Potential Website Security Flaw

Javascript in the Http 1.1 specification will block parallel downloads so the best practice is to load the script at the bottom of the page so the user experience is not impaired by a slower download and render cycle from waiting for scripts to download. This has a major flaw in banking, secure sites, and other sites that allow user name and password entry. Most users when presented with a web page, who are browsing solely to log-in, will click the login or user name box, type his or her user name, tab or mouse click to the password box and then type his or her password. Unfortunately, this user action is very quick and easy to do the more technical a user is and even worse most websites seem to love setting the focus to a element after the page is loaded? What is the end result? Based on network latency and server lag plain-text password are being inputted into the incorrect fields and possibly submitted to the wrong form. (Imagine the embarrassment of posting your blog password to your own blog instead of logging in!)

There is a simple fix and I will suggest it here without code. If you have user name and password fields on your page, validate the text in the user name field before allowing set focus after page load! There, simple, done.


Need a C# Consultant or a Software Development Consultant? I'm available

Just some tips

The internet slang, "pls" and "plz" are not acceptable in business communications, use "please" instead.

A famous quote follows, "A lack of planning on your part does not constitute an emergency on mine", so sending URGENT emails or posting URGENT questions to forums will not get you much help or respect. Most of us have jobs.

In the English language an interview conducted on the phone is a "Phone Interview" or a "Telephone Interview" using the word telephonic brings up childhood memories of "Hooked on Phonics" commercials and sounds like some poor script out of a 1950's era science fiction pulp film.



Need a C# Consultant or a Software Development Consultant? I'm available

Email Courtesy

Back in the pre-World Wide Web days there was a thing called email courtesy which people seem to have forgotten. I will not go into great detail since The netiquette rfc covers a lot so I will just mention my biggest pet peeve:

People that do not respond or reply to emails in reasonable time. Is it so hard?


Need a C# Consultant or a Software Development Consultant? I'm available

Programming is the smallest part of a Business System

Once again I feel it necessary to bring up the very important point that programming plays the smallest role in designing a successful business application. The number of vendors offering programmer productivity software has skyrocketed in an attempt to let more programmers write more code, faster. The end result, predictably is sloppier code that is difficult to maintain.

Here are the five phases of software development:

• Requirements Gathering 25%


• System and Software Design 20%


• Implementation (Programming) 10%


• Integration and Testing 20%


• Maintenance (long-term support) 25%

These phases apply to all development methodologies, including Agile.

Looking at these percentages a few things become obvious:

1. Programmer efficiency is not the most effective place to spend time


2. Critical thinking, analysis and design occupy the biggest chuck of any project, 45%


3. Maintenance is an unknown and potentially crippling consideration that can only be resolved by properly addressing the first two phases.

Take a look at your next project and compare the money you are planning on spending on heads-down developers alone and then ask the very serious question, “Am I spending 4.5 times this amount on Requirements and Design”. The answer should be shocking and revealing.


Need a C# Consultant or a Software Development Consultant? I'm available

Wow, training is hard work

Just got out of Lakeland, FL for after teaching a two-week, fast-paced, .NET training, mentoring, and transition class for C++ programmers. I don't usually do that sort of thing so it was a unique and interesting experience. Not only do you get to get intimately involved with the client's technology to be able to adapt a customized training but you really become more familiar with the overall .NET framework since you really have to know something to teach it. I hope to be lucky enough to do this again in the future and recommend every one try it if they have the change. It is worth doing, at least once.



Need a C# Consultant or a Software Development Consultant? I'm available

No Drinking and Emailing

No Drinking and Emailing, looks like Google is stepping in to help with a pre-ignition device for inebriated emailers.

I really don't know what to say. This is either incredibly brilliant or incredibly sad. If this works like the real world, a user that cannot solve math while drunk will eventually stumble around and disable the feature.



Need a C# Consultant or a Software Development Consultant? I'm available

The Rate Calculator

For all those that constantly ask, "How much should I charge" or "What should I pay for contract labor" I present the Rate Calculator. This tool works for all industries and not just I.T. or software development. Plug and and chug away and you will quickly be able to determine what to charge based on what you think a fair annual salary should be for your experience/position.



Need a C# Consultant or a Software Development Consultant? I'm available

Simultaneous vs. Concurrent testing

First let me start with a definition: Concurrent in this context means 2 or more users on the system at the same time while simultaneous indicates a request at the same time. Whats is the difference? Two users logged into to a system at the same time have a very low likelihood of making a simultaneous request. The more concurrent users you have, the more likely a simultaneous request occurs, in general.

Unfortunately, that presents us with a small problem, from two aspects: 1) The Test Environment and 2) The Testing Framework. I will address the later first and the former later.

Time and again I watch as a developer uses a test suite to test the number of users that can access a system. They fire up the Testing Framework on their local box, click the number of users they want to simulate vs. the time they want it to run, click a button and then champion the results. The fundamental flaw should be obvious one physical computer is unlikely to ever generate 2 simultaneous requests. The reasoning is fairly simple, either the test software is written for only one CPU, the test machine only has one CPU (less likely these days), and/or the test machine only has one Network Card. This issue is simply resolve by having n number of developers run the test suite at the same time but most seem to refuse.

The second which is really the first is the test environment. How many CPU's does it have? What is the CPU license on the database software? On the Web Host? On The Service Oriented Framework host? Is a VM crippling your ability test? How can you be certain that custom caching engine written by the lone developer in a Dark room because of the limitations of built in caching schemes prevalent in all layers of development won't actually cripple itself when you scale-out the hardware and licensing to reflect an actual production environment.

To make a long story short, the only way to effectively test a multi-user system is with, gasp, multiple users. When combined with automated testing tools you can use the Erlang traffic model to predict how many users you need to perform an adequate test of the system. Only then can you sit back with confidence knowing that your roll out of your first 10,000+ user system will at least handle the number of users required. Take a short cut in testing and you will get bitten.


Need a C# Consultant or a Software Development Consultant? I'm available

For the companies considering a web based system

More often than not when a company wants a web-based system then is based on ease of deployment, however with WPF and run-once .NET applications it is not really a necessity. Still many companies get the impression that developing a Web Friendly application has added value, either from the misunderstand that the only way to do SOA or for the prestige value of being "Web-Enabled" or "Web 2.0".

The ultimate reality, from a corporate perspective, is cost. Does a given technology requirement yield a higher or lower ROI? To be honest, you will usually spend more money and get less functionality from a web based system as well as incur significant maintenance penalties. I just recently came across the Acid Test as posted on Code Project and it is the perfect illustration of just how difficult it is to provide a clean, consistent Web Enabled application for the entire Internet, Acid Test.

When presented with this a gut reaction I get from many clients is, yes but we target IE6 only. Which of course invalidates the primary reason for a Web-Based system and that is multi-platform, multi-browser capability. From the perspective of coding for IE only there are no reasons to pick Web-Based over a Windows Forms based application and in the long and short run you will find a significant cost savings to choosing the later.


Need a C# Consultant or a Software Development Consultant? I'm available

This rant may reveal me as a MS Programmer

But don't sell me short, I have complaints about Java and C++ too. This is really a rant against developers and I it is a clear indicator of the systematic de-evolution of developers as free-thinking mathematicians into click-and-drag technicians. MS, in their ASP.NET development tools allows for something called a Master Page. This is basically a template for web pages in web sites and web applications. If you create a Web Page using a Master Page the @page directive is automatically populated with an attribute, a title Attribute. Rather than inheriting the title from the Master Page, or using the name of the Class it is a generic, Untitled Page.

The problem? With a little bit of years under the belt you can quickly notice a ASP.NET site, from the way things are slapped together and the excessive amount of postbacks, but the real sign is the ubiquitous "Untitled Page" in the title bar. Own of my major annoyances when I do ASP.NET is that I have to go in an manually remove this title attribute ... I would say more but it devolves into a ranting tirade against intentional ignorance.



Need a C# Consultant? I'm available

Generics Ad Absurdem

While writing some generic constraints the other day in .NET I had a stunning revelation that I was doing something wrong. Consider:

public class Foo<T> where T : IBar

At first, it seems like a great example of a Generic class using constraints. In fact, almost text book. But then I ask myself, why am I using generics here? With only one constraint I haven't provided any real advantage to this class over directly authoring the class with IBar in mind. This becomes more obvious when coding to interfaces, where most return types are interfaces, even further eliminating the generic advantage in this one particular case.

Sure this example seems contrived but it happened, heck I even wrote it and didn't catch what I had done until after I had compiled. Generics are great but they aren't the cure all. While this case really isn't that bad imagine generics the point of absurdity. I have recently started seeing code that uses so much generics it is actually impossible to use the code and type-safety at the same time. Please keep in mind that discretion is the better part of valor. If you can code something without generics do so, only add generics when there is a distinct advantage.

What is that major tenant of good design? Don't add features unless they are actually required!



Need a C# Consultant? I'm available

A Simple List of States

I am sick and tired of always needing to populate a database with a simple list of States. So I finally promised myself, never again. So here, for the convenience of lazy programmers, an actual Simple List of States. Your Welcome.



Need a C# Consultant? I'm available