Herding Code

Latest Episodes:

Herding Code 176: Jon McCoy on Hacking .NET Aug 07, 2013

Show notes

Episode 176

At NDC, Jon and K Scott talked to Jon McCoy about hacking .NET and .NET developer security. Download: Herding Code 176: Jon McCoy on Hacking .NET Show Notes:

Intro and NDC talks
- (00:30) Jon McCoy overviews his NDC talks, explaining how he got into security and some of the amazing things he's found out about .NET about along the way, like using Java JARs inside .NET applications.
- (02:55) Jon McCoy says that understanding IL and how the JIT works allows him to directly use assembly code and C++ from within .NET applications.
- (03:45) K Scott asks Jon McCoy about some of the tools he showed during his talks. Gray Dragon is a memory injection program which allows injecting code and remapping while an application's running. Gray Wolf allows editing an application's IL code. In his talk, he demonstrates extracting his admin password from biometrics password with six clicks.
Developer security practices: obfuscation, unit tests, monitoring
- (05:20) Jon G asks if obfuscation helps hide his code. Jon McCoy says it's always reversible and there's about a three month lag between obfuscator releases and workarounds. Just about anything that can be automated can be reversed.
- (06:44) Jon McCoy recommends security unit tests for practices like SQL cleaning and throwing security exceptions. Monitoring for security exceptions will let you know someone's attacking you - if someone has two years to attack you without you knowing, they're going to get in.
- (07:42) Attackers can target update mechanisms in desktop programs to target users throughout your enterprise. Also, the nature of .NET code makes it very difficult for antivirus software to detect when it's doing something bad.
- (08:30) Jon McCoy says there's a security issue with Visual Studio in that it executes constructor code for controls as they're loaded in the designer, so a malicious user can run code which runs under your user permissions.
Securing information on your computer: crypto and passwords
- (09:40) Jon McCoy talks about some of the security practices he recommends: full disk crypto with TrueCrypt, using a hardware solution like YubiKey for long passwords, and using encrypted VMs as secure containers.
- (11:12) Jon G asks Jon McCoy what he thinks of solutions like Keepass and LastPass. K Scott asks whether OpenID and OAuth help. Jon G laments that CardSpace never took off.
- (12:47) Jon G asks if signed code helps secure code at all. Jon McCoy says it doesn't really, since it's not validated.
Businesses and security
- (13:27) Jon G asks if Jon McCoy gets involved with forensics. Jon McCoy says he mostly works with small businesses who are being attacked or want to fix security issues.
- (14:31) K Scott asks Jon McCoy if he deals with mobile device security. Jon McCoy discusses the security blind spots desktop and mobile developers have.
- (15:23) Jon G asks what Jon McCoy thinks about two factor auth.
- (16:22) Jon McCoy explains how his background as a developer helps him understand issues in a way that IT focused security experts don't.
Defending against cracks
- (17:20) Jon asks about defense against cracks. Jon McCoy says the motivation behind cracks and malware shifts - sometimes the bad guys are just after a proxy network, password cracking machines, or even free cloud storage. Malware distributors can really strike it rich by owning a computer that happens to be inside a big company; they can sell that access for a lot of money. Part of fighting an attack is understanding what's motivating the attacker.
- (19:07) Jon G talks about targeted attacks against employees using fake, infected PDF business documents - send to enough people and a few will open it. Jon McCoy says that's why he advocates using a hardened VM for browsing the internet as well as using different e-mail addresses so you know unsolicited e-mails to an admin e-mail can't be valid.
Resources: tools and papers
- (20:13) Jon G asks for a little more information about the security tools Jon McCoy distributes on his site.
- (20:47) Jon G asks about how Jon McCoy's security disclosure policies. Jon McCoy says he generally keeps things secret long enough to give his clients a security advantage. He talks about a technique he used which phones home when obfuscated code is decompiled.
- (21:51) Jon G asks Jon McCoy how he keeps up with things. Jon McCoy says things are pretty lonely, he's off on his own most of the time. Jon G says it's easy to forget that a lot of .NET runs on top of Win32 and COM.
- (23:10) Jon G asks Jon McCoy for some reference for developers who are interested in learning more. Jon McCoy lists a few (referenced in the show links).

Show Links:

Jon McCoy (http://digitalbodyguard.com/)
NDC Session video: Hacking .NET(C#) Application: An Unfriendly Territory
NDC Session video: Hacking .NET(C#) Application: Code of the Hacker
YubiKey
Jon McCoy's white papers: Attack .NET at Runtime and Reflection's Hidden Power

Herding Code 175: Dominick Baier on Securing ASP.NET Web APIs and HTTP Services Jul 29, 2013

Show notes

Episode 175

At NDC, Jon, K Scott and Rob Conery talked to Dominick Baier about HTTP API security: CORS, token based authentication and more. Download: Herding Code 175: Dominick Baier on Securing ASP.NET Web APIs and HTTP Services Show Notes:

Overview of CORS and Token Based Authentication
- (00:17) K Scott asks Dominick about the subject of his talk at NDC. Dominick runs through the upcoming changes in Web API authentication, including an overview of CORS and token based authentication.
- (03:49) Dominick explains the ability to support a separate token server in Web API and announces Authentication Server, his new open source project which provides
- (05:13) Rob describes how he's seen people breaking their sites and services across multiple domains and subdomains. He explains a problem he's currently running into with older releases of Internet Explorer. Dominick explains more about how CORS works and talks about options for working with older browsers - either sticking with JSONP or putting services in the same domain.
OAuth
- (08:15) Jon asks how security token service relates to more well-known terms like OpenID and OAuth. Dominick explains some of the history and challenges OAuth has encountered. As a result, the OAuth spec is really just a collection of patterns rather than a strict specification.
- (11:19) Jon asks Dominick how he implemented the OAuth spec in his Authentication Server implementation. Dominick gives examples of how the spec is very open - for instance, there are 69 occurrences of the word MAY in the spec. He says he's been advocating for a minimum profile.
- (12:56) K Scott asks what sort of authentication should be used with Dominick's security token server, since OAuth isn't an authentication mechanism. Dominick explains the interaction with security tokens.
Token based security and JWT
- (14:49) Jon comments on the difference in security implications between a compromised token vs. a compromised account password. Dominick says that a token binds five things together: the client, a human, an application, permissions and time. He mentions that with token based authentication you can outsource the security mechanism - passwords, certificates, etc. - and talks about the newly released JSON Web Token (JWT) handler.
- (15:50) K Scott asks for some specifics about the JWT handler.
- (16:27) K Scott asks for more information about Dominick's talk.
Roles vs. Claims
- (17:14) Jon asks about the difference between roles and claims. Dominick explains that a role is just a very simple claim: are you in a role or not? Claims move from a simple boolean to more of a name / value pair
- (18:31) Jon asks what the average developer needs to know about Windows Identity Foundation.
Photography and wrap-up
- (19:02) K Scott asks Dominick about the photos section on his site and comments on how they're just about all black and white. Dominick
- (20:52) K Scott asks Dominick what he's got coming up. Dominick says he's been heads down on the Authentication Server release.

Show Links:

Dominick Baier (http://leastprivilege.com/, @leastprivilege)
NDC Session video: Securing ASP.NET Web APIs and HTTP Services
Thinktecture IdentityServer
Eran Hammer: OAuth 2.0 and the Road to Hell
Dominick's photo blog: http://photos.leastprivilege.com/

Herding Code 174: Paul Stack on automating Windows configuration management with Puppet and PowerShell Jul 24, 2013

Show notes

Episode 174

At NDC, K Scott and and Jon talked to Paul Stack about automating server configuration management with Puppet and PowerShell. Download: Herding Code 174: Paul Stack on automating Windows configuration managment with Puppet and PowerShell Show Notes:

Intro
- (00:32) Paul gave a talk on Windows infrastructure management with Puppet and PowerShell. Puppet is a configuration management tool. It allows you to define a configuration management level, and Puppet will bring it to that level and keep it there.
- (01:05) K Scott asks Paul how this relates to his continuous deployment emphasis. Paul explains how this has been part of the maturity model they've been using at his employer, Open Table.
- (01:50) Paul explains how they started using Puppet in their pre-production environment of 19 VMs. Their production environment is four times that large.
Some more questions about Puppet
- (03:00) Jon asks how Vagrant and Chef fit in. Paul explains how Puppet, Chef and CFEngine relate.
- (04:07) K Scott asks if it's worthwhile to look at Puppet in a small environment with 2-3 servers. Paul says there's an investment, so you really start seeing the rewards as things start getting more complex.
- (05:01) K Scott asks how you define a state.
- (06:30) K Scott asks about the client running on the target servers.
- (06:51) Jon asks how the verification works.
- (07:32) Jon asks if it's possible to use Puppet in cloud environments.
- (07:56) K Scot asks if you can use Puppet to configure developer workstations. Paul talks about GitHub's Boxen system. Jon talks about his experiences looking at Boxen before settling on sprout-wrap.
- (09:21) Paul mentions that Open Table just open sourced their Puppet IIS implementations.
How Puppet relates to PowerShell and Chocolatey
- (09:36) Jon asks what the PowerShell tie-in is, since Puppet is all Ruby based. Paul talks about the PowerShell scripts they exec from Puppet and how they use them to do things like turn Windows features on and off.
- (11:01) K Scott asks if you could use Chocolatey with Puppet, and Paul says they're using Chocolatey via PowerShell. Jon says that sounds useful since Chocolatey can now integrate with the Web Platform Installer, and Paul says they're doing just that to install .NET 4 on their servers.
More questions about Puppet
- (11:47) Paul talks about how traditional infrastructure management runs on documentation, and how they can replace all of that using Puppet.
- (12:58) K Scott asks if this is also useful for deployments. Paul says a deployment is just a different configuration state, so Puppet can handle that just fine.
- (14:09) Jon asks if Puppet can handle database state.
- (14:50) Jon asks how you handle licenses with Puppets.
- (15:20) Jon asks how Puppet relates to Windows configuration management options. Paul says that at Open Table they've moved to using multiple platforms, so they need infrastructure management options that can work across all of those environments.
- (16:30) K Scott asks what is was about Puppet that caused him to lose some hair. Paul says it's scary to be able to write a module that makes changes to 90 servers.
And some more Puppet stuff
- (17:30) Jon asks if it's possible to do automated testing with Puppet configuration and modules.
- (18:27) K Scott asks if there's any kind of rollback plan for Puppet.
- (18:40) K Scott tries to ask Paul about what he does in his free time, but Paul says in his free time he writes code and changes the subject back to Puppet.
- (19:21) Paul says he's going to be speaking at Puppet Conf, so he'll be speaking at a Linux administrator's conference.
- (20:00) K Scott asks if there's political fallout from systems administrators who are concerned he's trying to replace their jobs. Paul says he's trying to free them up from repetitive tasks in their jobs so they can get more done.
- (20:56) K Scott asks Paul about upcoming conferences he's going to be speaking at.

Show Links:

Paul Stack (blog, @stack72)
NDC Session video: Windows - Having its ass kicked by Puppet and PowerShell since 2012
Puppet Labs
GitHub's Boxen
Puppet-IIS
Herding Code 143 - Paul Stack on Continuous Delivery

Herding Code 173: Laurent Bugnion on sharing code with MVVM Light in Windows 8 and Windows Phone Jul 22, 2013

Show notes

Episode 173

At NDC, Jon, K Scott and and Rob Conery talked to Laurent Bugnion about XAML development, sharing code between Windows 8 and Windows Phone, and modern design. Download / Listen: Herding Code 173: Laurent Bugnion on sharing code with MVVM Light in Windows 8 and Windows Phone Show Notes:

XAML vs. HTML for Windows Store development
- (00:40) Rob asks Laurent how often customers ask for HTML/JS based Windows Store application rather than XAML based. Laurent lists a few of the cases where people ask for HTML based work, but says the cases are very rare. Generally they're much more productive with XAML and C#.
- (02:49) Rob asks Laurent if he thinks this will change over time. Laurent says IDE support may affect things a little, but generally he thinks web developers don't do desktop development because they don't want to do desktop development - they went into web development because they wanted to develop for the web.
- (04:09) Jon asks if Laurent sees things changing over time in XAML based development. Laurent says he sees some big changes in performance - you can get good performance out of the native controls with full designer support now. In terms of Windows 8, he's hoping for more controls to cover some Windows 8 UI elements so they don't require custom controls. In terms of design, he sees some cases where people are breaking some of the general Windows Store design guidelines in cases where they aren't as user friendly. Jon says he's seen one example of this - adding a print app bar button to applications where printing is a regular activity, even though technically the print is supposed to be accessed via the share charm. Laurent says he also sees this in search-heavy apps.
Cross-platform code sharing and Portable Class Libraries
- (07:46) Jon asks about Laurent's talk on sharing code between platforms - does it work? Laurent says he's focusing on portable class libraries - writing logic that works on Windows Phone and Windows Store, then building a UI on top of those libraries. That's working well for him and he's using it in production. It's still XAML and C#, so you can also share code, too.
- (09:26) K Scott asks about MVVM Light - is that working with Portable Class Libraries? Laurent says someone at Microsoft use a PCL port of MVVM Light as a test case, and it's working very well. They still maintain platform specific versions of MVVM Light for people who only work on a specific platform.
- (10:38) K Scott asks for a quick summary of what MVVM Light does.
- (12:45) K Scott asks about some of the challenges in converting MVVM Light to a PCL. Laurent talks about some UI and platform differences.
Metro and modern design
- (14:21) Rob asks how you make different design decisions around "Metro" design or other alternatives. Laurent discusses the design process.
- (16:29) Rob asks about some of the design considerations, and how you'd decide on platforms. Laurent says a default XAML application uses themes which will fit in with the host platform and operating systems, but might look at bit boring, which is why you work with a designer.
- (18:25) Jon says the Windows Store design principles don't prescribe a boring look, referencing the "alive with color" thing and Kelly Sommers' post about how Metro Doesn't Have To Be Boring. Laurent says he doesn't like the "flat design" term, preferring modern - and modern came from Bauhaus in the 1920's, Swiss design in the 1950's, etc. He says it's important to go the design principles, then use your skill as a designer to apply that. There are enough apps on the Windows Phone store that getting noticed takes a good design.
Hobbies
- (22:09) Rob asks Laurent what he does for hobbies. Laurent lists some things that keep him busy, then talks about his fish pond. Rob tells probably the worst newt joke of all time.

Show Links:

Laruent Bugnion (http://galasoft.ch, @lbugnion)
NDC Session video: Sharing code with MVVM Light in Windows and and Windows Phone
MVVM Light Toolkit
Microsoft Design Principles
Kelly Sommers: When Metro Design Falls Off The Tracks
Herding Code 26: Laurent Bugnion on WPF and Silverlight

Herding Code 172: Nik Molnar on Running an Open Source Project Jul 17, 2013

Show notes

Episode 172

At NDC, Jon and K Scott talked to Nik Molnar about what he's learned about running an open source project from his experiences with Glimpse. Download: Herding Code 172: Nik Molnar on Running an Open Source Project Show Notes:

Running an open source project
- (00:35) Nik says he's writing the guide he wishes he'd had a few years ago.
- (01:06) K Scott asks him for one big thing he's learned. Nik talks about the importance of public communication.
- (01:36) Jon mentions the difference between open source code and open source projects, and Nik mentions some of the different documented governance models for open source projects, citing OSS Watch and YUI. This helps
- (03:15) K Scott asks if Glimpse presents unique challenges because there's a plugin ecosystem. Nik says they used to just see code contributors and plugin authors, but now he sees contributors with a much broader perspective, citing Peter Hahndorf's documentation contributions.
- (4:54) Jon asks Nik how he defines success for an open source project. Nik says it depends on the project founder's goals. He says project popularity isn't important to him personally, it's helping users.
- (5:50) K Scott asks Nik about his slide that says Avoid Bikeshedding. Nik explains Parkinson's law of triviality and how it affects open source.
- (08:58) Jon asks Nik if he thinks roadmaps are important. Nik says this an important part of the public communication he mentioned earlier. Jon says he's found that involving people in decisions that will affect them early really important for any kind of project, open source or not. Nik explains how this is handled in the meritocratic model.
Cooking's like programming
- (11:12) K Scott asks Nik about the latest big dish he's prepared.
- (12:45) Nik talks about the parallels between programming and cooking - both have rules that must be followed, but a lot of room for creativity.
- (13:35) Jon talks about a professional chef textbook he got from the library (Nik tells him it's from the Culinary Institute of America). Jon says he saw some parallels between things like food sanitation and source control - you need to start with fundamentals, but then you can apply them in creative ways. Nik describes some further parallels: cooking math and resourcing, the kitchen brigade system and project management.
- (15:12) Nik talks about the ALT.NET of cooking and the focus on basic, classic skills.
What's next
- (16:08) K Scott asks Nik about what's next for him. Nik talks about their latest release and the Heads Up Display. He talks about how simplified web publishing has led to a big increase in documentation contributions. K Scott raves about the UI design.
- (18:45) Jon asks what's new with semantic versioning since they last talked.
- (19:18) Jon asks what's next for Glimpse. Nik says it'll be decided by the community, but he's expecting they'll want Web API support.

Show Links:

Herding Code 171: Magnus Martensson talks Continuous Delivery on Windows Azure and the Global Windows Azure Bootcamp Jul 08, 2013

Show notes

Episode 171

At NDC, Jon and K Scott talked to Magnus Martensson about continuous delivery on the Windows Azure platform and the Global Windows Azure Bootcamp he helped run.

Download / Listen:

Herding Code 171: Magnus Martensson talks Continuous Deliverery on Windows Azure and the Global Windows Azure Bootcamp

Show Notes:

Continuous Delivery on Windows Azure
- (00:20) Jon asks Magnus about what he'll be speaking about at NDC.
- (00:45) Jon asks about the difference between continuous integration and continuous delivery. Magnus says continuous integration just runs tests and builds, but it doesn't go anywhere; continuous delivery actually deploys the code to an environment - staging, possibly production.
- (02:06) K Scott asks about Azure support for continuous delivery. Magnus says you can do it with cloud services, but there's a delay; with Windows Azure Web Sites the deployment is extremely fast and easy.
- (03:00) K Scott asks about the steps of setting up continuous delivery for a web application for deployment including non-git source control. Magnus talks about the setup, new offerings for dev / test scenarios, and asks why anyone wouldn't integrate this into their development process.
- (05:02) Jon asks what recent Azure changes were announced. Magnus discusses both pricing and policy changes for MDSN subscriptions.
- (05:47) Jon asks what some of Magnus' demos include. Magnus talks about using your own TFS service, other git repos, etc. He talks about a his secret demo - the non-Microsoft demo that uses TeamCity, NUnit, and GitHub.
- (07:45) K Scott mentions all the new Azure SDK language support.
Migrating to the cloud and surprise business transformations
- (07:54) Jon asks how this relates to Magnus' work. Magnus works at Active Solution, which employs both of Sweden's Azure MVP's. Cloud development is really a hot field in Sweden right now.
- (08:45) Jon asks about some common challenges. Magnus says the biggest thing is learning the platforms - there are a lot of architectural and strategic things they haven't even considered.
- (10:23) K Scott asks if businesses think they can't move to the cloud because they have custom processes or protocols.
- (10:59) Jon asks if they often do hybrid solutions. Magnus says that multitenant solutions are common, and the process allows companies to transform themselves from product to service companies.
Global Windows Azure Bootcamp
- 12:21 Jon asks about the Global Windows Azure Bootcamp that Magnus helped organize. Magnus tells the story of how they started talking to a few MVPs and things spiraled out of control. In the end they had all timezones, 92 locations, over 5000 attendees. They had some big turnout in some unexpected locations: Nepal, Brazil, Africa.
- 14:08 Jon asks what happened at the event. Magnus talks about the content in the Windows Azure Training Kit and a shared demo with nearly 5000 coordinated worker roles in a giant render farm passed the rendering power of some Pixar films.
- (16:13) Jon asks about the relationship with Microsoft for the event. It was community run, but Microsoft helped out with things like attendee giveaways.
- (16:52) Jon asks if they'll do this again. Magnus says yes and talks about some of the scaling challenges. He calls out the sponsors, who gave away $18 million in license giveaways. It scales because each location is independent, so each location just needs to run one event.
- (18:36) Jon says this reminds him of Corey Haines' Global Day of Code Retreat.
- (18:52) Jon asks what Magnus is up to next. Magnus says he's moving and calls out the upcoming CloudBurst conference - in Sweden and live streamed.

Show Links:

Herding Code 170: NDC Geekout with Richard Campbell and Rob Conery Jun 21, 2013

Show notes

Episode 170

At NDC, Jon and Rob Conery quizzed Richard Campbell about books, nanotech, graphene, cooking, travel, explosions and more.

Download / Listen:

Herding Code 170: NDC Geekout with Richard Campbell and Rob Conery

Show Notes:

Cryptonomicon and other Neal Stephenson books
- (00:55) Rob Conery says he's been rereading Cryptonomicon. Richard, Jon and Rob talk about their favorite Neal Stephenson books.
Nanotech
- (02:26) Richard mentions nanotech in the context of Diamond Age. Jon asks Richard what's going on with nanotech.
- (03:31) Richard describes graphene - what it is, how it's made, and what we can do with it.
BBQ!
- (07:38) Jon asks Richard what he uses to barbecue things. No surprise, he's got three different BBQ devices, electrical modifications and Excel spreadsheets. Intense food chemistry discussions ensue.
Turing and Electromechanical computing
- (11:32) Rob talks about the Enigma machine discussion in Cryptonomicon. Jon and Richard talk about how the Enigma code was broken.
Quantum computing
- (14:37) Jon asks Richard about quantum encryption and computing. Richard explains quantum effects with the two slit experiment.
My Drunk Kitchen
- (18:10) Jon asks Richard how it came to pass that he hosted an episode of My Drunk Kitchen. Richard tells the history of My Drunk Kitchen and how french toast turned into some kind of sourdough frittata.
Home brewing and stills
- (22:37) Jon asks Richard if he's done any home brewing. Richard owns a still but has not used it in anger yet. Richard lists the dangers of moonshining and one-upmanship contests with Carl Franklin.
The geekiest house ever
- (25:38) Jon asks how Richard handles his intensely instrumented house and Rob asks for more details about Richard's house. Richard says he's only been raided as a suspected drug grow-op house once and talks about all the server infrastructure he's got at his house.
- (29:50) Rob asks about Richard's generator setup.
Modern media management
- (31:23) Jon asks Richard how he handles the hardest problem in modern life: managing media. Richard talks about his media shares, networking, media center, and how he gets all the good stuff.
Favorite books
- (34:28) Jon asks Richard for five book recommendations. Richard recommends Existence, Daemon and Freedom. Jon and Richard discuss the believability of Daemon and Richard talks about how some authors are good story tellers, others are good universe builders, and authors who do both are incredibly rare. Richard also recommends Lean Startup and The Phoenix Project. Rob recommends Ender's Game and talks about Arthur C. Clarke; Jon says he liked The Fiction Author's Guide To Time Travel and that got him into Heinlein. Rob and Richard liked Dan Simmons - especially Hyperion. Rob and Richard discuss the difficulty of ending a story well and Richard says Harry Potter put The Matrix to shame in that regard.
Travel tips
- (41:45) Jon asks Richard for some travel tips. Richard starts with recommending local SIM cards and knowing your power plugs.
- (42:33) Richard recommends beating jet lag using light and timing your meals. Rob has been pretty happy with some homeopathic jetlag whatsihoosie and likes baking soda too.
- (45:08) Jon likes compression bags and big batteries with USB outputs. Jon and Richard discuss the frustration of the VGA to HDMI conversion.
- (47:33) Rob always maps out the nearest Apple store before travelling.
- (47:57) Jon has USB video adapters for both VGA and HDMI and figures he's covered.
- (48:15) Richard mentions wireless video in Windows 8.1. Rob mentions AirPlay and Jon talks about Windows PlayTo, but they're all too fiddly for now.
Pretend ending
- If you don't like background noise, this is the end. Bye!
More stuff in the outtake
- We had some more discussion that's pretty hard to hear because of background noise, but we're throwing it in just in case you want to listen through it.
- (50:44) Rob talks about Benford's Law. Rob talks about the application in detecting voter fraud, Rob talks about the application in counterespionage in Cryptonomicon.
- (52:14) Rob wants to talk about submarines. Jon talks about some of the complexities of torpedo seek patterns. Rob talks about Russian supercavitation and mine hunting. Jon talks about old Russian wing-in-ground effect vehicles and ski-ramp carriers.
- (55:30) Richard talks about rail guns, which reminds Jon of fuel air explosives. Jon and Richard tell FAE stories.
- (58:47) Rob tells a story about big explosions at a YMCA camp on Catalina Island.

Show Links:

Richard Campbell (@richcampbell)
Rob Conery (@robconery, http://wekeroad.com)
Norwegian Developers Conference (NDC)
Graphene
Enigma machine
My Drunk Kitchen: Vancouver..."French Toast"? (contains drinking and cursing and a little cooking)
Books
- Cryptonomicon by Neal Stephenson
- The Code Book: The Science of Secrecy by Simon Singh
- Existence by David Brin
- Daemon and Freedom by Daniel Suarez
- Lean Startup by Eric Ries
- The Phoenix Project by Gene Kim, Kevin Behr, George Spafford
- Time Travel: A Writer's Guide to the Real Science of Plausible Time Travel by Paul Nahin
- The Door Into Summer by Robert Heinlein
- Ender's Game by Orson Scott Card
- Hyperion by Dan Simmons

Herding Code 169: Tom Dale and Rob Conery on the EmberJS / AngularJS Cage Match at NDC Jun 18, 2013

Show notes

Episode 169

At NDC, Jon and K Scott sat down with Tom Dale (co-founder of Ember.js) and Rob Conery to recap their cage match battle, compare Ember.js and AngularJS, and hear from Tom about where Ember.js is headed.

Download / Listen:

Herding Code 169: Tom Dale and Rob Conery on the Ember.js / AngularJS Cage Match at NDC

Show Notes:

Intro

(00:18) K Scott and Rob asks Tom and Rob to introduce themselves and recap the Cage Match.
(01:22) Tom describes the challenge and thanks Peter Cooper for moderating. Rob describes the scenario - start with installation and creating a new project, then move to routing and navigation between views.

Demo vs. Reality

(02:28) Rob says it's fun to do a demo with Angular, but once you need to do more structured things you have to start over and reimplement with modules, etc.
(02:43) Tom says that seeing the TekPub screencast about AngularJS informed a lot of their design for Ember.js. The result is a framework that gives you the same simplicity in getting started, but also grows with your application pretty easily.

You Just Don't Do That

(03:22) K Scott asks if they pretty much match up if you're looking at a feature checklist, and if it's more about how you implement things. Rob says AngularJS is much more component based and talks about some things that came up during the cage match which were tricky in Angular, because "you just don't do that".
(04:18) Jon asks if there's an overall effect to how you build your application because it's just not how the framework works. Tom says it's unacceptable when your designer comes to you with a user interaction design for you to tell them it's just too hard to do in your framework, so you won't do it. As framework developers, they spend a lot of effort on composability. Rob says that he sees Ember.js as more prescriptive, while AngularJS provides more building blocks. Rob says it seems like Rails to him, in that it just goes a lot better for you if you give in and go with the framework's opinions.
(06:13) Jon asks about how customization works in Ember.js, compared with Angular's use of directives and filters. Tom says that's done via helpers, referencing an example from the cage match.

Client-side MVC implementation and The Importance of URLs

(06:34) Rob asks Tom if it makes sense to say that "if you can think of it in a server-side framework like ASP.NET MVC or Rails, you can think of it in Ember.js". Tom says it's not the same, because server-side MVC requests are short-lived compared to client-side applications. The real challenge is how you manage that state over time.
(07:17) Tom says that they think URLs are really important. Their challenge has been how to marry the concepts of desktop MVC with the fact that they have a URL, and he thinks they've nailed it. Jon asks how that compares to Angular; Rob says that it's not a primary concern in AngularJS or Backbone.
(08:37) Tom says he considers your web application broken if he hits refresh and doesn't see the same thing he saw before. Everyone screws this up, not because they're idiots but because it's hard, and if you don't have this built into the framework you're using you'll mess it up. (09:06) K Scott asks what kinds of applications are the sweet spot for Ember.js. Tom says his first real professional programming gig was working on MobileMe / iCloud apps. They were big apps written in SproutCore. He says it's important to be able to add features without breaking old features. Functional reactive programming and strong conventions help support this.

State and Scope

(10:38) Jon asks about the difference in maintaining state between Ember.js and AngularJS. Tom talks about how the Ember.js controller is similar to Cocoa and explains how the the controller presents the model to the template. Rob describes the $scope in AngularJS and compares the way AngularJS handles things more explicitly, whereas Ember.js is more conventional.
(12:19) Tom says that he thinks the way AngularJS leverages JavaScript's prototypal inheritance is really elegant, but it breaks down when you have very deeply nested UI's pushing you into directives and more complex decisions. Rob says that you can share scope between AngularJS controllers, but the isolated scope situation is one of the things you struggle with in Angular.

Testing, testing

(13:54) Jon asks Tom about his comment on testability. Tom says that Angular's Karma test support is really nice, and they're working on catching up in Ember. Rob says that in AngularJS you're just working with basic objects, which is really nice when you're testing.
(16:08) Tom says Ember.js requires you to do things correctly from the beginning; they won't give you any foot guns to make things easier. Helpers help.
(16:42) K Scott asks how change detection works. Tom explains the differences - AngularJS uses dirty checking against the DOM, while Ember.js uses accessors (like Backbone). Tom says that the performance is better in Ember.js. Angular's situation will improve when they get object.observe, which ironically will happen at the same time Ember's situation improves due to support for object proxies.
(18:37) K Scott says he'd like to be able to conventionally wire up events. Tom talks about event delegation in Ember.js.

The SEO Elephant in the Room

(19:53) Tom says the biggest issue with JavaScript client-side applications today is SEO and describes why he's not happy with the SEO solutions the other frameworks provide. They're working on a solution that uses leverages the fact that they use Handlebars for templating to run a server-side process to generate SEO friendly content without any PhantomJS dependency.

Using Ember.js When You're Not Tom

(22:28) Jon says that one issue with highly conventional frameworks is that it can be hard when you're getting started and don't know the conventions. Tom agrees and says that you'll be frustrated if you experience learning difficulty before you feel the power and says the solution is documentation and good tooling. He mentions a coming Chrome extension that will show you what controller and model are backing content on the screen when you hover over it. K Scott says he's pretty impressed with the Ember.js documentation.

What's Next? How about some Prollyfills?

(24:45) K Scott asks about what's coming out next. Tom talks about Polymer and Web Components. Jon asks if this was related to something he saw on Twitter the other day and Tom says it's #extendthewebforward. The idea is that browsers should express primitives so browser vendors can innovate at the JavaScript level - rather than building speculative features into the browser, shipping a JS library that works cross-browser and can function as a polyfill (or "prolly"fill) if the feature doesn't ship.

So who won? Any missed opportunites?

(29:45) K Scott asks who won the cage match and Rob admits to having been destroyed. K Scott asks why Rob keeps challenging framework authors to cage matches.
(30:52) Jon asks Tom about the curveball that he threw at Rob during the cage match. Rob and Tom agree that coding a directive on the fly is not easy.
(31:42) Jon asks Tom if there's something that Rob could have asked Tom that would be hard in Ember. Tom says that they just added a competitor to filters using bound helpers, but if Rob had thrown list sorting at him he'd have had a hard time.
(32:54) Jon asks about a viewer question on the emphasis on getting started vs. maintainability. Rob says that they'd first focused on composability, but nobody wanted to use it until it was easy to get started. Framework libraries don't get the luxury of forcing a difficult learning experience on developers - if he can't show value in 5 - 10 minutes, you'll leave.

Wrap?

(34:42) K Scott asks Rob and Tom what else they've got going on. Rob plugs some TekPub videos (listed below) and Tom plugs some upcoming classes he and Yehuda will be offering (also listed below).

Show Links:

Tom Dale (@tomdale, http://tomdale.net/)
Rob Conery (@robconery, http://wekeroad.com)
Norwegian Developers Conference (NDC)
Ember.js
AngularJS
Ember101.com
SproutCore
Karma test runner for JavaScript
Yehuda Katz - Extend the Web Forward
Polymer
Extensible Web Community Group
TekPub: Get Involved! with Scott Hanselman
Upcoming Ember.js courses from Tilde

Herding Code 168: John Sheehan on Runscope Jun 07, 2013

Show notes

Episode 168

This week on Herding Code, the guys talk to John Sheehan about the recent launch of his new API developer tools company, Runscope.

Download / Listen:

Herding Code 168: John Sheehan on Runscope

Show Notes:

Intro
- (00:30) "What is Runscope and why should I care?"
- (00:55) Runscope is the ultimate API integrator developer's toolbox. It helps you solve the problems you encounter in dealing with API's from a consumption standpoint. It takes invisible API traffic and makes it visible, then helping you do all sorts of things with it: debugging, sharing, retry a request from the website, testing features like response playback without hitting the API, webhook debugging, etc. When you rely on an API, you're not just taking on a service dependency - it's code code that's running on someone else's service, and you should treat it like it's code that's under your control. You should apply the same testing rigor and should have the same debugging facilities.
- (03:25) Jon asks about the launch. Anyone can try it out now at runscope.com. John talks about the internal preview (shoutout to Kevin Dente, the first beta tester) and the launch at GlueCon and press at TechCrunch and TheNextWeb.
(04:35) Overview of features:
- Traffic Inspector
  - (04:55) In your code, instead of calling an API directly, you create a Runscope URL by including a Runscope bucket key and replacing dots with dashes. Essentially you're pointing your API calls at Runscope, which then extracts the hostname and makes the API request for you. A lot of other tools require you to change your API calls by modifying your authentication, adding parameters, etc. Runscope doesn't require any changes outside of the hostname, and all of your original headers and request parameters stay intact. This means you can just flip it on by changing your hostname and turn it off when done. You can then view all your requests in the Runscope website, filter to only show errors, All your requests show up in
  - (07:45) Scott says this is essentially a reverse proxy. John agrees that's technically correct, but they avoid the term because they're doing a lot more.
  - (08:13) Scott asks if Runscope adds headers to allow filtering or other things. John says the only modification they make is to add a Runscope message id header to allow lookup. They're thinking of some things in the future like caching credentials to apply to a lot of requests and other features that benefit performance, security, etc.
  - (09:27) Jon asks about the security concerns, as Runscope is kind of like a man in the middle. John says they're very concerned with security, and points to https://www.runscope.com/docs/security for a lot more information about their security practices. They're looking at future things like encrypted storage, and currently if you make an SSL request to Runscope they will forward it over SSL to the API provider.
  - (11:45) Jon asks about cases like multi-legged auth. John says everything just flows through Runscope, with one exception - if a response comes back with a location header then Runscope will modify the location to a Runscope url so if the client follows it it'll be captured.
  - (12:40) Scott asks about how geolocation works, since Runscope is making the request from a different location. John says that currently they're making requests from US East Coast, but in the future they want to allow requests from specific geographic areas.
  - (14:10) Scott asks about a current app he's working on which requires a custom certificate to connect to an API and asks if that would be supported. John says that they're looking at both support for custom certificates as well as on -premises installations to support those scenarios.
  - (15:35) Scott asks about support for non-standard ports. John says they support that using a Runscope request port header.
- Request Editor
  - (16:09) Jon asks about the Request Editor. John explains that they really wanted to make it possible to edit and create requests as easily as any other code. Their original inspiration was the hurl.it site. Jon interjects that he loves using hurl.it to see where shortened or dodgy urls will take him before clicking on them. John says they've taken the idea of hurl.it and really filled it out to include storage, advanced editing, etc. They also built in some helpers for basic auth, digest authentication, OAuth 1, OAuth 2 token generators, etc.
  - (19:45) Scott asks if they've looked at integrating OWASP tests to run some automated security inspection for things like SQL injection, XSS, redirect attacks, etc. John says he'd like to let people create collections and share them with others.
- Shared Requests
  - (21:11) Jon says that when he was testing during the beta and hit a question, John just had him share the request with him. John says that he really wanted that feature when he was at Twilio, and they currently use it all the time internally.
  - (22:39) Jon asks if there's a way to download or otherwise privately share a request. John says the best way to do that now is use team account, which allows for privately share requests within the team. They're also looking at allowing redacting some fields in shared requests, so you can share a request without revealing your password or other sensitive information.
- Passageway
  - (22:48) Passageway was based on the localtunnel project. It installs an agent on your local machine which forwards requests to a specific port to Runscope, and Runscope then creates a public URL. You can use Passageway to show off code running on your local machine, but you can also use it for debugging webhooks and testing API's used in a mobile application (by pointing it at the public Runscope URL). Scott says he sees this as being useful in a continuous integration environment, and John says that a current customer is already doing this.
  - (27:33) Jon asks about the installation via pip, and John explains how pip relates to other package managers. They plan to provider other installers, and later the agent will do more than just Passageway - right now it also supports automatically creating Runscope urls for requests.
  - (29:27) Jon says that Passageway is the first place on the site where he sees something about paid accounts and asks John how they're going to get rich. John says there are three reasons (access to passageway, team sharing and volume) to upgrade from a free account to a starter or team account. Jon asks about the naming of the starter account, and John says that naming and pricing are really hard. Scott offers some advice on enterprise friendly pricing.
Starting a business
- (32:47) Jon asks about the experience of moving from being a developer to founding a company. John says he's started several small companies, and writing software has always been a way to solve problems for businesses. He tells his recent job history at Twilio and IFFT and how he and his co-founder Frank got really fed up with the lack of good API developer tools and how they got started, funded, and launched. Getting funded was both a finish line and a starting line.
- (41:33) Scott and Jon talk about positive response they saw to the GlueCon launch: John spent the majority of the time describing the problem, then unveiled the solution. Scott compares John to Steve Jobs.
What's next
- (43:05) Jon asks what's next. John says they're first focusing on dev-time troubleshooting. Next they'll be focused on production use, especially high volume use cases. Long term they're thinking about mitigating problems - handling or proactively monitoring for problems.
Python
- (45:14) Jon asks about John's experiences building Runscope in Python and how he compares it to .NET. John says he's really come around to significant whitespace and standard
- (46:59) Scott asks if John's noticed that there are fewer ways to solve a problem, as opposed to C# or JavaScript. John says that's true for the most part. He comments on how he likes the small libraries and ecosystem.
Runscope vs. other network tools like Fiddler and Wireshark
- (49:19) Scott asks why you'd use Runscope rather than use things like Fiddler, Wireshark, etc. John explains proxies and applications modify the way the application works and doesn't work well on servers - it's cloud-native. It's also social - sharing is built in. Thirdly, it's not a desktop application.
- (52:30) John says he'd like to write a Fiddler plugin to make the two work well together. Scott says that there's one advantage to desktop applications - it can interact directly with the network stack. John agrees that developers need tools that work at all layers of the stack. Scott recounts a harrowing tale in which Fiddler had to be installed on a server for an application to work.
- (55:20) Jon says he was wondering about integrating with Glimpse but that would require an API - does Runscope have an API? John says one's on the way soon.
Lightning Round inspired by John's Traffic and Weather podcast (with Steve Marx)
- (57:00) Jon says he's really been enjoying the Traffic and Weather podcast, and the John and Steve have convinced him that API's really can be interesting.
- (57:50) JSON API - what is it, and is it good?
- (59:34) What are webhooks, and why have you been talking about them?
- (1:01:52) Should we stop writing REST SDK clients?
- (1:04:29) Where is API security going? Is it OAuth 2 from here on out?
- (1:05:21) Eric Williams (@motowilliams) asks "Ping Pong or Foosball? #gooooooaaaaaallll"
- (1:06:17) Where are you speaking next (answer: API Days and API World, both in San Francisco)
- (1:07:32) Do you support the HTTP 418 teapot response?

Show Links:

John Sheehan (@johnsheehan, http://john-sheehan.com/)
Runscope
TechCrunch: Runscope Lands $1.1M From True Ventures And Andreessen Horowitz For Tools That Address The Broken API Plague
TheNextWeb: Runscope raises $1.1m to help developers that rely on 3rd-party APIs
localtunnel
hurl.it
Traffic and Weather podcast
JSON API
Zapier (REST hooks discussion on Traffic and Weather ep 11)
Hyper Text Coffee Pot Control Protocol and the HTTP 418 (I'm a teapot) response

Herding Code 167: Glenn Block on scriptcs May 24, 2013

Show notes

Episode 167

This week on Herding Code, the guys talk to Glenn Block about scriptcs.

Download / Listen:

Herding Code 167: Glenn Block on scriptcs

Show Notes:

Intro
- (00:10) K Scott asks Glenn if he's still working with Node at Microsoft. Glenn says he's moved from command-line tools for node and is focused on Azure Mobile Services, but he still owns the Node SDK and the Node story for Azure.
- (01:56) K Scott scriptcs is another way to write C# code outside of the IDE as script files. It's inspired by Glenn's work with Node.js. It leverages Roslyn, NuGet, and some conventions to simplify scripting, such as automatically pulling in NuGet packages.
- (03:58) K Scott comments on the ability to reference assemblies using the #r directive. Glenn says it's even easier than that - you can use #r to reference GAC'd assemblies, but assemblies in the local bin folder are automatically referenced. K Scott asks about the hooks to support that, and Glenn explains how Roslyn supports a lot of scenarios; since it ships it as NuGet packages it can be used outside of Visual Studios. Roslyn allows for code to exist outside of a class.
- (06:33) Jon talks about his initial experiences, and how the REPL made it really easy to get started. Glenn explains how that works and explains how, using Chocolatey you can quickly install scriptcs and a NuGet package like MongoDb and then just start writing code in the REPL.
Dependence on Roslyn
- (09:35) Kevin points out that Roslyn is still in CTP and asks how that impacts scriptcs. Glenn says that since it's a CTP Roslyn you can't ship the binaries, but that's not a problem for scriptcs since it pulls in the public NuGet packages. Roslyn is still evolving, it doesn't yet support async / await or dynamic, for instance.
- (11:13) scriptcs no longer takes a dependency on Roslyn. It uses a pluggable script executor which can use Roslyn but can potentially also use other script engines.
Example uses of scriptcs
- (12:33) K Scott asks for some common use cases. Glenn says that it's possible to build apps because you can have one script that includes other scripts, then talks about the WPF calculator sample in the scriptcs-samples repo.
- (14:18) Glenn says another use he's seeing is automation - basically as a replacement for PowerShell. He talks about the Fluent Automation sample which uses script-cs to automate Selenium tests.
- (15:18) Glenn talks about a real world example at a large trucking company who is using scriptcs to automate data processing jobs.
- (16:05) Octopus Deploy has added support for scriptcs. He used a loader script that passes configuration to user-written scripts.
- (17:42) Glenn says it's useful to tinker and play with libraries or services and give an example of interacting with Azure Mobile Services in the REPL.
- (18:38) One other example is extensibility - creating hooks and allowing end users to just drop in a scriptcs script to extend behavior.
- (19:03) Kevin says that in the past people have used JavaScript engines to support extensibility. Glenn says that touches on a common question - why scriptcs as opposed to a lot of other options such as F#, Ruby, node, etc.? He gives two reasons: you get to stay in a language you're familiar with, and there's a "grow up" story to migrate from scriptcs to a Visual Studio project using the same libraries, same code, etc.
- (20:03) Jon says that the PowerShell syntax is different enough that he can't remember it. He talks about the idea of using scriptcs for installation and initialization scripts in NuGet rather than PowerShell. Glenn says there are kind of ways to use C# with PowerShell, but it's not the same. He mentions a sample from @beefarino which lets you talk to scriptcs from PowerShell.
- (23:01) Kevin asks what the migration process is to move from scriptcs to a C# project. Glenn says it depends on how much you take advantage of scriptcs features like Script Packs. Script Packs bring a node-like require module syntax into scriptcs. Glenn talks about the Web API script pack which adds in proper usings and gives you an API that's very easy to use in script, without IntelliSense. They've talked about creating a project exporter which could set up a project and bring in your Script Packs, etc.
- (26:25) Kevin asks if the Script Pack / Require experience could be brought into standard C#. Glenn says the general concept could work because it's just a DLL, although there are some incompatible things like import statements. They've looked at writing Script Packs as script, which could make this more useful.
- (28:40) Kevin talks about how the Node module system handles conflicting dependencies and asks if scriptcs handles that. Glenn says not yet, but .NET is now able to handle that so it could be added in. The general idea of script modules depending on other script modules makes sense, but conflicting dependencies might not be very useful. They're thinking of NuGet packages with no assemblies, just does as content, and talks about some implications.
- (31:32) Jon talks about how Glenn had told him that a lot of his bizarre feature requests wouldn't fit in the core but could be useful as extensions, then asks about the extensibility points. Glenn runs through what you can do: change the engine, use Script Packs, bring in NuGet packages, possible later REPL extensions via global NuGet packages. He says they're following the Node team's principles of keeping a small tight core and pushing features towards extensions.
Questions from Twitter
- (34:14) Jeff Schumacher (@codereflection) asks Glenn to compare scriptcs performance vs. compiled code. Glenn says that there can be a short startup impact and potentiall
- (35:58) Akim Boyko (@AkimBoyko) asks if it's possible to run scriptcs without Roslyn, async/await support and in sandbox mode. Glenn talks about the Mono impact of running without requiring Roslyn support. Roslyn will be getting async/await support at some point, but it could also be added via CodeDom if people implement that. However, CodeDom doesn't support the classless system that Roslyn does.
- (38:04) Simon Cropp (@SimonCropp) asks if scriptcs support plugging into the build pipeline? Eg if I wanted to plug in Fody (https://github.com/Fody/Fody/).
- (39:41) Several questions on how scriptcs compares to Snippet Compiler, LinqPad and csscript.
- (41:12) Dan Vanderboom (@danvanderboom) asks if scriptcs let us run a .cs code file by itself anywhere in the file system? Glenn says no and explains why he's not sure that would be useful.
- (42:55) Tomasz Janczuk (@tjanczuk) asks When will integration of scriptcs and edgejs be done? ;) Glenn talks about how the projects have both grown up together and how the two would be useful together.
Debugging and IntelliSense
- (45:29) Jon talks about how he messed something up in the samples and debugged it and asks about debugging support. Glenn points out that you can directly debug an EXE in Visual Studio and explains how to debug scriptcs code in Visual Studio. He also talks about MDbg which Glenn (and apparently everyone else) didn't know existed. He also mentions a Script Pack for debugging.
- (48:15) Jon says the REPL is great, and yet he'd sometimes like IntelliSense. Glenn talks about a lightweight WPF editor that's in progress, but says if you get to a point where things are getting complex it's probably time to move to move from scriptcs to a project. Jon says that for the most part Script Packs seem to really simplify the code to the point where you don't really need IntelliSense, and Glenn agrees.
Shoutouts
- (50:45) Glenn calls out the two other coordinators on the project, Filip Wojcieszyn (@filip_woj) and Justin Rusbatch (@jrusbatch) as well as some other top contributors.
Shell capabilities, TSR scenarios
- (52:03) Kevin asks if there are possible changes to make it more shell-like with things like piping. Glenn says they currently have a poor story for arguments, but it's coming. You can currently pipe text, but he's not sure about piping objects.
- (54:30) Jon says he's got some AutoHotKey scripts and asks if scriptcs could handle that kind of thing.
Future plans
- (56:10) K Scott asks where things are going in the future. Glenn mentions scriptcs modules, aliases, a better Visual Studio experience, export project, and saving DLLs.
- (1:04:25) Glenn talks about some interesting ideas on GitHub, like a command to break execution into the REPL. They've got 20 active contributors, so things are moving fast.
- (59:54) Glenn says he's got a personal interest in seeing some adoption in Microsoft - such as adding scriptcs scripting to other projects.
- (1:00:25) Glenn talks about one question that comes up: should the Roslyn team have tackled the scriptcs scenario?
Wrap up
- (1:01:10) K Scott asks about Glenn's upcoming plans, speaking engagements, etc.
- (1:02:27) Jon makes a last minute sales pitch to try it out - you can install in seconds from Chocolatey and just start playing at the REPL. Glenn points one gotcha - scripts which run servers need to be run as admin.

Show Links:

Glenn Block (@gblock, CodeBetter blog, MSDN blog)
scriptcs - Living on the edge in C# without a project on the wings of Roslyn and Nuget - Glenn's post explaining scriptcs and why the project started
Scripting ease with Script Packs
Roslyn CTP
scriptcs samples repository
Fluent Automation sample
ScriptCS or PowerShell post by @beefariono
scriptcs on Dot Net Rocks
Project-less scripted C# with ScriptCS and Roslyn (Scott Hanselman)

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected