drawing increasingly close, and had surrounded my dad and I. Some had their hands on their guns. Others were standing very threateningly – like a cobra ready to strike. OK, I’ve seen “Cops” and other shows. I see how these things go down. I was ready for someone to tackle me to the ground at any moment and arrest me. They would then “lose” my device to make sure there was no proof and then I’d be stuck on defense rather than offense. I was playing out every scenario in my head and I kept thinking my poor father was standing in harm’s way. I was still scared they would take him down hard and he just couldn’t handle that right now.

So after repeated attempts to take my device, the captain said, “OK, let’s go! We are done here.” I asked “What about my report?” And they just ignored me and got in their cars. They weren’t even going to take my report. My dad and I went back to our truck. The police stuck around for a minute until the realized I wasn’t going anywhere just yet. I made a phone call to 911 again and expressed my concern that we were going to be harassed or worse on our way out of town. This was a rather valid concern at this point because the police had ‘driven off’ but had circled back around. Despite their obvious attempts to hide – turning off their lights and creeping into position so I wouldn’t see them, I could see them placing themselves in strategic positions. The 911 dispatcher gave me the number for the state highway patrol. I called that number and was told that the officer would call me back. As I waited for a return call, the police officers repositioned themselves. One even threateningly put himself directly in the alley in front of me as if to say, “go ahead and pull out, I dare you.”

The state trooper on the line was very helpful by providing me with some information, but he was unable to come help me in what I perceived to be a dangerous situation. So, I hung up and put my phone down in the console. I knew there are anti-cellphone laws in the area, so I didn’t even want it in my hand where they could say I was on it. I pulled out and drove down toward Bridgewater. It was just a mile or so away to get out of Beaver’s jurisdiction in that direction. My dad and I ended up driving completely around the jurisdiction of Beaver police department out of fear.

I have never been afraid of anything like this in my life. I stand up when I feel it is necessary. When I was a child in school, Edmund Burke’s quote had a profound impact on my life: “all that is necessary for evil to triumph is for good men to do nothing.” I wasn't grandstanding for my own amusement. I wasn't trying to cause problems. I really just wanted to go home after watching a movie. However, this situation just got increasingly worse as more and more testosterone and abused power was added to the group. There was strength in numbers, but fortunately for me, there was also strength in using fear of the unknown and media scrutiny to keep me busy. I fully believe that if I had not had my device, or had the police had any certainty that I wasn't recording them, I would have been in jail or dead -- perhaps my dad too.

From our childhoods, we are told to cooperate with the police. However, I have always had distrust for law enforcement officers. Growing up, I was told about the police scandals in my little home town and knew that a badge isn’t necessarily a reason to trust someone. This certainly hasn’t helped the cause. Tonight I was threatened by an officer at a sobriety check point because I wasn’t familiar with them. I was directed into a bad situation by a 911 operator. I was threatened again by a gang from the police department – including the chief himself. I was told to give up my rights, that I had none. Even if I wanted to record the police officers, apparently it IS illegal to do so in PA (seriously, they can record you, but you can’t record them). I witnessed a police officer change his story to protect himself and others around him when he thought he was being recorded. The chief of police wouldn’t even take my report and in fact, threatened me instead of helping me. So the police are out to stop drunken driving (an admirable act), but were more than willing to break laws, abuse their power, and make threats to protect a man who was just as dangerous as a drunk driver – if not more so.

The police cry foul when citizens don’t help them out. Perhaps this is why. It has taken me three hours to write this up as my hands are still shaking and my heart is still literally racing from the experience. I still fear retaliation or reaction from them in some way. How are my dad and I to react?

Is Pennsylvania so corrupt that they give you means for the average citizen to defend themselves? What is a person to do if they feel their life is threatened and there is no other way to prevent harm other than to record the officer? What is a person to do when the police department is so corrupt that they won’t even take a report against one of their officers. I’m afraid to even go in to file the report now. I’m actually securing an attorney to handle the matter because I feel I have no choice. Had the police just taken my report, I would have been happier and there would have been no need for me to protect myself. Hell, they could have thrown the report away afterward. I wouldn’t have known any better. The point is, I didn’t make this a big deal. The police just gave me no choice but to make it one because they wanted to swing their authority around for absolutely no reason at all.

Please tell me what you think.

Update (May 9, 2009 - 9:34PM EST):

I've been doing some more reading and have found some more resources. First, I found the location to contact for public records. I will be requesting transcripts of the 911 calls, videos from the police vehicles, correspondence and public records about the officers involved last night. I also found that the Pennsylvania State Attorney General has a Public Corruption Unit. I will be contacting them on Monday to file a formal complaint and ask for an investigation.

Update (May 10, 2009 - 12:03AM EST):

In my previous version of this post, I posted that this was the Sheriff's department. After doing some investigation and talking with my dad to confirm, it was the local Beaver, PA police, and not Beaver County police. Beaver is the county seat so the local police and Sherriff's office are on the same street within blocks of each other. My sincerest apologies for the misunderstanding.

Update (May 10, 2009 - 1:00AM EST): I was checking out Google Street view and found this 'grab' to be a bit humorous. That's right, Google street view cams drove right by a speed trap on their way into Beaver from Bridgewater.
View Larger Map

IIS Security – Past and Present

tobint — Tue, 28 Apr 2009 04:31:00 GMT

This topic has been covered many times both by Microsoft and non-Microsoft employees. However, I’ve recently been asked what the main features of IIS 7 are and have seen a great deal of misinformation about IIS security on twitter, blog posts and forums.

I think, therefore, the issue deserves yet another look. In this post, I’m going to go over security in the past for IIS and then move on to talk about security features in IIS 7. These are not in any particular order. This post is not meant to diminish the many thoughtful works already created by others – both complimentary and critical. This is just meant to bring the subject back up for discussion again in hopes that you can be properly equipped with the decision making information you may need.

Ghosts of IIS Security Past

The reason for so much misinformation about the current state of security in IIS is likely due to the earned reputation the product had in versions previous to IIS 6.0. A quick search on the web for IIS 5 security vulnerabilities may be like a walk down memory lane for some of the more veteran administrators and IT staff across the globe. The search results are littered with critical vulnerabilities related to buffer overflows, ISAPI extensions, exploits on rarely-used features, or features that were available by a default installation. We are haunted by names like “Code Red” and “Nimda”. I don’t know about you, but those very names send shivers down my spine. I was consulting as a developer and web administrator for a very large property management company when these hit. We were lucky enough to avoid these as we had patched our services. That said, many whom I did business with on a regular basis were not very happy. So, to be clear, I feel the misinformation that is spread today is built on an element of experience with previous versions. Secunia reports 16 advisories and 6 vulnerabilities with IIS 5. And so started the reputation , perhaps deservedly so, that IIS was not secure unless you really knew what you were doing with security.

Bill Gates was apparently visited by the ghosts of security past, present and future when he laid his head on his pillow January 14th, 2002. I say that because on January 15th, 2002 Mr. Gates sent out the now-famous trustworthy computing memo to every employee at Microsoft. This set off a major revamp of products from the ground up. Standards were set for test planning and testing. Writing Secure Code was mandatory reading for every Microsoft developer and tester. The results have been staggering.

Security drastically improved in Microsoft products over the years, and IIS was definitely no exception to this. IIS 6 saw 5 security advisories and 4 vulnerabilities reported since 2003. Not to get ahead of myself, but IIS 7 has exactly 1 advisor and 1 vulnerability from Secunia. Compare this against Apache 2.0.x which has had 39 advisories and 23 vulnerabilities (4 of which are still unpatched as of this writing) and Apache 2.2.x which has had 10 advisories and 16 vulnerabilities (2 of which are still unpatched as of this writing) in the same period. Now I have seen attempts ([1], [2]) to quantify or otherwise explain these numbers further. You can read those articles for yourself and determine how much weight you want to give them. However you skew it, the facts should speak for themselves – IIS has dramatically improved and taken a leadership roll in security in IIS 6 and 7. Our ghost of IIS past still haunts the product’s reputation today, despite obvious strides taken. Even if you feel you like Apache better I think it is only fair to give credit where it is due.

Improvements in IIS 6

The IIS team took the four tenants of Microsoft’s Trustworthy Computing initiative to heart: Secure by Design, Secure by Default, Secure in Deployment and Secure Communication. Since we are already on the next version, I won’t spend a great deal of time talking about the security improvements in the last version other than a brief overview so you know how they relate to changes in our current version, IIS 7.

IIS 6 took vast strides to improve security. During upgrade installations, IIS 6 was disabled by default if the previous server had not been secured by the IIS lockdown tool. The architecture was completely revamped to separate kernel-mode HTTP listening from user-mode application execution. Changes were made to application pools, authentication, access control, encryption and certificate handling, auditing, logging and patch management that made the product far superior to its predecessors. You can find a detailed list of these features on TechNet. SecurityFocus did a comparison of these features in March of 2004.Server Watch wrote an article in December of 2003. By most accounts, everything accomplished in IIS 6 was a huge step in the right direction.

Despite the massive steps already taken in IIS6, IIS 7 took these all a bit further. Let’s go ahead and investigate these now.

Improvements in IIS 7.x

Customizable Installation

Continuing with the tenant of being secure in deployment, IIS 7 has made installation a wonder to behold. In IIS 6, you could reduce your attack surface by disabling features native to web server. However, these features were still loaded into the process. This carried not only a security factor, but also a performance and memory footprint issue. IIS 7 has a completely modular architecture. That means that features which you do not want are not only NOT loaded into the process, you can leave the bits for those features off of your disk completely.

Limitable Attack Surface

This is a bit dubious and is essentially part of the customizable installation. By reducing the modules that are available on disk or loaded into a process, you significantly reduce the attack surface for your specialized web servers. If all you intend to do is serve static content with caching and no default documents, you can simply install the static file handler and caching module and leave the rest of the IIS modules off of your server. Additional controls and limitations will also reduce your attack surface and I’ll cover those below.

IUSR account

Anyone who has tried to migrate an IIS installation from one machine to another or attempted to recover your installation on a new machine, previous to IIS 7, has likely run into an issue with the local “IUSR_<machine_name>” account. IIS 7 now uses a built-in IUSR account that allows you to easily copy your security settings from one machine to the next. This is great news for those using distributed configuration in web farms, recovery, restoration, or replication.

IIS_IUSRS group

IIS 6 introduced the IIS_WPG group. Application pool security identities had to be assigned to this group in order to host the w3wp.exe process. Like the IUSR account, IIS 7 now creates a built-in security group (IIS_IUSRS) and assigns application pool identities to the group automatically. You can find more information about the built-in user and built-in group for IIS 7 on IIS.NET (Understanding the Built-In User and Group Accounts in IIS 7.0).

ASP.NET / IIS Unified Security Architecture

Previous versions of IIS did not provide a unified approach to security with ASP.NET. The IIS 7 unified request pipeline that supports both Windows and non-Windows principals and provides one place to do all authentication and authorization. Apart from simplification and performance improvements, this also reduces the attack surface and allows for greater flexibility in authentication / authorization scenarios with custom modules.

Request Filtering / URL Rewriting

IIS 7.0 includes a request filtering module that is based on the URLScan ISAPI Filter for IIS 6.0. The module helps you tighten security of your Web servers.

The IIS team has also released an add-on URL rewrite module for IIS 7.0, which provides functionality for rule-based URL manipulation. Even though the primary purpose of the URL rewrite module is to rewrite URL paths for requests, the rewrite module can also be used as a security enforcement tool that helps prevent access to Web site content.

Application Pool Identities

On top of Application Pool Isolation, IIS introduces a new security feature in Service Pack 2 of Windows Server 2008 and Windows Vista. It's called Application Pool Identities. Application Pool Identities allows you to run Application Pools under an unique account without having to create and manage domain or local accounts. The name of the Application Pool account corresponds to the name of the Application Pool.

Kernel mode SSL

The implementation of SSL has changed from IIS 6.0 to IIS 7.0. On Windows Server 2003, all SSL configuration was stored in the IIS metabase and encryption/decryption happened in user mode (required a lot of kernel/user mode transitions). On Windows Vista and Windows Server® 2008, HTTP.sys handles SSL encryption/decryption in kernel mode, resulting in up to 20% better performance for secure connections.

Configuration Improvements

IIS 7.0 allows locking and unlocking configuration settings in various levels and scopes. Locking down configuration means that it cannot be overridden (or set at all) at lower levels in the hierarchy. Unlocking configuration can only be done at the level where it was locked. This is useful, for example, when creating different configuration for different sites or paths, and only some of sites and paths are allowed to override it. Locking can be done at the section level or for specific elements, attributes, collection elements and collection directives within sections.

Dynamic IP Restriction

IIS 7 provides a new module that allows dynamic, temporary IP address restriction. This module prevents brute force attacks and HTTP clients that make unusually high number of concurrent requests or a large number of requests over a short period of time.

Summary

A verbose list of security features in IIS 6 and IIS 7 might be nearly impossible. Apart from the obvious features, there were numerous improvements to code made over these two versions that make the product far more secure than IIS 5 and earlier. That said, this should give you a summary start on information. I’ve listed some reference documents that may help you understand these features better. In general, I would encourage you to ask questions of the product team and or other users on the IIS.NET forums if you hear something that sounds negative regarding IIS. If the feedback is true, the product team has the benefit of improving the next release. If the feedback is unfounded, the product team has the benefit of helping you find the information you need to make an informed decision.

I might be Speaking at CodeStock – or watching Shawn Wildermuth

tobint — Fri, 03 Apr 2009 22:21:51 GMT

OK, so I had intended to announce that I posted a session submission to CodeStock and that voting was open. However, I procrastinated and Shawn Wildermuth beat me to the punch. So in an act of utter creepiness, I am modeling my post after his and invoking his name for extra copy-cat points.

For those of you that don’t know what CodeStock is, think of it as a CodeCamp done better – in two days instead of one. In their own words:

CodeStock is about Community. For Developers, by Developers (with love for SysAdmins and DBAs too!). Last year and idea started at CodeStock to mix Open Spaces within a traditional conference. This year we're going to crank things up to 11 and rip off the knob - and you're being drafted to help.

This two-day conference, of sorts, will be kicked off June 26th and costs only $25 to register.

My sessions are in the running, right along side Shawn’s. As he so eloquently pointed out, CodeStock attendees get to pick what sessions they wish to see from all of those submitted by would-be speakers. If my session doesn’t get picked, perhaps I can just watch Shawn. I’m told he has given a presentation or two in his career :)

So if you haven’t already, please go register for CodeStock so you can vote on those sessions while you can! Session voting ends on May 15th.

(Thanks, Shawn!)

Installing CakePHP on IIS 7

tobint — Fri, 03 Apr 2009 08:47:54 GMT

Recently I spoke with someone on Twitter who was having issues running CakePHP on IIS. With all the talk about ASP.NET MVC on IIS, folks forget that the MVC pattern works in other languages as well. CakePHP provides MVC development on PHP. That said, I wanted to dive in and see what the issues were involved in getting this project up and running on IIS 7. I managed to get it installed pretty quickly, but it does take a little tweaking to get you up and running. I've chronicled my adventures with CakePHP below in case anyone else is having issues. That said, I must first say that I am not an expert working with CakePHP. This was my first experience with the project, so this information is provided "as-is" and should be taken with a grain of salt. With this demo, I’ll be walking through the "Cake Blog Tutorial” offered on cakephp.org, and modifying it as needed to work with IIS 7. That said, let's get started.

Prerequisites

Install: IIS 7 on Windows 2008 Server or Windows Vista
- Install: PHP for IIS 7.0. Use the Web Platform Installer for easiest experience.
- Install: URL Rewriter module. Use the Web Platform Installer for easiest experience.
Install: A database supported by CakePHP. This post uses MySQL.
Download: CakePHP source code
- Unzip: CakePHP (entire contents) to the intended path

Yes, there ARE a lot of Prerequisites, but these are pretty typical for any MVC app on any platform.

Assumptions / Conventions

For the purposes of this post, I will use the convention/assumption that you have unzipped CakePHP to c:\inetpub\CakePHP\ . You should have the following paths now:

c:\inetpub\CakePHP\
- \app
- \cake
- \vendors
- .htaccess
- index.php
- version.txt

I will also use the assumption that this is being installed on the "Default Web Site". This is unlikely what you are doing, so you'll want to replace the "Default Web Site" instances in the steps below with your site or application path.

Lastly, I will assume that you are using and have already installed MySQL. You may use another database if you please, but this blog will reference MySQL.

Installing the Blog Sample

Pointing IIS to the cake document root

First, you'll need to configure your website to point to the correct location. Using the assumptions above, the correct location would be c:\inetpub\CakePHP\app\webroot\ .

Creating a Blog Database

Second, configure your database connection. To do this, you’ll need to create a blog database, and then point your configuration to that new catalog.

Start by creating a new MySQL Catalog using your favorite tool. I used MySQL Administrator. Simply right click in the catalogs and click “create new schema.”

Create a schema named “CakeBlog”. Once the schema is created, click on the “Tools” menu and select “MySQL Query Browser” and execute the following script:

/* First, create our posts table: */
CREATE TABLE posts (
    id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
    title VARCHAR(50),
    body TEXT,
    created DATETIME DEFAULT NOT NULL,
    modified DATETIME DEFAULT NOT NULL8.);

/* Then insert some posts for testing: */
INSERT INTO posts (title,body,created)
    VALUES ('The title', 'This is the post body.', NOW());
INSERT INTO posts (title,body,created)
    VALUES ('A title once again', 'And the post body follows.', NOW());
INSERT INTO posts (title,body,created)
    VALUES ('Title strikes back', 'This is really exciting! Not.', NOW());

* This SQL code copied verbatim from tutorial found here:

http://book.cakephp.org/view/326/The-Cake-Blog-Tutorial

You’ve now created your database and a blog posts table with some default posts. Time to configure CakePHP to read from the database:

Cake Database Configuration

We’ll need to let CakePHP know where the database is. Copy database.php.default in c:\inetpub\CakePHP\app\config\ to database.php

Open c:\inetpub\cakephp\app\config\database.php and change the $default variable to point to your database:
var $default = array('driver'       => 'mysql',
                                'connect'   => 'mysql_connect',
                                'host'         => 'localhost',
                                'login'        => 'CakeBlog',
                                'password' => 'c4ke-1z-k00l',
                                'database' => 'CakeBlog',
                                'prefix'      => '');

* This PHP code copied nearly verbatim from tutorial found here:

http://book.cakephp.org/view/326/The-Cake-Blog-Tutorial

You should not be able to open your browser to your application and see the default cake configuration page.

Setting up Rewriting Rules

CakePHP uses mod_rewrite, but also provides the ability to use Cake’s built-in ‘pretty URLs’. We’ll be importing the mod_rewrite rules from the .htaccess files from the default cakephp installation into the IIS URL Rewrite module. We’ll then have to modify those rules.

Start this process by opening the IIS Management Console. Open your application path. In this instance, we are using “Default Web Site”.

Click on the “Default Web Site”
Open the “URL Rewrite” module
Click on “Import Rules…” in the Actions pane
Click the “…” button next to the “Configuration file” textbox.
Select the c:\inetpub\cakephp\.htaccess file and click “OK”
Click the “Import” button
Click the “Apply” button in the “Actions” pane
Repeat steps 4, 5, 6 and 7 for c:\inetpub\cakephp\app\.htaccess and c:\inetpub\cakephp\app\webroot\.htaccess files.

The rules are imported, but now you’ll need to edit the rules.

Click the “Back to Rules” button in the “Actions” pane
Edit the two rules with the action starting with “webroot/”
Remove the “webroot” portion of the “Rewrite URL”. Your paths should now look as follows:

Creating your MVC Application

The remainder of your application setup should follow the steps found in the original “Cake Blog Tutorial”. There is nothing different between IIS and Apache at this point, so copying the steps would be a bit redundant. Start with the step named “Create a Post Model”. Much like ASP.NET MVC, Cake provides an MVC pattern for developing PHP applications.

Once you have completed the steps, you should have a default site that looks something like the following:

Summary

Installing CakePHP on IIS is actually not much different from installing on Apache. The main difference lies in the implementation of mod_rewrite on Apache vs URL Rewriter in IIS. Obviously the installation of PHP differs from Apache. IIS makes the installation of PHP simple with Web Application Installer. If you are using CakePHP on IIS, I would be interested to hear if your experience was different than mine.

A matter of pixels

tobint — Tue, 24 Feb 2009 01:34:58 GMT

I’ve been sick a lot lately. In fact, in my entirely life, I don’t ever remember being this sick for this long. It’s been weeks with the same cold – months if you consider the on-again/off-again problems I’ve been having. I guess it could be my fault. I’ve never been a big fan of drugs or doctors.

During my sick time, I try to do some work and often find myself barely able to concentrate. You know how it is, your head feels like its floating, and then you cough or sneeze and you feel as though your body has shaken apart into a million pieces. I’ve always equated that feeling with the visualization of my head becoming pixilated or snowy. That brings me, ever so strangely, to my current topic.

It’s been years since I focused on the front of web development issues. Back in the late 1990’s and early 2000’s I tinkered with client-side web development a great deal. I was writing “Ajax” applications before they were known as that. Of course, they all ran on intranet sites for my clients because they would only work in IE. I learned something back then. It was all a matter of pixels. In many cases, you had to take a box model and calculate precisely where things were and how they should line up. Of course, back then I was still using tables for layouts and cutting up images into manageable slices to put in individual or spanned table cells. Making those images line up, then, was extremely important to work on all browsers.

Over the years, I drifted away from client-side development. I have been concentrating on the back end of the web development stack. IIS, Apache, SQL Server, MySQL, MSMQ, MQ Series, BizTalk, WF, Remoting=>WCF, and associated technologies have been where I spent my time. What happened with data once my server pieces were done was beyond me. As a 3-year veteran working with IIS at Microsoft, you can see why this is important to me. That said, to help make IIS a better web server, it is always useful to actually know what is being served by your webserver, and why it may be important to you. I started playing with ASP.NET MVC which of course means I had to look at the “View” side of things again. To get a better grip on ASP.NET MVC, I decided to implement my blog in Oxite. Oxite isn’t a product, its a technology sample that is being followed to its logical conclusion – full implementation. This project fills the void of most samples by truly evangelizing the technology in a real-world implementation that can (and should) be implemented by others. Many of the samples out there are great examples of how to start an app, but never demonstrate that you can fully implement your project in the technology.

So, as I decided to dive in again and start playing with client-side development, I realized quickly that I needed to relearn everything I once knew. Box models were still important, but so was understanding the nuances of where my pixels within the context of their containers. Unlike with tables, that are fairly predictable, I learned very quickly that CSS-based DIV layouts can break down quickly if you aren’t using the proper attributes in your styles. div wrapping, overflow, z-indexes, display styles all became important topics for me to learn. I was trying to learn All this while I was laying sick in my bed!

I must say that I’m hooked now. I love technologies like jQuery. I’ve written a few plug-ins already. Some of them you see on this site, others will be on my site soon. Some will be coming in next revisions and available for download from this site. You can get the twitter client plug-in that scrolls at the top of this site’s page by downloading the Oxite skin on this website. I love that the community has developed many resources such as Yahoo’s CSS reset and associated style sheets.

Don’t get me wrong, I’m not an expert in these technologies overnight. I’ve got a LOT to learn. But I just keep telling myself, its all a matter of pixels. Count them out and everything will turn out ok!

Some resources for your own journey in client-side design/development:

jQuery – jQuery is a technology rooted in Microsoft’s leading XmlHttpRequest object. jQuery native core allows you to assign behavior to elements of the document object, perform common tasks such as layout, animations, fades and much more. This site’s plug-in repository is worth checking out and scouring for examples.
jQueryUI – If you like jQuery, this framework of UI plug-ins will help you get a clean, professional look for any website. The site allows you to create a customized theme, download it, and apply it to your layout. Absolutely brilliant.
YUI – Yahoo User Interface Library provides many user interface modules. I highly recommend the reset CSS. It helps all browser get on the same footing as far as padding, margin, borders, and spacing go. Very useful tool to help you achieve your desired look/feel on all browsers.
The Ajaxian – Great blog with useful information about developing dynamic content on the client side.
Introducing JSON – A good starting spot to learn about JSON (JavaScript Object Notation) and associated extensions such as JSONP. JSON allows you to serialize objects across Ajax requests. jQuery provides support for JSON/JSONP.
Microsoft: Introduction to JSON in JavaScript and .NET – Useful information to further your understanding of JSON.
HTML 5 Draft Recommendation – It always helps to know where your rendering specification is heading. HTML 5 supports things such as canvases that can render objects of irregular shapes and even manipulate individual pixels.
Common layouts – This useful site provides the code needed to produce common layouts in fixed and fluid mode.
Firebug – This tool is useful if you need to inspect a website’s output and determine what isn’t working. Often times it is hard to tell what setting is making our layout go wildly wrong. Firebug allows you to view the aggregate of your CSS calls for a given element, and let you see where your settings are coming from. The tool is invaluable to any client-side developer.
FireUnit – Provides JavaScript debugging. This is a necessary tool for anyone developing modern, dynamic, and interactive web UI today.
Color Schemer – This site provides a great tool to create color pallets for your site.

There is so much more to look at that I’m leaving out here. Obviously I could make the list extremely long. However, emphasizing everything means I am emphasizing nothing. I suggest those sites above as a good starting point.

Happy Coding!

Enabling VS.NET 2008 to work with IIS 7.0

tobint — Wed, 22 Oct 2008 14:08:05 GMT

This is likely old ground for some, but I thought I’d cover it again just in case. As you may know Visual Studio allows you to create a new web site on IIS. However, there are some minor steps that you need to complete before it will work appropriately.

Let’s walk through this.

Open Visual Studio .NET 2008
Go to File | Web Site…
Click the Browse… button to choose a Location
Click on the Local IIS button on the left

You’ll notice the IIS 6 Metabase and IIS Configuration Compatibility need to be installed as well as ASP.NET. The next steps we’ll go through will enable this for you.
Go to Start | Control Panel and click on the Programs and Features applet
Click on the Turn Windows features on or off button on the left
From the Windows Features window, select the IIS Metabase and IIS 6 configuration compatibility option under IIS 6 Management Compatibility as well as ASP.NET under Application Development Features
Click OK and wait as Windows configures the service
Once Windows is done configuring IIS, it may ask you to restart. Click Restart Now.
After rebooting, you should be able to walk through steps 1-4 again and create a Web site with the Local IIS option.

This should be all you need to do to enable Local IIS integration with VS.NET 2008.

IIS cannot start after upgrade to Vista SP1

tobint — Thu, 02 Oct 2008 00:31:40 GMT

Some time ago, I tried to start up the IIS Management Console on my Vista machine and I received an exception. After trying a few quick fixes, I gave up. I had several VPC images that I worked from and I didn't particularly need this machine to work when I had so many others. However, I've been doing a great deal of development on this machine now, and having IIS working is obviously rather handy. So, I tracked down the exception and solved my problem. I thought I'd go ahead and chronical my adventures for anyone else who is having this issue and needs help.

So first of all, the error that was displayed when I started inetmgr was as follows:

---------------------------
Failed to connect
---------------------------
There was an error when trying to connect. Do you want to retype your credentials and try again? 
Details: 
Creating an instance of the COM component with CLSID {2B72133B-3F5B-4602-8952-803546CE3344} 
from the IClassFactory failed due to the following error: 8007000d.
---------------------------
Yes   No   
---------------------------

So I thought that this might be a configuration error. I tried to roll back to a known good configuration but appcmd failed with the following exception:

ERROR ( hresult:80070426, message:Command execution failed.
The service has not been started. )

I tried to start the service with a good old fashion iisreset command and the following exception occurred:

Attempting stop...
Internet services successfully stopped
Attempting start...
Restart attempt failed.
The IIS Admin Service or the World Wide Web Publishing Service, or a service dep
endent on them failed to start. The service, or dependent services, may had an
error during its startup or may be disabled.

Once again, I thought I'd go into the services console and try to start IIS manually. After trying to start it manually, it failed, stating that a dependent service failed. So I looked at Windows Process Activation Services (WAS) and noticed it was stopped. I tried to start it manually and found the following:

---------------------------
Services
---------------------------
Windows could not start the Windows Process Activation Service service on Local Computer.
Error 13:
The data is invalid.
---------------------------
OK
---------------------------

So I checked out the event log and found the following four entries:

First Event :

Log Name:      System
Source:        Service Control Manager
Date:          9/21/2008 11:52:00 PM
Event ID:      7001
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Description:
The World Wide Web Publishing Service service depends on the Windows Process Activation Service service which failed to start because of the following error:
The data is invalid.

Second Event:

Log Name:      System
Source:        Service Control Manager
Date:          9/21/2008 11:52:00 PM
Event ID:      7023
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Description:
The Windows Process Activation Service service terminated with the following error:
The data is invalid.

Third Event:

Log Name:      System
Source:        Microsoft-Windows-WAS
Date:          9/21/2008 11:51:59 PM
Event ID:      5005
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Description:
Windows Process Activation Service (WAS) is stopping because it encountered an error. The data field contains the error number.

Fourt Event:

Log Name:      System
Source:        Microsoft-Windows-WAS
Date:          9/21/2008 11:51:59 PM
Event ID:      5036
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Description:
The configuration manager for Windows Process Activation Service (WAS) did not initialize. The data field contains the error number.

I checked through my event logs and realized that this started happening after I had upgraded to SP1. I hadn't recognized this as the issue because, as I said, don't typically use IIS on this machine on a regular basis. I decided to go back to my initial assessment that this had to be configuration related. I started doing comparisons between configuration of a pure Vista installation vs a Vista machine with SP1. I found that the schema had changed during the install, but something had been left out. The schema file was updated to add the configurationHistory configuration section, but a corresponding section definition was not added to the applicationHost.config file.

Whether this was what was causing the problem or not, I knew this was going to cause a problem. I added the following configuration entry to the applicationHost.config file under the section group for "system.applicationHost".

<section name="configHistory" allowDefinition="AppHostOnly" overrideModeDefault="Deny" />

After this I started the WAS service, the World Wide Publishing Service and the IIS Admin Service. I opened up the IIS Management Console and everything was working just fine.

I'm not sure what exactly happened during the SP1 upgrade that caused this file to not be updated, but I'm pleased to report that all things are up and running again.

Enabling VS.NET 2008 to work with IIS 7.0

tobint — Mon, 22 Sep 2008 11:08:00 GMT

Let’s walk through this.

Open Visual Studio .NET 2008
Go to File | Web Site…
Click the Browse… button to choose a Location
Click on the Local IIS button on the left

You’ll notice the IIS 6 Metabase and IIS Configuration Compatibility need to be installed as well as ASP.NET. The next steps we’ll go through will enable this for you.
Go to Start | Control Panel and click on the Programs and Features applet
Click on the Turn Windows features on or off button on the left
From the Windows Features window, select the IIS Metabase and IIS 6 configuration compatibility option under IIS 6 Management Compatibility as well as ASP.NET under Application Development Features
Click OK and wait as Windows configures the service
Once Windows is done configuring IIS, it may ask you to restart. Click Restart Now.
After rebooting, you should be able to walk through steps 1-4 again and create a Web site with the Local IIS option.

This should be all you need to do to enable Local IIS integration with VS.NET 2008.

IIS 7.0 Error Support

tobint — Sun, 21 Sep 2008 00:48:09 GMT

I know that most of you reading the blogs on this site have already seen how handy the errors are in IIS 7.0 as compared to previous error conditions. This weekend, I was playing with BlogEngine.NET and thought I'd put it on my personal site (tobint.com) to try it out. I downloaded the software and tried setting it up on my server. After following the brief instructions, I hit an error:

HTTP Error 500.22 - Internal Server Error
An ASP.NET setting has been detected that does not apply in Integrated managed pipeline mode.

In previous versions of IIS, this might have been all that I had to go on. I'd then search one or several search engines for that exact error and read through blog posts, forums, knowledge base articles and FAQ's before I found what I needed. In IIS 7.0, I found the friendly error page awaiting me:

I looked at the "Things you can try" and a picked the first "fix" on the list. Since my application was not in the Default Web Site, I ran the appcmd for my application in "tobint.com/".

As you can see, the error page correctly identified that my configuration needed to be migrated, and gave me the steps I needed to migrate it effectively. No searching the web. No trying to trace the problem down. No turning on tracing for ASP.NET pages.

I love this feature. It's a huge time saver and I don't think it gets bragged on enough.

Reading IIS.NET Blogs (or any RSS) with Powershell

tobint — Wed, 14 Feb 2007 14:46:00 GMT

Being a member of the IIS team, I often find myself checking blog posts to see what the members of the product team are blogging about. However, since Powershell came out, I find myself doing more and more work on my scripts. It's a bit annoying to have to jump out of Powershell to go read blog posts. As such, I've written a few quick scripts to help me read IIS.NET from my pretty blue shell. For those of you who are already familiar with powershell and don't want to read the long blog post, you can download my blog script from the DownloadCENTER: http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1387

(continued)

IIS 7 Logging UI For Vista - Download Now

tobint — Tue, 30 Jan 2007 14:28:03 GMT

As many of you already know, the management console for IIS 7.0 on Windows Vista does not have a UI for logging. Since this was a pain point for several customers, I decided to test out the extensibility APIs by creating a logging UI module.

( continued )

Extending Microsoft.Web.Administration through PowerShell (Part II)

tobint — Fri, 01 Dec 2006 11:46:00 GMT

In my previous post, I showed you how easy it was to leverage your knowledge of the IIS 7 managed SDK in Windows PowerShell. We loaded the IIS 7 managed assemblies and then traversed the object model to display site information and stop application pools. While this in itself was pretty cool, I don't think I quite got my point across about how powerful IIS 7 and PowerShell are together. As such, I wanted to show you some more fun things to do with PowerShell in the name of easy IIS 7 administration.

First, our examples still required a great deal of typing and piping and filtering. Let's modify our profile script from my previous post by adding at least one new global variable that will give us access to the ServerManager without much typing. Add the following line to your profile script from my previous post.

new-variable iismgr -value (New-Object Microsoft.Web.Administration.ServerManager) -scope "global"

(if you don't have a profile script yet, go back to my previous post to learn how to create one).

Note: If you signed your script before, you'll have to do it again after modifying the script

Open a new instance of PowerShell and now you can access the site collection just by typing:

PS C:\> $iismgr.Sites

That's considerably smaller than our previous examples. But let's not stop there. What happens if I want to search the site collection? PowerShell has some fun syntax for this as well. I simply pipe the output of my SiteCollection to a "Where-Object" cmdlet and then specify what site I'm looking for:

$iismgr.Sites | Where-Object {$_.Name -match "Default*"}

( blog post continued on IIS.NET ... )

Where can I find in IIS 7.0 ?

tobint — Tue, 10 Oct 2006 14:40:00 GMT

Question: Where can I find Windows Authentication in IIS 7.0?

I've seen this question or questions like this asked numerous times so I thought it would make a nice quick -- and hopefully useful -- blog post.

In previous versions of IIS, administrators were able to enable or disable features on their servers by simply checking or unchecking a box in the IIS management console. However, when an administrator unchecked a feature in IIS, the feature still existed on the machine and was even loaded. Unchecking a box allowed the administrator to disable a feature -- but it didn't physically remove anything from the machine.

(continue)

Steve Wozniak ... at Microsoft?

tobint — Sun, 08 Oct 2006 22:00:00 GMT

I know it may sound very strange coming from a Microsoft employee, but last Friday I found myself in awe while I sat directly in front of Steve Wozniak while he gave a presentation ... on Microsoft campus.

(continue)

Unsafe thread safety

tobint — Thu, 05 Oct 2006 00:42:00 GMT

As I stated in my last post, for the past two days I've been sitting in Jeffrey Richter's threading class. The class is near the end and I can't say that a lot of new concepts have been taught. Another student and I have decided that the class should have been renamed, "Threading Basics". That's not to say anything of Richter's teaching skill or the content of the class. It just goes to show that if the architecture of a product is right, the threading code should be extremely simple to use.

However, what I love about this class is that it reminds me how much I enjoy this topic. The theory of the perfect architecture doesn't exist. Additionally, many times the developer has little-to-no ability to push back on a bad architecture. It's in these cases that you must use your bag of concurrency tricks to work out of the whole the architect(s) put you in. That sound easy enough, but what if the architecture included - *gasp* - "less-than-optimal" decisions in the actual .NET framework classes? What if those decisions were made in the very methods that are supposed to help you with these synchronization problems? These problems perplexed me when I first encountered them and I never really thought to blog about them (I was actually just scared I was doing something wrong). Taking this class gave me the perfect excuse to bring the topic up.

(continue)

Back in business...

tobint — Mon, 02 Oct 2006 14:58:00 GMT

I haven't blogged for some time now. This in large part has been due to heavy workload, close deadlines, and the fact that I was alone in my workload. Over the past few weeks, I've been able to get my head above water. While our open position on the team is still "open", we've filled our contractor position. Not only have we "filled" it, we've actually brought in one of our old contractors who is more than capable. He is definitely helping to alieviate my workload already. I've finished my Vista RTM handoffs and that has taken off some more pressure. I've also completed my first review at Microsoft and, while I definitely see much room for improvement in the process, I was pretty pleased with the outcome.

All three of these events have helped me free up time to start blogging again. In fact, this new found freedom has given me some time to start taking some classes at Microsoft. As we speak, I'm typing this blog post up during a break of a class on managed code threading. Those of you that know me may be saying, "Didn't you write books on threading? Why would you sit in a class on that very topic?" Well, I'm attending for two reasons. The first of these reasons is that the class is being taught by Jeffrey Richter. No matter how much you think you know about anything, I guarantee you that Jeffrey Richter can make you feel like a "n00b". OK, there may be a small percentage of you out there that know more about obscure printer driver hacks, but even there, I'd defer to Mr Richter. If you ever get a chance to sit in on one of Wintellect's classes, I recommend you take advantage of that opportunity. If you can't afford it, I'd recommend you read the many books published by Wintellect employees. The second reason I'm sitting in this class is because I think threading is increasingly important. When I co-authored my first book on this topic, I believed that the multi-core and multi-processor industry would be growing by leaps and bounds making threading knowledge extremely valuable. This is proving true as Intel has just announced that they will have 80 core processors by 2011. If you don't know how to use multi-threading techniques PROPERLY, I highly suggest you start learning. Despite my involvement in three books on the topic of threading, Richter's class, in my opinion, is one of the best means to get solid, current multi-threading advice today.

I hope you'll forgive the silence on my blog from the past few months. I also hope you'll come back often and trust me to provide you with some relevant articles on a more regular basis.

Accessing Microsoft.Web.Administration through PowerShell (Part I)

tobint — Sun, 01 Oct 2006 11:43:04 GMT

I've caught the PowerShell bug. In between stints with my ever-expanding code samples, I play with PowerShell a lot. I thought I'd share a quick example of how to load Microsoft.Web.Administration.dll and use it to perform some basic tasks.

Note: I'm running these samples on Windows Vista RTM, but I have no reason to believe this will not work on the PowerShell release candidates for the Vista RC* builds that are available now.

So let's get started.

First, PowerShell has no idea where Microsoft.Web.Administration.DLL is so you have to tell it how to load it. Anyone who has written code to dynamically load an assembly should be familiar with this syntax. Type the following command

PS C:\> [System.Reflection.Assembly]::LoadFrom( "C:\windows\system32\inetsrv\Microsoft.Web.Administration.dll" )

The path to your assembly may change depending on your install. I'll show you later how to use environment variables to calculate the correct path. In the mean time the out put of the line above display something like the following:

GAC Version Location

--- ------- --------

True v2.0.50727 C:\Windows\assembly\GAC_MSIL\Microsoft.Web.Administration\7.0.0.0__31bf3856ad364e35\Microsoft....

Once the assembly is loaded you can use PowerShell's "New-Object" command to create a ServerManager object that is defined in Microsoft.Web.Administration.

PS C:\> (New-Object Microsoft.Web.Administration.ServerManager)

( blog post continued on IIS.NET ... )

Why am I smiling?

tobint — Fri, 21 Jul 2006 14:22:00 GMT

I moved to Redmond just over four months ago. In the time I have been here, my rental car was side-swiped, my truck was broken into, my headlight and bumper were damaged by someone in our own parking garage, someone stole my copy of "Professional Visual C++/CLI" from my office today (clearly someone missed the "corporate values" talk at New Employee Orientation), and my relocation to the great Pacific Northwest has been less than smooth or swift -- waiting for the insurance company to assess and pay my claim for the furniture damaged by the movers. I'm the only PW in my group and we've been unable to find anyone else that can fill the shoes for our open position. I have deadlines looming with tons of work to do and not enough time to do it all by myself. Bill Gates has announced he is reducing his role here, both Windows and Office have announced schedule changes and Microsoft's stock has dropped over four dollars since I arrived on campus.

So why am I smiling?

In four month's time I've learned so much. I've been able to look at the technologies we will implement in the future before most people even know they are in the pipeline. I sit in on meetings and get to give real feedback that can influence products used by more people than I could have ever imagined. I have taken over ownership of an internal tool our team uses and have written a few of my own. I've gathered customer feedback and helped several customers personally or got them in touch with others who could help them. The amount of responsibility piled on me is less of a burdon and more of a compliment, in my opinion. Who puts that amount of pressure on someone if they feel they can't handle it?

Apart from all the benefits provided by Microsoft there are other reasons I'm happy to be working here. I'm in a technological heaven. The people are brilliant and open-minded (except when it comes to "Red State" ideas, but give me time -- I'm still working on it). I pass those same brilliant people in the halls every day. If I have a question about something, I can go hit our Global Address Book and track down the person who owns the feature to discuss the matter with them personally.

I also get to see the company make huge changes in the way it delivers software. With the industry changing so quickly, its awesome to see a company of this size roll with the punches and adapt.

It's hard to explain why I'm so happy to work here. The only thing I can say is that you can tell that the majority of people working here love working here and finding new ways to make customers happy. That reason alone is enough to make me love working at Microsoft.

Enjoy the weekend!

OT: Bank transaction privacy

tobint — Thu, 13 Jul 2006 13:10:00 GMT

BankRate.com is reporting a story about the use of financial transactions being used to track down terrorism. Of course, our anti-American partners at MSN are, of course, lapping up the story like a dog to a toilet bowl.

The article states:

According to their rules, any group of transactions totaling $5,000 or more that "is not the sort in which the particular customer would normally be expected to engage" can cause enough suspicion to create a SAR [Suspicious Activity Report].

Having engaged in more than my fair share of transactions last year that involved more than $5000 on a weekly basis, and having had my fair share of "irregular" bank transaction requests, I can state that I more than likely have one or more of these reports generated about me and suprisingly enough, I'm not cowering in a corner waiting for the feds to bust down my door. Now, if I had engaged in any illegal activity, I am sure I'd be singing a different tune. I also appreciate the fact that our government is trying to track possible terrorist activities and I'm thankful that we have a President who is willing to do what is necessary to meet that need.

It seems to me I remember some certain "Jersey Girls" complaining:

I watched my husband murdered live on TV. . . . At any point in time the casualties could have been lessened, and it seems to me there wasn't even an attempt made.

Among other things, they charge that nothing was done in a meaningful timeframe to save anyone's life, that the delay was on purpose, and that [President] George Bush was responsible for the deaths of three thousand people.

I actually can understand the sentiment and complaints. I can even sympathize with the rationale, but these same women are complaining when we do try to gather intelligence. Democrats are proud to bring up the intelligence failures of 9/11, but are also quick to leak intelligence to ensure failure again in the future -- and they wonder why they lost the Presidential election as well as the House and Senate in 2004?

Now, I'm certain I'll be attacked for taking this stand, but I want to get one thing straight. I don't believe that the government should be so involved in our lives either. I think that we have let the government etch itself too deeply into our way of life. Let's not forget that the government was never intended to control so much of our lives. Instead, we've perverted it to do so and now we are paying the consequences of those decisions. Socialism has crept into our society years after we supposedly defeated it. We've put the burdon of our every-day lives onto the government and now that the government is taking what we have given them over the years, we are going to complain?

You cannot have it both ways. Either you have a government that is in charge of distributing wealth, protecting citizenry, giving "free" health care to "everyone", establishing what is moral and what is not, literally robbing from the not-so-rich and giving to the not-so-poor, educating our children (if you can call it that) and caring for our every need, or they can be a thin layer of government that conforms to the will of the people and doesn't have the ability or business of prying into our every day lives.

Looking left and turning right: management style

tobint — Fri, 07 Jul 2006 16:43:00 GMT

Today, I was returning from my manager's office to my own when I nearly collided with another manager-type in the hall. As I was approaching a hallway intersection, a manager emerged in a bit of a hurry looking to the left while she was turning to the right. She prolonged her view to the left for so long that her path was diverging directly into mine. In motorcycle safety course several years ago we were taught while taking a corner that we should look in the direction of the curve. Looking to the opposing direction could often cause us to veer off course toward the direction of our gaze. Referring back to my manager-turned-missile, of course, I scrambled to get out of her way before she hit me. This was rather awkward to do and by the time the manager looked back at me shuffling around, she look at me like I was the stupid one and didn't as much as say "oops, sorry".

Nothing in this world enrages me more than managers with an inflated view of their own self-importance. But this is rather indicative of the problem I think we face in our company. We know where we want to go, and if we just focused on our own goals, we would get there in spectacular fashion. This isn't the case, however. We fixate on what other companies are doing and what else we could be doing instead of directing our gaze at what we are working on until it is completed. Couple these misguiding glances with all of our team meetings, morale events, office sharing and quarterly group/org/company ra-ra meetings that do nothing more than tell us what we already know -- or tell us more than we care to know -- and it's no wonder we cannot get anything done.

I encourage Microsoft to start training our managers -- and our non-management employees for that matter -- to stay focused on the direction of our company. Stop worrying about what every other company out there is doing and start worrying about what we are NOT getting done on time. Our customers depend on us. You want to drive up customer satisfaction rates? How about delivering a product for them to be satisfied with! You want to drive up revenue? How about filling some warehouses with some freshly minted retail bits!

Obsessing over our career options at myMicrosoft and worrying about work-life balance cannot continue to be our main focus. Putting our focus in that direction will only take us off course from our real goals. Trust me, when we deliver quality products to our customers on time and under budget, our career options will open up for themselves. And nothing makes work-life balance easier than getting performance bonuses that we can spend on our nights, weekends and vacations or put toward our children's college education fund.

Edit:
I should clarify that I am also guilty of this very same problem. While re-reading my annual review, my commitments are filled with goals that aren't in my direct line of responsibility. This is as much of a criticism of myself as it is of anyone else. Furthermore, my managers up my direct line have been pretty wonderful, supportive and have kept me fairly focused on my tasks.

SDK Sample: Programmatically change the runtime version of an application pool in IIS 7

tobint — Wed, 28 Jun 2006 20:02:00 GMT

I have posted a new sample on IIS.NET demonstrating how to programmatically change the managed runtime version of an application pool in IIS 7.0. I have posted code in VB.NET and C#. Enjoy.

Communication breakdown: internal spam affects productivity

tobint — Wed, 28 Jun 2006 17:49:00 GMT

When I interviewed with Microsoft, I was asked, "What is one thing we can count on you to do at Microsoft?"

My reply was brief: "You can count on me to complain."

My interviewer suddenly took on the puzzled look that an interviewee would normally take when presented with an unfamiliar scenario. The facial expression of my inquisitor demanded an explanation. I decided to end the torment by presenting further detail; “When something is wrong, I’m going to bring it up and someone will hear me. I’m not going to just complain, but I’m going to offer at least one alternative solution.” Apparently, my explanation cured the torment of my initial declaration. I was hired and here I sit; typing my 23rd Microsoft blog post to an audience that has graced me with tens of thousands of views. This particular post is a follow-up on my promise to complain and provide an alternative solution.

As many have said in the past, email is the life-blood of our company. We communicate everything in email. That’s why our anti-spam measures that counteract external tormenters are so critical to our business. But what are we doing about the measures to counteract internal spammers? Adam Barr made light of the need for Microsoft Outlook rules in his short story, “The Microsoft Code”, but the premise is 100% genuine. Internally, we have people who just LOVE to toot their own horns and, as you might guess, these horn-tooters are typically the management way up the line. They do this horn-tooting in a barrage of email that cripples productivity. This is fine, I suppose, but it comes from the internal culture that supports working toward better reviews each year rather than making meaningful contributions to their teams, organizations, the company and (hopefully) the customers. When a director sends you a “professional” email that contains exclamation points and smiley faces, you can almost assuredly delete the email – can anyone make an Outlook rule for that?

I've been at Microsoft for less than 4 months now and I've been swamped with work since I came to Redmond.   I am the only worker of my particular discipline in my particular group. I have deadlines; big ones; looming ones. I sincerely mean no offense here, but I don’t have time to listen to everybody in our company talk about what they did and what they are going to do. To take that one step further, I don’t care to know everything that’s going on. I lose my focus as I try to decipher the email and understand how that particular communication affects my day-to-day work. If our upper management stopped to think about the opportunity cost of each email they sent out, we might actually have time to stop reading email and start getting products shipped on time. Seriously, I wonder how many people send out these emails to distribution lists that “appear” correct (apparently based on the name of the group) without actually looking to see who is involved in the distribution. Those distribution lists in the GAL can be nested so many levels deep, I venture to say that no one knows who is going to receive a particular email with any degree of specificity.

If upper management is going to send email to everyone, what is intermediate management meant to do? I personally prefer a military style approach where one level talks directly to the level above them and the level below them with rare communications in between. If those particular levels above or below think the information is important to the next level up or down, they can forward that communication accordingly. Dissemination of information in this particular manner assures that the appropriate people get the data, and everyone else doesn’t suffer from information overload. Each management level can also summarize the information and parse out the pieces that they feel are important for their group – a human Outlook rule, if you will.  That's obviously not the culture we have here at Microsoft.

One idea I tossed about in my head was the idea that everyone internally should have their own RSS feed or VLOG. When someone wants to toot their own horn, they can do so on their blog; their managers can see those accolades, their team can see it, and the people who really care about it can see it. If that particular employee keeps blogging about stuff that doesn’t affect me, I can unsubscribe and stop wasting my time reading/watching that feed – providing incentive for everyone to keep their topics relevant or risk humiliation with low agg-view participation. In this approach, new employees or employees who transfer to groups could then subscribe to manager-recommended OPMLs that generally contain information that you will want so you can be effective in your new role.   Furthermore, RSS feeds can be much more easily tagged than email can. I can subscribe to “John Doe’s IIS posts” but filter out “John Doe’s Accomplishments” (much like my own blog that will allow some of you to ignore this particular “Microsoft Culture” post if you so desire). Sure, this is not a perfect solution, but it's a start.

I have tons of important data to keep track of. Communication is very important to the company – too important to gum up with internal spam. We need to find a solution or we will forever find ourselves bogged down in self-congratulatory expression and no real work getting done.

Security: There's incompetence, and there's major incompetence

tobint — Wed, 21 Jun 2006 22:11:00 GMT

It's one type of incompetence to keep the personal identifiers and financial data of customers on your laptop and then lose it -- twice; It's an entirely different type of incompetence that allows government data to be compromised through a network. Last year at TechEd, a demo showed how a completely patched network could be compromised using an exploit in a web site. The best part of the exploit was made possible due to turning on more functionality than was necessary. Namely, one issue in the demo was that the router configuration allowed port 80 and port 443 traffic -- despite the fact that SSL was not in use on the web site.

Regardless of the platform being used, many of these compromises are possible these days not due to the operating system itself, but due to assumptions made about users, lack of planning, or pure laziness of administrators and developers. This is one major reason why I'm not a big fan of agile. Despite the best arguments I've heard for agile software development, I have witnessed too much emphasis on feature completion without regard to overall system security. I would encourage you all to read Michael Howard's new book on the security development lifecycle (link provided below).

Whatever the case -- whatever the cause -- I would urge the community to pay attention to the recent news stories, learn to start protecting important data and please stop putting personal and financial information that doesn't belong to you on your laptop!

For more Microsoft resources on security please check out the following:

General Security Websites:
http://www.microsoft.com/security/default.mspx

Developer Security:
http://msdn.microsoft.com/security/securityreskit/default.aspx
http://msdn.microsoft.com/security/securecode/default.aspx

Blogs:
http://blogs.technet.com/msrc/default.aspx
http://blogs.msdn.com/michael_howard/

Books:
http://books.mcgraw-hill.com/getbook.php?isbn=0072260858
http://www.microsoft.com/MSPress/books/5957.asp
http://www.microsoft.com/MSPress/books/8753.asp
http://www.microsoft.com/mspress/books/6893.asp
http://www.microsoft.com/mspress/books/6788.asp
http://www.microsoft.com/mspress/books/6892.asp
http://www.microsoft.com/mspress/books/6432.asp

ADO.NET 2.0 Boot Camp

tobint — Tue, 20 Jun 2006 20:01:00 GMT

Sahil Malik, a prolific speaker, Microsoft MVP and author of "Professional ADO.NET 2.0" is holding a one-day ADO.NET boot camp in Charlotte next month. If you are in the area, I think this class will definitely give you your money's worth. Sahil has a very unique way of teaching that is easy to follow and highly effective. If you are going to be in the area on July 21st, and want to master ADO.NET, I would encourage you to take a look at this great opportunity in the Charlotte, NC.

Workaround: Adding a script map in IIS 5.1

tobint — Sat, 17 Jun 2006 01:15:00 GMT

I was contacted by a customer who commented that he could not add a Script Map to IIS 5.1. After selecting his executable for the script map and adding his extension, the "OK" button was still disabled -- preventing him from committing the script map change.

To work around this issue, once you have selected the executable and set the extension, click inside the "Executable" text box to expand the full path to the executable. Doing so will enable the OK button and you will be able to commit your script map change.

Bill Gates affect on my mood

tobint — Thu, 15 Jun 2006 15:29:00 GMT

Being a new employee at Microsoft leaves me at a bit of a disadvantage in weeks like this. First, we hear that our "chief blogging officer", Robert Scoble is leaving the company. Today, it’s been announced that BillG will be stepping back his responsibilities at the companies once again. It is not like this wasn't expected, but it is a bit disheartening, none-the-less.

Bill Gates has had a profound affect on my life. I grew up in a poor town with family that worked VERY hard to provide for us, but by no means were we wealthy. However, when I was writing code on my Atari 800XL in fifth grade, I told my mom that I would be working for Microsoft one day. Since then, Bill Gates' drive has inspired this poor kid from East Liverpool, OH to succeed. No matter what life throws at you, who makes fun of you or attacks you with pies you can always come out on top. Like BillG, I didn't finish college -- but unlike Mr. Gates, I quit because I ran out of money. None-the-less, in my mind, I said "If Bill can succeed without a degree, so can I!" Over the years, my life has thrown one curve ball after another at me. I've had good times and bad. The one common factor in all those years has been Microsoft software; I've made my career of it; I've based my life on it; My house and my belt clip are embedded with it; I've tied my success (if I can call it that) to it. So with all of this said, it’s a deeply saddening experience to see the man who is responsible for getting it all started is now slowly backing out of his role here.

However...

If you talk to the larger percentage of Microsoft employees, most of us have had little to no interaction with Bill. Our software goes in and out the door much without his micro-management or interference. How much of the Microsoft Office 2007 feature set was designed or coded by Mr. Gates? What drivers for Windows Vista do you think Bill had a part in creating? My guess is, very little of our software is directly controlled by Bill. Instead, he delegates those responsibilities as he sees fit.

I think it's great that Bill gets to follow this path with his life. There is such an emphasis on giving at Microsoft. I'm proud to be part of a company that thinks about more than what goes on inside its own walls. I, too, intend to do charity work full time at some point in my life. I think, one again, Bill is setting an example for my own life. I obviously will not likely be able to do this to the same degree that Bill Gates is, but the example has been set and I admire the man.

Microsoft will go on making great software on and off the desktop for years to come and Bill is responsible for the spark that started this software industry off in such spectacular fashion. It’s time for someone else to take the torch and move on while Bill starts a new spark in charitable giving. If it's possible for someone 11 levels under Mr Gates to say this, I'm proud of him for doing this and I can't wait to see what he accomplishes with The Gates Foundation when he goes full time with it in 2008.

Good luck, Mr. Gates, and God Bless.

ASP.NET 1.1, IIS 6.0 and 64-bit Windows

tobint — Thu, 15 Jun 2006 11:17:00 GMT

A few days ago, one of the many distribution lists I belong to was presented with the following requests:

I’m trying to create a Web Service in Visual Studio .NET 2003 and am getting an error “Visual Studio .NET has detected that the specified Web server is not running ASP .NET version 1.1. You will be unable to run ASP .NET Web applications or services.”

The individual said that he had checked the script maps and everything seemed to be in order on the server. They had installed and uninstalled the ASP.NET extensions several times using aspnet_regiis.exe. After a few more communications the poster added:

(Potential complication: my machine is a 64-bit OS; does this change the equation?)

The answer is that running 64-bit Windows does have an affect on your ability to run ASP.NET 1.1 in IIS 6. ASP.NET 1.1 only supports running in 32-bit mode. Fortunately, IIS 6 on 64-bit Windows can run in either 64-bit mode or 32-bit mode.

The following steps to run IIS 6 in 32-bit mode can be found in our MSDN documentation:

Click Start, click Run, type cmd, and then click OK.
Type the following command to enable the 32-bit mode:

cscript %SYSTEMDRIVE%\inetpub\adminscripts\adsutil.vbs SET W3SVC/AppPools/Enable32bitAppOnWin64 1
Type the following command to install the version of ASP.NET 1.1 and to install the script maps at the IIS root and under:

%SYSTEMROOT%\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe -i
Make sure that the status of ASP.NET version 1.1.4322 is set to Allowed in the Web service extension list in Internet Information Services Manager.

After following these instructions, the issue still wasn't resolved. In fact, the script maps for the web application were not being properly updated. I had the customer execute the "aspnet_regiis -ua" which would remove all versions of ASP.NET from the machine. To reinstall the ASP.NET 1.1 again, you then need to reissue the "aspnet_regiis -i" command (use "aspnet_regiis -i -enable" if you are using Windows 2003). This should allow you to run ASP.NET 1.1 on IIS 6.

Keep in mind, however, that IIS 6.0 cannot run in both 64-bit mode and 32-bit mode at the same time. By running IIS 6.0 in 32-bit mode on 64-bit Windows, ASP.NET 2.0 applications will also run in 32-bit mode.

(This blog post was cross-posted from: http://blogs.iis.net/tobintitus/archive/2006/06/15/1315931.aspx )

Work-life balance; Robert Scoble; Weekends @ Microsoft

tobint — Sun, 11 Jun 2006 21:36:09 GMT

Since coming to Microsoft, I have heard a LOT about our policy on "work-life balance". If you aren't familiar with what work-life balance is, a simple search on the web should satisfy your curiosity. Essentially, we believe that people work best when they are satisified with their accomplishments at work as well as their lives at home. Microsoft will often say that their greatest asset is their employees. However, Microsoft doesn't actually believe that last statement. Now if you are a manager or an HR rep at Microsoft, and you just read that last statement, you probably just spewed your soda ("pop" for some of you) all over your flat-screen and keyboard. Never fear. Let me explain that. If Microsoft actually believed that employees were an asset, they would treat them like they owned them. This is NOT the case. In fact, Microsoft treats us more like a guest that they don't want to leave. I'm sure this week will be particularly hard for Microsoft as one of our more prominent guests have announced they are leaving. I'm glad that Robert has seen fit to shut down the critics who opened their mouths before getting the facts straight.

I often hear about how Microsoft doesn't pay enough or treat their employees right. While that may or may not be true (depending on who you talk to), Microsoft has proved with their benefits that they do care deeply about their employees. From day one at Microsoft, you are given a package of benefits so thick that it takes two days of new employee orientation to help you get familiar with them -- and even then, you are left bewildered with all of the benefits and resources at your disposal. One such benefit that is actually a "requirement" at Microsoft is work-life balance. In the past three months since my arrival, I've been pressured to make sure I have been enjoying life while getting my work done at the same time.

However, here I sit at work on the weekend, trying to pound out some of my work while there are less distractions and no meetings to attend. This is by choice, obviously, and if anyone from my team knew I was here, I'm sure I would get reminded that my "life" is just as important as work. Of course, at the moment I decide to take a quick break, a member of my team walks in and "catches" me with a pocket full of ping pong balls on my way from the ping pong table. See, I've got work-life balance! (Thank goodness they didn't catch me working instead).

This post was prompted by the news of Scoble's departure and the folks that immediately took that opportunity to bash Microsoft over "letting him go". And that they didn't "do everything they could to make sure he stayed put". I'm sure that everything was done to encourage him to stay -- but remember -- he is just guest and not an asset. Therefor he is entitled to leave any time that he wants for whatever reason he wants.

I'm very sorry to hear Robert Scoble is leaving Microsoft, but very happy that he cleared the air about life at Microsoft before it got out of hand.

Good luck, Robert!

Improving code performance

tobint — Tue, 06 Jun 2006 16:40:00 GMT

Recently, an old co-worker contacted me to ask me a question about code performance. Specifically, he was emitting IL from his code and had some questions about some of the opcode usage he witnessed when viewing the IL of some compiled assemblies. The question was based on a simple application he wrote in C#, compiled, and disassembled. He did this to see how the C# compiler produced IL and give him clues in how he should emit IL. The function in question was as follows:

public object GetProp(string name)
{   if (name == "X")
   {    return this.X;
   }
   return null;
}

Now, the code obviously isn't meant to do anything other than lend some insight into the IL. Compiling to 'debug' the following IL was produced.

.method public hidebysig instance object
        GetProp(string name) cil managed
{
// Code size       35 (0x23)
.maxstack 2
.locals init ([0] object CS$1$0000,
          [1] bool CS$4$0001)
IL_0000: nop
IL_0001: ldarg.1
IL_0002: ldstr      "X"
IL_0007: call       bool [mscorlib]System.String::op_Equality(string, string)
IL_000c: ldc.i4.0
IL_000d: ceq
IL_000f: stloc.1
IL_0010: ldloc.1
IL_0011: brtrue.s   IL_001d
IL_0013: nop
IL_0014: ldarg.0
IL_0015: call       instance string class TestApp.TClass`1::get_X()
IL_001a: stloc.0
IL_001b: br.s       IL_0021
IL_001d: ldnull
IL_001e: stloc.0
IL_001f: br.s       IL_0021
IL_0021: ldloc.0
IL_0022: ret
} // end of method TClass`1::GetProp

The question was, why was the stloc.1 and ldloc.1 needed after the ceq instruction at IL_000d (there are actually other issues in this small snippet, but I'll focus on this particular one) . I, too, tried to resolve the issue and batted a few guesses around. I proffered two ideas, and then ultimately suggested that the JIT compiler would likely be modifying this code anyway (particularly once it was recompiled in 'release' with optimization).

Still curious as to why the compiler produced the stloc and ldloc opcodes, I asked around internally until Vance set me straight with this blog post.

Introduction: What does ‘foreach’ actually do?
http://blogs.msdn.com/vancem/archive/2006/02/20/535807.aspx

Essentially, he states what I initially felt -- that the JIT transformations on the IL are so dramatic, that you cannot judge an application's performance based on the IL. He also gives some great information on how to view your JITed code -- with release optimizations and everything. The other side to this is, that after further review, the inefficiencies of the IL were fixed in the optimized IL anyway once the code was set to 'release'.

Sometimes, it's really easy to get side-tracked by these discussions in your quest for software glory. I'm glad to know we have people like Vance around to set me straight when I do.

IL Performance Optimization

tobint — Tue, 06 Jun 2006 13:13:34 GMT

public object GetProp(string name)
{   if (name == "X")
   {    return this.X;
   }
   return null;
}

(continue)

IIS 7 on a MacBook !

tobint — Wed, 24 May 2006 12:58:03 GMT

The IIS 7 Commander-in-chief, Bill Staples , has just released a screenshot of his new 17" MacBook running IIS 7! I simply must get one now!

Beta 2 Live - IIS.NET now open!

tobint — Tue, 23 May 2006 11:39:00 GMT

Now that Beta 2 has been announced and IIS 7 is now publicly available to beta testers on both the Vista and Longhorn platforms, our new portal, IIS.NET is now open and live! Many long hours were spent on this by some great guys here at Microsoft. Be sure to stop by and tell them what you think of the site!

IIS 7.0 UE team is hiring!

tobint — Mon, 15 May 2006 11:58:00 GMT

We're hiring! Take a look at the details below

"Do you love Internet and Web server technologies? Join the IIS UE team and work on the coolest version of Internet Information Services (IIS) ever. IIS 7.0 joins forces with ASP.NET to deliver a Web application development platform that's getting rave reviews from customers.

We're looking for a programmer writer to define and deliver essential developer-focused, solution-based documentation for a programming audience. Your responsibilities will include writing API reference topics, conceptual topics about IIS, and code examples that demonstrate product features. You’ll be responsible for multiple feature areas, so good organizational skills and the ability to prioritize your workload are a must."

(continue)

Online Training: Upgrade from VB 6.0 to VB.NET and Absolute Beginners Guide to VB.NET Express Edition

tobint — Mon, 15 May 2006 01:05:00 GMT

Microsoft Learning has put together a great series of training courses which are available now at a substantial discount. Take advantage of the deal while it lasts (sale ends June 30th)!

https://www.microsoftelearning.com/visualstudio2005/#upgradingfromVB60

Also, don't forget to check out the free training videos for VB.NET Express Edition. They provide a great starting point for anyone looking to break into the Visual Basic .NET market.

http://msdn.microsoft.com/vstudio/express/vb/learning/

What technology actually improves your life?

tobint — Mon, 15 May 2006 00:00:00 GMT

Nearly a year ago, I blogged about the fact that I had no "cool" technologies in my house. I didn't own a single gadget that anyone would consider to be "up to date" by any standard. I didn't own a PDA, a laptop, or even a modern cell-phone. I didn't have flat-panel monitors or anything other than a standard 27" television -- with a broken power button at that. I had several computers in the house, but all of them were at least a year and a half old -- with the exception of my wife's gaming system.

I decided after posting that complaint that things were going to change. I released my death grip on my cash that I had been hording and sprung for a new, improved, gadget-savvy image.

Flash forward to today -- 11 months after that post. As I got ready to head into work, I closed up my 17" widescreen HP media center ready laptop and turned off my HP printer/copier/fax. I packed up my Gateway Tablet PC and shoved it into my Microsoft backpack along with my 60GB video iPod, assorted USB flashdrives, bluetooth adapters, folding headphones, and the like. I strapped my 8.1 MegaPixel Nikon digital camera and Audiovox Smart Phone to my belt. I put my Motorola bluetooth hands-free headset on my ear. I walked into the living room and turned off my 50" Plasma TV and shoved the wireless controllers for my Xbox 360 under the TV stand. I walked out to my car and looked at the windshield cluttered with an XM SkyFi2 satelite radio, a Sirius satelite radio, and a Microsoft Streets and Trips GPS device. Now, I say all of this to point out that I've gone from one extreme to another and at no small expense. I sometimes wonder if I should have just hung onto my cash, but in other instances, I really enjoy my products.

I asked myself as I traveled to work this morning "Have I gotten my money's worth out of these devices? Have they made my life better -- or just more expensive?" It seems that many of today's top technological gadgets are great at overcoming technological problems, but do they really enrich our lives? My Smartphone is one device that I just couldn't live without. I keep track of my appointments, birthdays, phone numbers and so much more on that little thing. I also keep a copy of Microsoft Pocket Streets and Trips on there -- which is a great little tool for getting around. There is no question that this device makes my life easier in today's society that requires that I know how to contact any number of people, keep track of appointments and schedules that change every hour, or keep me up to date with birthdays of family members all the way on the other side of the country. My camera is great. Photos are so hard for me to keep track of. I keep a few but they are usually buried in boxes that I have to dig for if I want to view them again. I can snap pictures of the mountains out here in the Pacific Northwest and immediately send them to my parents. The camera is a great addition to my "technical family." That said -- there are other devices that just seem to be excessive (Who needs XM and Sirius and an iPod? Could I do without them? Most likely.)

I could go on and on talking about my devices. Instead, I'd like to hear from you. What technologies have made your life better? These could be services, pieces of hardware, or even websites in general. I want to know what technologies make a difference in your everyday life and what technologies have you invested your hard-earned money into that haven't been worth it.

Mort, Elvis and Einstein don't exist

tobint — Mon, 01 May 2006 20:44:27 GMT

Much has been said about the Mort, Elvis and Einstein controversy over the past few years (yes, years). The past few days have been no exception. One of our MVPs is apparently upset about them, and apparently some employees are not too happy about it either. I've waited several days to comment until the screaming stopped. Now that it has, it's my turn to weigh in. Most of this content about this topic is completely off-base and unfounded. "Why?", you might ask. That's because Mort, Elvis, and Einstein don't exist. That's right, there is no one person on this planet that is meant to be exhibited by these personas. The names depicted here are meant to represent behaviors -- not people. Trying to pigeon-hole people into one of these areas is just a misrepresentation of what the persona was meant to portray.

Mort is not a VB developer, Elvis is not a C# developer, and Einstein is not a C++ developer. Sure, the personas use these analogies because they do fairly closely resemble a large stereotypical audience, but it doesn't "fit" to anyone. Then again, no description fits more than one developer. These personas don't drive features and they don't do anything but serve as reminders that we have different types of developers who need different types of features, documentation, and applications. Don't think this is true? Ask the average VB developer what a thread is and they may get the "word for word" answer, but a large part of that audience never has wanted to understand the intricate details of thread local storage, differences between the stack and the heap and why those are important in the context of application development. Does that mean that all VB developers don't care about threading? NO. Once again, there is plenty of evidence that einsteins exist in the VB community as well -- "Einsteins" meaning people who want detail! Mort behaviors exist in the C++ community as well. I'm one of the people have have a mort mentality with C++. I know so little about C++ I'm amazed I'm allowed to breath the same air as the folks here at Microsoft. That, indeed, is the Mort side of me.

Several people have asked "Why are there no definitions for these from Microsoft." And they are hopping mad about it! Quite frankly, its because the personas were not meant to be public information. They were used to help mold and categorize functionality internally, and nothing more. Because of that, the actual documents for these personas are not available externally. If they were, they would also likely be taken out of context.

That said, this won't be the last discussion about these fictional characters. I imagine we'll be hearing about them for some time. Just remember to take everything you hear with a grain of salt, and if you think the way we construct software is wrong, by all means RESPOND! Speak up, tell us how you would approach it. Better yet, apply to the team that interests you most and come implement those changes yourself!

Free Training CDs from AppDev

tobint — Mon, 01 May 2006 09:20:35 GMT

AppDev is apparently giving away free training CDs. I have not personally seen the training, but free is not typically a trait in a product that I hate, so AppDev already "has me at hello" with this offer!
http://www.appdev.com/promo.asp?page=SN00009

What's wrong with MSDN documentation? (and what's right?)

tobint — Fri, 28 Apr 2006 14:17:17 GMT

A large part of my job at Microsoft is to provide developers with the knowledge they need to make use of the IIS 7.0 SDK. While the information about IIS 7.0 is not out yet for review, there are plenty of docs provided in other areas, such as the .NET Framework SDK and ASP.NET sections, which can be used as a benchmark. In order to make the IIS 7.0 SDK a success, we must do more than just put out a good product. We must also describe how to use it properly or it just will not be used. So I pose a question to anyone who has ever looked something up in MSDN, what is wrong with the documentation you have used so far? What is good about it? What would you like to see to a greater/lesser extent in our documentation? Feel free to flame us, or praise us. If you have suggestions, comments, or ideas, feel free to express them here.

Your feedback will help me understand how to increase your satisfaction with MSDN and Microsoft in general.

Or better yet, if you have some desire to play with new technology that isn't documented yet and provide that content to a worldwide audience, why not apply?

Threading issue with VB.NET Default Instances

tobint — Tue, 11 Apr 2006 17:40:55 GMT

Here is an issue that showed up for one of our customers in the Microsoft forums for Visual Basic .NET. It is NOT the typical ”cross-threaded UI update” issue that you might think. No, this one, IMO, is slightly harder to catch since no exception is thrown to let you know something has gone wrong.

One of the many new features of Visual Basic .NET are default form instances. As the feature lists explain, a default form instance prevents you from having to "new up" an instance of a form before acting on it. So, instead of using:

  Dim frm As New frmMain
  frm.Show()

I can simply use:

  frmMain.Show()

This is handy, particularly for the folks coming from VB6 who are used to forms that behave in this manner. However, default instances present a very interesting problem.

Take, for instance, a project that I create with a form (named frmMain) and a module (named BackgroundMethods.vb) . For the form, I have simply added a multi-line text box (named txtOutput) and a button control (named button1).

Here is the code I have in my project:

[frmMain]

Imports System.Threading

Public Class frmMain
  Private Sub Button1_Click( ByVal sender As System.Object, _
                             ByVal e As System.EventArgs) _
                             Handles Button1.Click
     Dim t As Thread = New Thread(AddressOf GetData)
     t.Start()
     txtOutput.Text &= "Updates complete"
     ' Break after the call above to read the value
     ' in txtOutput.Text
  End Sub
End Class

[BackgroundMethods.vb]

Imports System.Threading
Module BackgroundMethods
   Public Sub GetData()
      WaitForData("Message 1")
      WaitForData("Message 2")
   End Sub
   Public Sub WaitForData(ByVal strMessage As String)
      ' Presumably this method would actually be 
      ' waiting for data from a network connection,<
      ' serial port, or other source
      Thread.Sleep(2000)
      My.Forms.frmMain.txtOutput.Text &= (vbCrLf & Now().ToShortTimeString() & _
      vbTab & strMessage)
      ' Break after the call above to read the value
      ' in My.Forms.frmMain.txtOutput.Text
   End Sub
End Module

So the simple example is that I have a button which, when clicked, will execute the "GetData" method asynchronously in a module. That method is going to call the WaitForData method that updates the UI with two different messages ("message1" and "message2"). WaitForData is supposed to simulate a long-running process, so I threw in the typical "thread.sleep" call to make this illusion.

If you run this code, you will notice that no exceptions are thrown, but the UI for your form is also not updated. Why is this? You would have at least expected a cross-thread exception, right?

In any other managed language, this likely wouldn't happen -- namely because the "My" application is specific to VB, as well as default form instances! In C#, if I try to update the UI from another thread, I would get an exception stating: "Cross-thread operation not valid: Control 'txtSerialIn' accessed from a thread other than the thread it was created on." which could be solved by using the "Invoke" method.

The issue with Visual Basic, in this instance, is that the default form instances are thread-specific. So, when I try to access the form using My.Forms.frmMain from within the worker thread, a NEW default instance is created under the covers. My calls to update the text box are then executed on the NEW instance of the form which resides in the same thread as the call to update it -- hence it doesn't throw a cross-thread exception. In the mind of the VB program, the request to update the textbox occurred without an error. When the worker thread dies, the second instance of the form (which was never displayed) is now a candidate for garbage collection. Meanwhile, back on the original thread and original form the textbox is left blank. You can validate this by running the program (I have attached sample code to this blog post) and setting breakpoints on the textbox update line in the WaitForData method, and in the last line of the button1_click event handler of the code. You will notice that after the second call to WaitForData (before the debugger exits the Sub) that My.Forms.frmMain.txtOutput.Text has been properly set to the value you expected. However, remember that this is on a second background instance of the form, not the original one you expected. Once the debugger hits the last line in the button1_click event handler, read the value of txtOutput.Text and realize THAT instance of the textbox was never updated.

So what is the solution?

First off, you still have to use the "Invoke solution" that is often times bandied about in threading discussions. To do this in VB.NET (and particularly in our solution), do the following:

1. Add the following code to the top of your BackgroundMethods.vb file:

        Delegate Sub UpdateTextHandler(ByVal strMessage As String)

This allows you to create a delegate that can be invoked on the UI.

2. Add the following method to your frmMain file:

    Public Sub UpdateTextMethod(ByVal strMessage As String)
       txtOutput.Text &= (vbCrLf & Now().ToShortTimeString() & vbTab & strMessage)
    End Sub

This creates the method that will actually be executed via your delegate
from the worker thread.

3. Change your WaitForData method as follows:

    Public Sub WaitForData(ByVal strMessage As String)
        ' Presumably this method would actually be 
        ' waiting for data from a network connection
        ' serial port, or other source
        Thread.Sleep(2000)
        Dim f As frmMain = My.Application.OpenForms("frmMain")
        f.Invoke(New UpdateTextHandler(AddressOf f.UpdateTextMethod), _  
                 New Object() {strMessage})
    End Sub

   This method now uses the form's "Invoke" method (actually defined in
    Control) to execute UpdateTextMethod on the original form via the
    UpdateTextHandler delegate.

So what is happening is that your new thread is getting an instance to the existing frmMain instance by going through the OpenForms call. Once I have that instance, I can invoke a delegate that points to the "UpdateTextMethod" of the existing form ( passing in the message in the object array ). By invoking, I am able to get back on the UI's thread and that call can execute any updates to the UI that it wishes.

Keep this in mind the next time you are not receiving errors and your UI isn't getting updated how you would expect -- particularly if you code communicates with the network, a serial device, or other device which communicates asynchronously.

Free Microsoft Press Book: Introducing Microsoft Visual Basic 2005 for Developers

tobint — Tue, 04 Apr 2006 10:25:07 GMT

Microsoft has a free book available for download for anyone who wants it. Download the whole book, or download it chapter-by-chapter (8 in all). Check it out at http://msdn.microsoft.com/vbasic/learning/introtovb2005/

Debugging Resources

tobint — Tue, 04 Apr 2006 09:25:18 GMT

It is my opinion that the difference between good developers and outstanding ones are the way that they debug applications. As such, I wanted to point you to some great debugging resources to get you well on your way to standing with the outstanding developers.

First off, there is the issue of understanding Windows to begin with that get a lot of people in trouble. Many issues can be traced down to something that is "working as designed". As such, I highly recommend the Microsoft Windows Internals book from MS Press. This book will give you a great understanding of how Windows works. Next, I would brush up on .NET debugging skills. To do so, I recommend a .NET 2003 book, but most of the debugging skills still apply to 2005, so don't be dismayed by the title: Debugging Applications for Microsoft .NET and Windows. Once again, John Robbins from Wintellect writes one awesome book.

Well, books are great, but what about free resources? I have some of those too!

First, you can check out the windows debugging website at:
http://www.microsoft.com/whdc/devtools/debugging/default.mspx

Then there are a new series of webcasts that have just been released in the past week or so dealing with the very issue of debugging:

TechNet Webcast: Microsoft.com Operations Introduces Real World Debugging: Determining When You Have a Problem and Beginning the Initial Debugging (Level 300)

TechNet Webcast: Microsoft.com Operations Introduces Real World Debugging: Debugging CLR Internals

TechNet Webcast: Microsoft.com Operations Introduces Real World Debugging: Diagnosing Memory Leaks in ASP.NET Applications (Level 300)

TechNet Webcast: Microsoft.com Operations Introduces Real World Debugging: How to Tackle Problems in Dynamically Generated Assemblies (Level 300)

TechNet Webcast: Microsoft.com Operations Introduces Real World Debugging: Debugging Without the Debugger in IIS and ASP.NET (Level 300)

OK. So maybe I did not have a TON of debugging resources, but this is a great start for anyone who wants to make himself or herself into an outstanding SDE or SDET. So go work yourself into a "debugging guru". By the time you are done, hopefully John Robbins' new book on debugging will be out.

202 VB.NET Samples

tobint — Mon, 03 Apr 2006 16:33:00 GMT

I just wanted to bring some attention to a resource that I think is extremely valuable for VB developers (and really, any .NET developer using any other language for that matter). MSDN has a website with 101 Code Samples for VB.NET 2005. There is also another website for those of you that haven't upgraded to 2005 yet: 101 Code Samples for VB.NET 2003. Both of these sites have very valuable sample code for doing things such as network programming, using regular expressions, executing transactions, handling/changing ACL’s on files, accessing data, performing bulk data transactions, executing asynchronous operations (one of my favorite topics), using ClickOnce, creating ASP.NET pages and more! It is a great resource for those of you that just want to get it done and don't want to waste a lot of time reading specifications on each class in System.Net or System.Data. The samples are robust and provide some great starting points for anyone interested in the many topics available in these samples. Check them out and let me know what you think!

XBOX 360

tobint — Sun, 02 Apr 2006 13:04:00 GMT

On my way home from work Friday, I stopped by a local game store had a few 360 consoles in stock. This just a short time after it was announced that shipments would be stepping up for the console. So, I bought myself a premium console and headed over to the Microsoft store and bought Kameo. I then headed home with a giddy little grin on my face. On the way home, I stopped at yet another game store and bought Ghost Recon and Fight Night.

When I got home, I started feverishly hooking the console up. I realized quickly that I didn't have enough power outlets at my entertainment center to plug in the 360 so I started running around the house looking for a power strip to plug all of my other devices into (the 360 should not be plugged into a surge protector). Since we JUST moved to the Northwest all of our stuff is still mostly packed in boxes. I had paper and cardboard flying everywhere while looking for this strip! At last: I found one! "I'll clean up the mess later," I thought as I rushed back into the living room to finish the setup.
I turned the console on and changed the television to channel 3 and then 4 -- an obvious habit I had from the last console I owned so many years ago (Nintendo -- nope, not 64, not DS -- just plain old Nintendo). I finally got everything set up right and then I saw it -- the Xbox 360 console -- right there on my TV. I could curl up to this thing at night for warmth -- I'm sure of it.

I've already been playing so much longer than I ever expected. I've already got a list of friends hooked up in my console and have already played a few rounds (and lost many) of Fight Night. I love this game and I can already tell that I need to apply some time management skills to keep me productive. If you haven't played Fight Night yet, let me explain. This game lets you build your own fighter. You can control his stats, his clothes, his skills and even his look. That's right, when you build your fighter, you can control every aspect of his looks -- cheek shape / size, skull shape/size, jaw shape/size, eye color/socket size, eye brows, facial hair, and more. You can then add tattoos to the boxer's back, arms, and chest. The amount of customization is unreal. You can then start fighting and training your boxer up the ranks, all the while fighting great boxers like Ali, Frazier, Leonard, and more. As you are fighting, the level of control is amazing and the detail in the graphics is fantastic. I can lean back, block with one arm, two or even duck and cover. The conrol is 100% up to me -- no preset motions that limit your ability to create your own fighting style. Jab left then Haymaker right. Jab high right, jab low and left, jab low left, uppercut right, parry, counter haymaker! It’s indescribable! I'm addicted already: not good yet, but addicted!

I then picked up Ghost Recon and tried playing that. It’s really amazing how cool this game is, but honestly -- it's a lot harder for me to play this than anything else. To explain, I've been a PC gamer for a while. I've played PC-based FPSes (First Person Shooters) since .. well Wolfenstein 3D. I then moved on to games like Doom (1 and 3), Enemy Territory, Quake (1, 2, 3 4), Call of Duty, and Half Life. I've played them as single player. I've played them as multiplayer. I played in clans. I created trick jump videos and even got bored and started doing trick jump videos backwards. Yes -- I'm no stranger to FPS gaming. But playing on a console is so much more... contrived.. harder. In my opinion, the keyboard and mouse are the best controllers for an FPS. None-the-less, the game play itself is awesome. I also like that being shot actually hurts the character -- and being shot in the right spot -- even with one shot is fatal. This is contrary to a lot of older games that I played that just took your 'health' down with gun shots to the chest and head. In any case, once I've mastered Fight Night, I'm definitely going to give this game another shot with a controller. Note to XBOX 360 team -- allow mouse and keyboard controller input for games!

Kameo was ... different. I'm not used to playing games like this, and I honestly didn't put much time into it. The game is very cool looking. Kameo can change shape into a rolling spikey looking creature that can spin at high velocity toward monsters. She can also transform into a plant-like creature that is great at sneaking up on things. She can take the shape of a blue ape-like creature that can bash monsters and stick them to his back and use those monsters as weapons. More shapes are available later. It’s very... umm... interesting. Kameo herself can fly short little hops over obstacles. This game appeals to my some but for me, I think I'll stick to the other two for now.

The games themselves aren't the only thing that are cool. I can connect my XBOX to my PC's in the house and use MP3's I have stored there as well as pictures and movies. The only thing I wish is that I could continue playing those MP3s while I played Fight Night. I prefer my music to EA sports selection!
This post was much longer than expected. But I couldn't help but share my enthusiasm about this machine. For those that have stuck around a bit, I have some thoughts: If you buy one of these systems, consider buying the core system. You'll save $100 that you can spend on a 20GB hard drive and a pair of headphones that feel good for you. The ones included in the premium system aren’t that great and are cheaply made, IMHO. Once again, I could just be spoiled from my previous online gaming headphones I use. Also, consider buying the wireless ethernet adapter, and some recharge kits for your controler(s). All of this will cost a bit more, but will make your gaming experience better, IMO. That's all for now. Happy gaming!

Tobin.Swallow( Pills.Red );

tobint — Fri, 13 Jan 2006 03:14:00 GMT

Doing a google search for "red pill" and microsoft today yielded 55,700 hits. That same search on MSN search yields 14,433. This term, and other variations, are often used on blogs when someone takes a job at Microsoft. I would be naive to think that all of those hits are new employee announcements, but with these sort of numbers, I might have to buy some stock in a red-pill-manufacturing pharmaceutical company. This particular post will increase the count on those searches by 1 and will be counted among the many search hits that ARE about taking a Microsoft job.

Its my pleasure to announce that I will be packing up and moving to the Redmond, WA area to take a position with Microsoft sometime at the beginning of March. The exact date hasn't been chosen yet but the offer has been made and accepted.

(continue)

MVP Award

tobint — Wed, 04 Jan 2006 23:54:00 GMT

I just got an email today stating that I was awarded a Microsoft MVP award. This is an honor. In the past, this award was mainly given to the folks who posted a ton of replies to forums and newsgroups (whether the responses were right or wrong). Microsoft has made a shift to try to reward people who do a lot of local work too. I've been highly involved with the local code camps, user groups and the like. I'm very excited to receive this award and I look forward to continuing participation in the year ahead.

(continue)

Visual Studio 2005 Community Launch : Tools of the Trade

tobint — Fri, 18 Nov 2005 01:17:00 GMT

This year, I was asked to be the INETA community launch champion for my local user group. Essentially, the job is to present at least two topics related to Visual Studio 2005 and/or SQL Server 2005 and/or BizTalk 2006. I was honored to be picked for this role and have done my best to provide the best possible experience for those who come to listen. This month's topic is "Managing the Software Development Life Cycle with Visual Studio 2005 Team System". WOW! Here's the blurb that the UG's sent out on this topic:

"Today’s software projects have one consistent trait – they fail. They fail to meet budgets. They fail to meet deadlines. In many instances, they fail to even make it to implementation. In 2000, only a fraction of software projects succeeded. That rate did not get much better in 2004. Industry demands such as more complex business requirements, government regulations, and standardization of components will make success all the more challenging. In this presentation, we’ll explore how you can utilize the new tools found in Visual Studio Team Services to increase your own success track record. This presentation will show how requirements can be gathered early, managed, modified, tracked, and reported on all the way through the software development life cycle. Come see the powerful new tools that are provided for architects, developers, testers, project managers, business analysts, and even project stake holders!"

While its always a good thing to prepare for a meeting, I realized while sitting in my hotel room that there are quite a few tools that I use to give presentations. I thought I might post pictures and informationa bout the tools I use so that others who are just getting started in their presentation careers can get a glimps into their future.

The Laptop

Its an HP Pavilion zd8000 series laptop that has been customized for the best performance I can get out of it. It has 2GB of ram, a 100 GB hard drive, Lightscribe DVD burner, and the like. I love this laptop because it has 4 USB ports (5 if you count the HP usb digital drive port), firewire, built in wireless, bluetooth, 5-1 media reader, built in speakers, and the list goes on. It even has a media remote control (meant for use with Windows Media Center Edition) that works very well for remotely moving forward and backward in powerpoint slides. Its a varitable swiss army knife of laptops and the kicker, of course, is the 17" widescreen LCD.

(continued)

Microsoft Korean Promo for Visual Studio .NET 2005

tobint — Wed, 09 Nov 2005 21:59:00 GMT

OK. I don't really know how to react to this.

What part of conserve gas do you not understand?

tobint — Fri, 02 Sep 2005 16:42:00 GMT

Forgive the non-technical post and the language, but this has me a bit upset.

There is nothing I hate more than to see millionaires complain about money problems. NASCAR is apparently having some difficulty with their races due to the recent gas hike. My favorite quote was:

"We also are seeing it in our aircraft. Our charter company, because we charter our team planes, has given us an extra charge directly due to the raise in fuel costs."

Well boo-f ' ing-who.

(continue)

Engineering for Reliability: What we can learn from a chair

tobint — Sun, 21 Aug 2005 03:21:00 GMT

The other day, I posted an article about Engeneering for Usability. I hadn't intended to make a series of this, but it may very well turn out that way as today's post is about engeneering for reliability. Who knows what future posts may hold.

I was sitting in a doctors office the other day, waiting very patiently to be called in. I fidgetted as I always did. Leaning forward, leaning sideways, flopping around like an idiot just trying to reconcile myself with the fact that I didn't have a laptop or something in front of me to do. But then it sort of hit me. I was abusing that chair to death and it was taking it.

Lets think about the first sentance of this blog post. I said that I was sitting in the doctors office. I'll bet not one person reading this said "Oh man, what kind of chair was it?" or "Oh my goodness, what if it breaks?" or "Holy cow, that guy is really rolling the dice there isn't he?". All of you most likely pictured someone just plopped down on a chair. No one was really fixed on the idea that the chair could fall apart or that it wasn't an appropriate height. The reason behind this is that, in general, we tend to think that a chair will work when we use it. When was the last time you tested a chair to see if it would hold your weight? I'm sure under the right circumstances, you just might -- like if the chair looked visibly weak or damaged, but once again, the general concensus is that its going to work out for you.

When was the last time you could rest this easy with the software we use on our desktops?

(continue)

Engineering for usability: What we can learn from vending machines

tobint — Fri, 12 Aug 2005 23:20:00 GMT

Today, I used a vending machine. Anyone that has met me will surmise that this was obviously not my first attempt to purchase an unhealthy snack from such a contraption. In fact, not only have I excessively used of vending machines, I've written code for kiosks that use the same currency and coin accepting hardware as vending machines. Suffice it to say this long paragraph was meant to proclaim my self-appointed title of "Certified Vending Machine Professional" (CVMP).

However, with all of my years of experience, todays experience was different. Today, I approached the vending machine, tired from lack of sleep the past month, distraught over having to get my cat a permanent tracheotomy, cranky from a back problem, and distracted by tons of work-related issues running through my head. I carefully stood in front of the machine contemplating what I would get this time -- as though the product selection would have changed between now and the last time I looked. Well, I am supposed to be on a diet, but due to the massive amount of life-issues I'm having at the moment, I decide a "healthier" vending machine snack of pretzels will suffice this time. "D10, 65 cents, ok." I think to myself as I begin to press the numbers out on the keypad "D, One, Zero -- CRAP!". As it turns out D-10 expected me to press D and then press a key they had specifically set to 10 -- not 1 then 0 as I was thinking. I knew this. I've used enough vending machines in my life to know how they work. But today, I failed the test. I immediately began to blaim the vending machine and started re-engineering a smart vending machine in my head.

(continue)

Tobin Titus

Run-in with Beaver, PA Police Department

IIS Security – Past and Present

Ghosts of IIS Security Past

Improvements in IIS 6

Improvements in IIS 7.x

Customizable Installation

Limitable Attack Surface

IUSR account

IIS_IUSRS group

ASP.NET / IIS Unified Security Architecture

Request Filtering / URL Rewriting

Application Pool Identities

Kernel mode SSL

Configuration Improvements

Dynamic IP Restriction

Summary

See Also

I might be Speaking at CodeStock – or watching Shawn Wildermuth

Installing CakePHP on IIS 7

Prerequisites

Assumptions / Conventions

Installing the Blog Sample

Pointing IIS to the cake document root

Creating a Blog Database

Cake Database Configuration

Setting up Rewriting Rules

Creating your MVC Application

Summary

A matter of pixels

Enabling VS.NET 2008 to work with IIS 7.0

IIS cannot start after upgrade to Vista SP1

Enabling VS.NET 2008 to work with IIS 7.0

IIS 7.0 Error Support

Reading IIS.NET Blogs (or any RSS) with Powershell

IIS 7 Logging UI For Vista - Download Now

Extending Microsoft.Web.Administration through PowerShell (Part II)

Where can I find in IIS 7.0 ?

Steve Wozniak ... at Microsoft?

Unsafe thread safety

Back in business...

Accessing Microsoft.Web.Administration through PowerShell (Part I)

Why am I smiling?

OT: Bank transaction privacy

Looking left and turning right: management style

SDK Sample: Programmatically change the runtime version of an application pool in IIS 7

Communication breakdown: internal spam affects productivity

Security: There's incompetence, and there's major incompetence

ADO.NET 2.0 Boot Camp

Workaround: Adding a script map in IIS 5.1

Bill Gates affect on my mood

ASP.NET 1.1, IIS 6.0 and 64-bit Windows

Work-life balance; Robert Scoble; Weekends @ Microsoft

Improving code performance

IL Performance Optimization

IIS 7 on a MacBook !

Beta 2 Live - IIS.NET now open!

IIS 7.0 UE team is hiring!

Online Training: Upgrade from VB 6.0 to VB.NET and Absolute Beginners Guide to VB.NET Express Edition

What technology actually improves your life?

Mort, Elvis and Einstein don't exist

Free Training CDs from AppDev

What's wrong with MSDN documentation? (and what's right?)

Threading issue with VB.NET Default Instances

Free Microsoft Press Book: Introducing Microsoft Visual Basic 2005 for Developers

Debugging Resources

202 VB.NET Samples

XBOX 360

Tobin.Swallow( Pills.Red );

MVP Award

Visual Studio 2005 Community Launch : Tools of the Trade

The Laptop

Microsoft Korean Promo for Visual Studio .NET 2005

What part of conserve gas do you not understand?

Engineering for Reliability: What we can learn from a chair

Engineering for usability: What we can learn from vending machines