Herding Code

Latest Episodes:

Herding Code 76: John Sheehan on RestSharp Apr 02, 2010

Show notes

Episode 76

This week on Herding Code, John Sheehan joins the cast for a conversation about his open source project, RestSharp. The gang dives into REST and .NET open source. Makes sense, right? And the show wraps with talk of OData and a MIX10-inspired Lightning Round.

John talks about his exciting new evangelist job at Twilio. Twillo provides a web-service API for businesses to build scalable, reliable communication apps. Wait! The evangelist is going to tell you all about it.
The guys quiz John about RestSharp. John talks about what RestSharp has to offer and the direction of the project.
The gangs talk about the oddities of .NET open source project development - forking, closing source, project naming, boredom and a plea for project takeover.
Jon leads the group into dangerous territory and forces an OData discussion. Is OData good? Is it REST? Hear what the guys have to say.
K Scott dazzles us with a power-packed Lightning Round. Don't step away for a second or you'll miss it! Just like lightning.
John kicks off our first Official Pimp Your Stuff segment talking about ManagedAssembly - a community for .NET developers which is poised to be taken over. Just ask. Please.

Show Links:

Twilio
John's Blog
RestSharp
Hammock for REST
TweetSharp
Daniel Crenna
OData
Darrel Miller
IE9 Testdrive
jQuery Snippets
ManagedAssembly
James Avery
SubSonic
NerdDinner's OData Service
NerdDinner JSON response Note: this is a json link so IE will show a file download prompt
MIX10

Show notes compiled by Ben Griswold. Thanks!

Download / Listen:

Herding Code 76: John Sheehan on RestSharp

Herding Code 75: Barry Dorrans on Developer Security Mar 05, 2010

Show notes

Episode 75

This week on Herding Code, Barry Dorrans educates, entertains, insults and scares us with his expert commentary on application security, threat modeling, analysis tools and common attacks. You've been waiting for this show. I just know it. Listen in as Barry talks security, pimps his new book, and comments on his new position at Microsoft, book burnings, guns, money, proper pronunciation and Jon's bald head.

Scott K shares that public facing applications and services seem to get the least attention when it comes to security - until there's an audit. Barry talks about the lack of security education and how training should be baked in from the ground up.
Jon notes that folks don't start off projects thinking about security. First you code and then you worry about the risk. Barry speaks to the Security Development Lifecycle (SDL) and continuous threat modeling.
Scott K asks if there is a security checklist which developers should consult when developing a web application. Barry references his book, OWASP, CDE and Miter. Barry states that can't think like a hacker but you can think about the risks and "what happens if this goes wrong" or "I leak this information" or "there is a cross site scripting attack."
Jon notes there are some security measures which are baked into the .NET Framework. Barry talks about a defense in depth strategy and the Web Protection Library (WPL.)
Barry dives into a few of the security and code analysis tools like CAT.NET and FxCop which are available for Visual Studio. But how, by the way, no tool offers a silver bullet.
Scott K asks where emphasis should be placed when implementing security measures. Barry responds by putting his security hat on and assuming that all users are scum. Trust no one!
The guys get into encoding rules (when and where), XSS, SQL Injection and Cross-site request forgery. Jon asks more about the measures built into ASP.NET Webforms and ASP.NET MVC which help prevent attacks.
Kevin asks a question about automatic encoding by the framework. Barry states this is a tricky solution to implement and suggests that frameworks should provide tools but developers should handle the encoding manually. Jon notes the new syntax in MVC 2 which facilitates this approach.
Jon asks about testing frameworks and asks Barry for a checklist of steps which developers must complete if they wish to secure their applications. Barry rattles off a bunch of must-dos actions, pimps his book and pokes fun at American money.
The guys talk about RIA, Silverlight and Flash and briefly touch upon security benefits and issues. And then they discuss social engineering security/privacy issues.
Scott K moves away from web applications and services. What about client applications? Barry talks about trusted sources, and the .NET and Java sandboxes. And the guys speak of OS sandboxes and vitualizing applications and Code Access Security (CAS.)
Barry talks about FoxPro thanks to a Twitter question from @jglazano and the show finishes up with talk about blue and black hats, security snake oil and scary security stories. But wait! Jon remembers he wanted to talk about OpenId and the show continues with a discussion about OpenId, CardSpace and OAuth and OAuth WRAP.

Show Links:

Barry Dorrans' Blog
Beginning ASP.NET Security, Barry Dorrans
Google Buzz
Writing Secure Code, Michael Howard
Developing More-Secure Microsoft ASP.NET 2.0 Applications, Dominick Baier
Threat Modeling, Window Snyder and Frank Swiderski
DeveloperDeveloperDeveloper!
PCI Compliance
OWASP Top 10
WebGoat Project
CWE/SANS Top 25
Web Protection Library (WPL) - Evolution of Anti-XSS Library
Microsoft Code Analysis Tool .NET (CAT.NET)
FxCop
NDepend
StyleCop
XSS Attack Tool
XSS (Cross Site Scripting) Cheat Sheet
Tamper Data Firefox Add-on
Enough Rope to Shoot Yourself in the Foot: Rules for C and C++ Programming
Foxit
NoScript Firefox Add-on
App-V (Microsoft Application Virtualization, formerly Microsoft Softgrid)
We Should Be Virtualizing Applications Not Machines
Javier Lazano
Microsoft BlueHat Security Briefings
Black Hat Technical Security Conference
OpenId
CardSpace
LastPass
OAuth / OAuth WRAP
Kim Cameron's Introduction to the Laws of Identity

Show notes compiled by Ben Griswold. Thanks!

Download / Listen:

Herding Code 75: Barry Dorrans on Developer Security

Herding Code 74: Javier Lozano on MVC Turbine and Composed Applications Feb 23, 2010

Show notes

Episode 74

This week on Herding Code, K Scott leads a conversation with ASP.NET Insider and MVP, Javier Lozano, about his open source project, MVC Turbine, and extensibility and composition with ASP.NET MVC.

Javier provides a twitter-like overview of his open source project: "MVC Turbine helps you build modular applications on top of ASP.NET MVC and that's pretty much it."
K Scott asks about the advantages of using MVC Turbine to add features to your applications. Javier talks about MVC's extension points, controller factories, view engines, and "the blade."
The guys talk about MVC Turbine's support for multiple IoC containers and whether or not MVC Turbine is merely "IoC for IoC." Javier speaks of his design approach and the need to register components on the fly.
K Scott notes that though ASP.NET MVC has many extensibility points it may not have been built with IoC in mind. Javier talks about the pros and cons of this and how it factored into his design.
Scott K asks if there are any features Javier would like to implement into his project which he hasn't been able to address because of limitations with the MVC framework.
K Scott asks about Action Filters and Inferred Actions. Javier explains. Jon comments on Inferred Actions' awesomeness and how they really reduce your controller code.
Scott K asks about Inferred Actions and strongly typed views. Javier talks about how the current implementation effectively serves up static pages without a model but the ideal implementation (which is doable) would provide an inferred models and more.
Scott K talks about defaulting return types. For example, if request doesn't include the mime type then default to Json.
The guys talk about general extensibility in ASP.NET MVC and how various open source applications are addressing concerns.
K Scott gets back on topic and asks Javier to dig deeper into filters.
Jon and Javier talk about MEF and how it might play a roll in MVC Turbine. Bingo!
K Scott notes that MVC Turbine is hosted on Codeplex and asks how it's going? Javier notes the source code is now hosted at GitHub, and Jon asks if recent Codeplex support for Mercurial might lure Javier back to Codeplex. The guys talk/joke about version control systems.
The guys talk Visual Studio 2010 versions and games of yesterday.
Javier turns the tables and asks the guys about their thoughts on compositions in general. Scott K has thoughts - it's painful. Jon states that MVC Turbine is doing it and you can use Attributes so what's missing in the .NET framework that makes composition so painful.
Javier talks of folks interest in contributing to his framework, producing documentation and video, and what's next for MVC Turbine.
Jon asks if MVC 2 provides features (validation or templating, for example) which may be leveraged in MVC Turbine.
Lightening round! Have you used Google Buzz? What's the funniest comment thread you have ever read?

Show Links:

Show notes compiled by Ben Griswold. Thanks!

Download / Listen:

Herding Code 74: Javier Lozano on MVC Turbine and Composed Applications

Herding Code 73: Daniel Plaisted on Model-Based Testing in Action on the MEF Team Feb 14, 2010

Show notes

Episode 73

This week on Herding Code, Jon leads a discussion with Daniel Plaisted about Model-Based Testing and the progressive practices of the MEF team.

Daniel speaks of the primary development roles at Microsoft and how the MEF team addresses testing concerns. Guess what. Developers write tests, too.
Daniel talks about Model-Based Testing and validation of transitions and states.
Scott K is reminded of a presentation he attended at Northwest Python Day which spoke of protocol and framework testing.
Daniel shares the need of trim test cases to manageable sets which will still ensure adequate coverage.
Jon asks about mapping out the endless states that may be found when testing MEF.
Jon asks about test frequency. Are tests run on each check-in? Are they scheduled?
The guys address the difference test types - unit, functional, performance and stress tests.
Kevin asks about coordination of developer and tester efforts. Who produces which tests and where is each group's focus?
Daniel explains Exploratory Testing
Scott K asks about Heisenbugs and how closely testers work with developers to resolve hard-to-reproduce defects.
Jon asks if the MEF testers use any debug/test tools which are built into Visual Studio.
Kevin asks if any special considerations must be made when QAing an open source project.
Daniel explains how model-based testing works well for verifying cache states.
Scott K asks about test environment setups and how deep the MEF testers need to dive into the bugs in order to adequately report on them.
Jon asks Daniel to share tips to help developers improve their own unit tests and improve broader testing.
Daniel talks about MEF's beginnings. It's not an IoC container. Oh wait. It is.
What type of tester are you? The guys speak of a recent Google Tester Blog post on tester types.
Kevin ask if the progressive approach which MEF takes is gaining traction throughout Microsoft.
Jon asks how Daniel became a tester, a Microsoft MEF tester.
Kevin asks how much collaborating occurs between the various testing teams at Microsoft.
Daniel briefly talks about Synchronization Coverage.

Note: The audio's a little rougher than usual this week. Sorry about that.

Show Links:

Show notes compiled by Ben Griswold. Thanks!

Download / Listen:

Herding Code 73: Daniel Plaisted on Model-Based Testing in Action on the MEF Team

Herding Code 72: Questioning Uncle Bob, Clojure Magic, Mercurial Support at Codeplex, Thoughts About the iPad and Handerpants Feb 07, 2010

Show notes

Episode 72

This week on Herding Code, the gang discusses Uncle Bob's self-titled blatherings about DI, IoC and Mocking, Clojure and polyglot programming, managed javascript, and recent support for Mercurial at Codeplex. The show finishes up with another K Scott Lightning Round with questions about the iPad and non-technical blog recommendations.

Uncle Bob recently published two articles which are a little down on DI, IoC and Mocking. Was he merely trying to get a rise out of the community or was he sending a subtle message about poor use of our tools?
K Scott attended Craig Andera's Clojure Presentation at a recent DC Alt.NET meet up. This sparks a discussion about Clojure Magic - functional programming, transactional memory, concurrency and multi-threaded programming.
The guys talk about the polyglot programmer, Scala running on the JVM and Java interop. Scott K shares his interest in getting a Clojure, Scala and F# guy in the same room and Kevin gives his thoughts about the language explosion.
Scott K leads a conversation about managed javascript, node.js, and IronJS.
The group offers their opinions on Codeplex support for Mercurial and address questions like "Why not Git?" and "Does this make Codeplex more appealing?"
Lightning Round Question #1: Who's going to buy an iPad?
Lightning Round Question #2: What non-technical blogs do you read?

Show Links:

Show notes compiled by Ben Griswold. Thanks!

Download / Listen:

Herding Code 72: Questioning Uncle Bob, Clojure Magic, Mercurial Support at Codeplex, Thoughts About the iPad and Handerpants

Herding Code 71: James Avery and Rob Conery on NoSQL and a bunch of other stuff Feb 01, 2010

Show notes

Episode 71

This week on Herding Code, James Avery and Rob Conery join the cast in a lively discussion about NoSQL, TekPub, the new DotNetKicks and the technical debate du jour, ASP.NET Web Forms vs ASP.NET MVC.

Kevin asks Rob and James to share their views on NoSQL and the use of object and document databases. James challenges the idea that all data must reside in a relational databases. Are ORMs so last year? What's going to be happening in 2020?
Rob claims he wouldn't accept a ride to the bar in an 18-wheeler. Whatever!
Jon asks what we're saving with object databases - don't ORMs abstract the database away? So what's the point?
James pimps TekPub
Rob talks it bit about domain-driven design and how we marry relational tables to object-oriented system. K Scott fails to see how the choice of a UI pattern is influenced by the type of database one is using. Rob explains.
Jon asks about maintainability and supportability issues and what's your boss going to think if you suggest moving away from your current relation database solution. James gives examples on why non-relational solutions are easy to maintain and support. Rob talks about quick ramp up time, scalability and performance like he's given the speech 1000 times before.
The guys pleasantly discuss MSDN.and VB.and ASP.NET Web Forms.
K Scott shares his opinion on the future of MVC, Web Forms, Silverlight and Sharepoint as they will exist both inside and outside of the firewall. Scott K, James and Rob also offer their opinions (shocking) and Jon's chance to interject is taken away when the luminous "Page Lifecycle" crashes down upon him.
James and Rob dig a little deeper into object and document databases and normalized database nightmares are exchanged.
Kevin asks how versioning works in an object database, the guys speak of Json and Bison, and serialization and deserialization. James speculates that object databases will ultimately be more popular than document databases.
Rob addresses the idea that he's condescending and rude. The group talks about opinions and share their views on recent technical debates - ASP.NET MVC vs Web Forms, VB vs C#, ORMs vs Stored Procedures, and Jets vs Sharks. Can't we all just get along?
Rob and James pimps TekPub again.
K Scott kicks off a flash lightning round - one question about VB6.
Rob answers Twitter question from @elijahmanor about TekPub's technology stack and elaborates about video options.
James pimps DotNetKicks.

Show Links:

Download / Listen:

Herding Code 71: James Avery and Rob Conery on NoSQL and a bunch of other stuff

Length: 1:18:38

Show notes compiled by Ben Griswold. Thanks!

Herding Code 70: Sean Chambers on Migrations in .NET Jan 25, 2010

Show notes

Episode 70

This week on Herding Code, we talk to Sean Chambers about migrations in .NET with Fluent Migrator.

Sean talks about how Fluent Migrator originated from Migrator.NET
Sean discusses how the benefits of a semantic model in Fluent Migrator
K Scott and Sean discuss how you'd start using Fluent Migrator in a project
Sean talks about some useful features, like InsertData\
Jon asks about support for different databases
Scott K asks about the benefits of a migration framework over a simple directory of T-SQL scripts
We take a question from Aaron Lerch (@aaronlerch) on Twitter about how Fluent Migrator would work with Fluent NHibernate
Kevin asks about Schema Update
Kevin and Sean talk about possible inefficiencies with objects being added, changed, and removed in successive migrations
K Scott asks about extensibility hooks
Scott K asks about stored procedures, functions, user defined types, etc.
Jon asks about how Fluent Migrator relates to other .NET migration frameworks
We take a question from Aaron Jensen (@aaronjensen) on Twitter about the benefits of a migration framework since T-SQL is already a DSL
Lightning round: K Scott starts the lightning round by asking what refactoring operations everyone uses most
Lightning round: What's your favorite VM software? (spoiler: VirtualBox wins by a wide margin)
Lightning round: What's your favorite movie that involves an android?

Show Links:

The Fluent Migrator github repo
Sean's blog: http://schambers.lostechies.com
Sean's photo blog: http://www.full-fx.com
Migrator.NET
RikMigrations
SubSonic Migrations
31 Days of Refactoring
VirtualBox
Josh Coffman
Steve Hodgkiss

Download / Listen:

Herding Code 70 - Sean Chambers on Migrations in .NET

Herding Code 69: Scott Bellware on HTML Specialists Jan 22, 2010

Show notes

Episode 69

This week on Herding Code, Scott Bellware returns to talk about .

Scott talks about the frustrations in working with "HTML Specialists"
Scott discusses the team issues caused by specialists in a software team who aren't in touch with the entire product development cycle
The problem with handoffs: loss of workability
Eventually, things turn to the technology issue involved in working with HTML and CSS
Are HTML tables necessarily evil
Scott and Scott K discuss whether CSS purity is a premature optimization
Jon and Scott discuss whether clean markup can be deferred until the end of a project
Scott talks about the lunacy of delivering design work as "final"
Scott talks about how optimization fights with workability
Scott enumerates some of examples of websites which might not benefit from accessibility
Jon posits that tables might not be easier than CSS design, it's just what we learned first
Scott K talks about how CSS floats drive him nuts
Scott talks about how crazy CSS is when viewed as a programming language
K Scott talks about some technological workarounds like lesscss
Scott talks about how he doesn't see Silverlight as an improvement, because it brings along a lot of other challenges
Scott talks about how working in teams and in "small batches" solves the problems with handoffs
Scott talks about the joy of a January 1st project date

Show Links:

Scott Bellware's Blog
Scott's consulting company, ampersand GT

Download / Listen:

Herding Code 69 - Scott Bellware on HTML Specialists

Herding Code 68: New Year Shenanigans Jan 15, 2010

Show notes

Episode 68

In this episode of Herding Code, the gang talks about what happened last year and what they think will happen in the years to come. Oh, and K Scott brings us the first lightning round of 2010!

How will the guys manage the show in 2010? Google Docs and listener requests?
Are you bitter because today's coder has little appreciation for how rough devs had it 10 years ago?
Phone wars. Big, smart ones. Will Android dethrone the iPhone?
Place your bets! Biggest box office hit in 2010: Ironman 2 or The A-Team Movie?
You don't see the Fail Whale quite as often, but it's still fun to listen to the guys continue to complain about Twitter and its clients.
Next ten years - will C# continue to rule the .NET roost?
Ever ask WolframAlpha "Who uses this site?"
What secret project is John Lam working on? Will IronRuby live on?
You love maps, right? K Scott does too. Who knew?
Ever wonder if the iSlate will take over the (Kindle) world?
Are you planning to improve your skill set in 2010? How?
Really? Jon's default search engine is Bing! How's about that Infinite Scroll!

Download / Listen:

Herding Code 68 - New Year Shenanigans

Show notes compiled by Ben Griswold. Thanks!

Herding Code 67: Udi Dahan on Scalability Jan 10, 2010

Show notes

Episode 67

You're interested in web application scalability and availability, right? Of course you are! Well, you're in luck because Udi Dahan - enterprise development expert, SOA specialist and author of NServiceBus - joins the guys on this week's episode of Herding Code.

Jon kicks off the show by asking Udi if one can run a high-availability and high-scalability site (like stackoverflow.com) on two servers with ASP.NET? Udi asks "how high is high" and talks about the importance of defining the scope of the architectural problem.
Udi comments on the how site behavior (high reads or writes, static or dynamic content, etc) dictates the way availability and scalability concerns can be handled.
Udi talks about how websites can be broken into fragments and how one can take advantage of content distribution networks and caches.
Udi stresses that high-availability inherently makes scaling more difficult and how scalability is a multidimensional cost function.
Kevin asks about common scalability mistakes and solution patterns. Udi replies with talk of SOA, web services, REST, one-way messaging, pub/sub and offloading things to the background in an asynchronous way.
Kevin follows up with additional questions: Why don't more developers turn to messaging patterns to solve their scalability issues and can one introduce scalability changes incrementally?
Udi discusses the scalability patterns employed by RIA Services for Silverlight and gives his opinion on Azure as a scalability system.
Scott K asks about geographical distribution and Udi gets to the heart of the matter - high-availability means writing data to multiple places which means you are slowing your system down.
K Scott asks Udi about the AppFabric service bus provided by Microsoft and how it compares to already available distributed cache solutions like .NET Service Bus, MassTransit, and NServiceBus.

[Note: The sound quality for Udi's voice is kind of rough. We tried to clean it up, and this is as good as it's going to get. Just pretend we're talking to him on a CB and things will be fine]

Show Links:

Download / Listen:

Herding Code 67 - Udi Dahan on Scalability

Show notes compiled by Ben Griswold. Thanks!

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected