Yiyi Sun - Programming Blog

Visual Studio Isloated Shell and Eclipse Rich Client Platform

Visual Studio 2008 isolated mode shell reminds me the Eclipse rich client platform (RCP).

The most important architectural characteristics of Eclipse is the Plug-in architecture, which has concept of Plug-ins, Extensions and Extension-Points.

Plug-ins are the smallest deployable and installable software components of Eclipse. The similar concept in VS is VSPackage. After this eveything began to be very different.

Eclipse plug-ins are pure Java libraries on Java platform.
VS Packages are .NET libraries on COM based on platform through COM interop and MPF.

Eclipse plug-ins are described in XML.
VS replies on registry. VS Packages are using pkgdef and pkgundef files and code attributes.
……

From the Visual Studio 2008 Shell offcial definition:

The Microsoft Visual Studio 2008 Shell provides a core integrated development environment (IDE) to help you build and ship specialized languages and development tools.

Looks like it is only targetting development tools, not general application platform.

What about DSL then? Bound DSL only to VS shell is really limitting the potentials of DSL.

Add comment March 9th, 2008

Controller is NOT to separate the View from the Model

I used to think controller in MVC is to separate the view and the model, until I saw this blog An Introduction to the Model-View-Controller, Model-View-Presenter, and Presentation-Abstraction-Control Patterns where Derek Greer wrote,

One common misconception about the relationship between the MVC components is that the purpose of the Controller is to separate the View from the Model. While the MVC pattern does decouple the application’s domain layer from its presentation layer, this is achieved through the Observer Pattern, not through the Controller. The Controller’s job is to mediate between the human and the application, not between the View and the Model.

While the original idea of the Presenter was seen by the Taligent team as a Controller elevated to an application level, the Dolphin team mistakenly considered it a replacement of the VisualWorks’ Application Model and maintained the Presenter as a mediating component within the triad.

• In MVC, controller is the human to model connector (intercepts user input).
• In Taligent MVP, the presenter is the subsystem component connector (manages application subsystems).
• In Dolphin MVP, the presenter is the presentation to domain connector (manages access to model updates).
• In Passive View, the presenter manages presentation logic.
• In Supervising Controller, the presenter assists with presentation logic.

Add comment February 10th, 2008

Visual Studio can do MVP

The code beside technology is used by the visual studio designer. E.g. for each Windows Form, visual studio designer generates two partial classes, one for creating UI elements, and the other one is the place to write code. I think it is a MVP/Passive View already.

• Windows Froms App, The SomeForm.designer.cs is the view and the SomeForm.cs is the presenter.
• ASP.NET, the aspx/ascx is the view and the aspx.cs/ascx.cs is the presenter.
• WPF, the xmal is the view and the xmal.cs is the presenter.

If it Visual Studio generates an interface, ISomeForm.cs. Then have SomeForm.cs reference to this interface, instead of being partial class of the view. It is exactly MVP/Passive View. This would make unit testing easy based on ISomeForm.cs and SomeForm.cs. I would not mind if Visual Studio does this (in fact it might be something good to suggest MS to do).

In SCSF and WCSF, there has to be another presenter class. This makes me feel it is a redundant, because presenter class ties/couples to the view. It can hardly be reused. And you have to create extra code to delegate user input/UI events to the presenter. That’s part of reasons why I am not satisfied w/ MVP in SCSF and WCSF.

The original force of MVP is to ease unit testing. Current unit testing on the presenter is to mock interfaces of view and model. Because there is no other better method, this leaves the mocking on interfaces only one to use practically.

What about to have a tool that generates mock object from aspx/ascx to make aspx.cs/ascx.cs unit test-able?

Add comment February 10th, 2008

ASP.NET MVC Framework is just another front controller

ASP.NET framework is already a MVC framework that allows to implement MVC.

Within ASP.NET, there is a front controller.

The controller itself is usually implemented in two parts: a handler and a hierarchy of commands. The handler has two responsibilities:

Retrieve parameters. The handler receives the HTTP Post or Get request from the Web server and retrieves relevant parameters from the request.

Select commands. The handler uses the parameters from the request first to choose the correct command and then to transfers control to the command for processing.

The commands themselves are also part of the controller. The commands represent the specific actions as described in the Command pattern [Gamma95]. Representing commands as individual objects allows the controller to interact with all commands in a generic way, as opposed to invoking specific methods on a common command class. After the command object completes the action, the command chooses which view to use to render the page.

The upcoming ASP.NET MVC framework is another front controller implementation.

ASP.NET’s default front controller truns plain http request into view state and server side events. ASP.NET AJAX extended the ASP.NET web form to support partial page render.

ASP.NET MVC replaced (not extended) the default front controller, so that there won’t be view state, nor server side event any more, in order to have SEO/REST style URL. Not sure if it is worth to trade REST style URL with view state, server side events and partial page render.

Add comment February 10th, 2008

C# Feature Presentation

Here are the slide deck and source code used in my presentation about C# features for fellow developers. Topics include:

C# feature demo: Find even number from a list of integers:

• C# 1.x – Loop in Collection (Array)
• C# 1.x – Delegate (Custom Delegate)
• C# 2.0 – Iterators (yield return)
• C# 2.0 – Delegate (Predicate<T>)
• C# 2.0 – Anonymous Method
• C# 3.0 – Lambda Expression
• C# 3.0 – LINQ (Language integrated Query)
• C# 3.0 – Extended Method

LINQ demo: Match orders with appraisers

• Select: Default, Anonymous Class, Dictionary
• Where: Static, Dynamic Query
• Group: Aggregation, e.g. count
• Join: Inner Join, Out Join, Group Join
• Order: e.g. order by count desc

Add comment December 28th, 2007

Service without description is a pain

Too many debates are there about SOAP vs. REST, contract first vs. code first.

But here is my real life experience during developing WB Editor when it needs to connect web services through those famous RESTful style APIs.

First, the API documents usually have no schema definitions other than request and response XML examples.  Examples are good for human to read.  But after reading, where is the code that I can work with? I have to write code to parse those XML! - This is a pain. If there was schema, machine could generate client code stubs automatically. The nice “Add web reference” way.

Second, maybe the web service providers realized the issue mentioned above. Usually there are client libraries are also available, such as libraries for Java, for .NET, for PHP, for Python and for Javascript …. If using libraries, what is the differece between them to those C libraries ages ago? As long as the the library black box can talk to the server no needs to bother whether underneath it is HTTP, whether it is XML or binary.

I cannot imagine if in my company, when I publishing tones of web services to other departments or clients, I have to also deliver client libraries, for Java, for .NET ….

Tags: WB Editor, SOAP, REST, API, schema, Add web reference, web services

Add comment June 8th, 2007

SQL CE database and ClickOnce Deployment

My default SQL CE database was deployed to ClickOnce Data Directory. If changed the database schema, ClickOnce will deploy the new database and keep the old database file (in .pre folder). Here is the psuedo code to migrate schema:

if (IsFirstRun)
{
   if (customMigrationORMergeNeeded)
   {
      string dataFolder = call the API
      // Database from V1 of the    app
      string oldDatabase = Path.Combine(dataFolder,”.pre\db1.db”);
      if (File.Exists(oldDatabase))
      {
         string newDatabase = Path.Combine(dataFolder,”db1.db”);
         //perform the task needed with old and new one
         DoPerformCustomMigrationORMergeAsNeeded();
      }
}

What about removed the program from control panel? Data are all gone.

Looks like better to copy database file to the application data folder.

Add comment May 15th, 2007

About

Add comment October 18th, 2006

SharePoint Windows Authentication

In IE: open “Tools | Internet Options -> Security”, add the SharePoint sites in “trusted sites”

In firefox: open firefox browse to about:config find “network.automatic-ntlm-auth.trused-uris” modify the value and enter in SharePoint intranet sites that you must pass your username and password to. For some site i connect to i also had to add values to: “network.negotiate-auth.delegation-uris” “network.negotiate-auth.trusted-uris”

1 comment July 20th, 2006

P&P OB CAB EntLib

继续 VSLive Toronto 的后续故事。 上次记录了 SQL/e，这次是关于 Daniel Cazzulino çš„发言 《Microsoft p&p ObjectBuilder》。听完这个演讲发现最近周围的事情还都发生了些关联。

首先是日前买了本书 《Head Up Design Patterns》。它的第一章就以一个引人入胜的故事介绍了设计模式的 Strategy Pattern。这个模式的好处多多，但是负作用是会产生了很多相互关联的类。如何按照合理地创建这些类，并把它们组和起来。这就引出了另外一个话题 Inversion of Control / Dependency Injection。

这几天帮女儿复习准备乐理考试，还碰到了 Interval Inversion / Triad Inversion，搞得我就很头昏。Dependency Injection å¥½åƒè¿˜å¥½ç†è§£äº›ã€‚

Daniel Cazzulino 讲的 ObjectBuilder å°±æ˜¯ä¸€ä¸ªå…·æœ‰ dependency injection 功能的轻量级对象容器*。 ObjectBuilder æ˜¯ ï¼­ï¼³ patterns & practices Composite UI Application Block ä»¥åŠ Enterprise Library 的核心部分。

这就又引到了 CAB - Composite UI Application Block。也是不久前 WB Editor 3.0 的设计已经开始了。鉴于 2.0 版本中 RAD 流毒太深**，决定应该采用个好的系统结构，正在犹豫，是否用这篇 Implement a Microsoft Word-like Object Model for Your .NET Framework Application 文章介绍的方法呢，还是用 CAB。

经过聆听 Daniel Cazzulino 的讲解，不但了解了 OB 的功能，还了解了其内部的一些机制。因此决定进一步学习了一下 CAB Hands on Lab。于是得到结论就是 WB Editor 3.0 将采用 CAB。

Daniel Cazzulino 还讲了个有用的内容，Guidance Automation Toolkit / GAT，值得再用一篇笔记介绍。
* 轻量级对象容器和 ** RAD 流毒也可以讲些故事。

Tags: VSLive ObjectBuilder Strategy Pattern Inversion of Control Dependency Injection Composite UI Application Block CAB RAD

1 comment May 14th, 2006

Optimistic concurrency

During the WB Editor 2.5 testing, we found an interesting concurrency control issue. In this version, we allowed multiple program instance for ease of cross posting.

Now in multiple instance windows, user can setup blog server accounts differently. Which one is the winner?

“Last one wins” was disapproved by QA.

Maybe we need optimistic concurrency. I this case user will receive a dialog saying “another instance has modified the settings”, do you want to overwrite or discard or reload?

Another option is concurrency control with change notifications. Using FileSystemWatcher to detect changes of configuration file, but what should happen next in UI?

Tgas: WB Editor concurrency control Last one wins optimistic change notifications multiple instance blog cross posting FileSystemWatcher 

Add comment May 10th, 2006

.NET 下制作 Shareware 的关键技术探讨二：非对称加密

前文描述了.NET 为 Shareware 程序开发提供了许可证检测机制，使得开发者可以集中精力到如何验证许可证。

把一个信息经由不可信任的途径传达给接受者的时候，就需要进行加密。对于信息接受者来说，则需要确认信息的来源是来自正确的，就需要进行数字签名。Shareware 程序拥有者要告诉远在用户机器上的自己的程序用户有权使用这么个信息，是要加密的。因为你不想让其他人知道这个信息是如何表达的，更不能让人家如法炮制出相同的信息。

.NET 提供了加密和数字签名等现在用在网络安全方面的技术用到 Shareware 上是绝对好的。下面是用 .NET RSACryptoServiceProvider 的一个办法。

RSA 是一种非对称加密技术 Asymmetric Cryptography，即加密用的密码和解密用的密码是分开，相互不能推演的。如果知道了解密用的密码，无法知道加密用的密码。这比对称加密安全性好，因为 Shareware 总是需要一个密码用来解注册码，用对称加密的情况下，如果被人从程序中分析到了解密的密码，有可能复制注册机。而用非对称加密，即使解密的密码泄漏，也无法做出注册机。

1、生成和保存密码

创建个新的 RSACryptoServiceProvider 对象，.NET 就随机生成了密码。
RSACryptoServiceProvider 对象可以把密码输出成 xml。

RSACryptoServiceProvider rsa = new RSACryptoServiceProvider();
Console.WriteLine(rsa.ToXmlString(true));

这个 xml 是要好好保存起来的秘密。其中包含了用来做注册机的加密用的 private key 和 将来在程序中用来解密的用 public key。

<RSAKeyValue>
  <Modulus>…</Modulus>
  <Exponent>…</Exponent>
  <P>…</P>
  <Q>…</Q>
  <DP>…</DP>
  <DQ>…</DQ>
  <InverseQ>…</InverseQ>
  <D>…</D>
</RSAKeyValue>

2、注册机

根据上面的密码 xml，可以这样生成注册机所需要的 RSACryptoServiceProvider 对象。然后用数字签名的办法生成注册码。

SignData 是做数字签名。它与单纯的加密解密有区别。

如果要变成注册码是这样一句话：某人于某时某地购买了我的软件。单纯的加密后的解密你会看到这句原话(从内存里什么地方挖出来)。而用数字签名办法，解密后看不到原话，而是一个单向计算出来的 Hash 值。所以对所传送的信息多了一层保护。RSACryptoServiceProvider 提供了直接的生成数字签名和验证数字签名的方法。

private static byte[]CreateKey()
{
    byte[] digestInput = fileEncoding.GetBytes(GetRegistrationInfo());
    RSACryptoServiceProvider RSAalg= new RSACryptoServiceProvider();
    RSAalg.ImportParameters(GetPrivateKeyParam()); 
    return RSAalg.SignData(digestInput, new SHA1CryptoServiceProvider());
}

private static string GetRegistrationInfo()
{
    return GetValue(“NAME”)+GetValue(“PURCHASE_TIME”)+GetValue(“FROM”);
}

private static RSAParametersGetPrivateKeyParam()
{
    RSAParameters param = new RSAParameters(); 
    param.D= Convert.FromBase64String(“…”); 
    param.DP = Convert.FromBase64String(“…”);
    param.DQ = Convert.FromBase64String(“…”); 
    param.Q = Convert.FromBase64String(“…”); 
    param.P = Convert.FromBase64String(“…”); 
    param.Exponent= Convert.FromBase64String(“…”); 
    param.Modulus= Convert.FromBase64String(“…”); 
    param.InverseQ= Convert.FromBase64String(“…”); 
    return param;
}

从 XML 中生成 private key 来制作数字签名，需要用到全部参数：D, DP, DQ, P, Q, Exponent, Modulus, InverseQ.

3、验证数字签名

在 Shareware 程序中，从密码 xml 文件生成验证数字签名所需要的 SACryptoServiceProvider 对象，然后请用户输入他的名字、以及购买软件的时间地点。组成一个句子：某人于某时某地购买了我的软件，用 SACryptoServiceProvider 验证一下它的数字签名是否符合注册机生成注册码。

private static bool VerifyKey(byte[]digestInput, byte[] signed)
{ 
    RSACryptoServiceProviderRSAalg = new RSACryptoServiceProvider();
    RSAalg.ImportParameters(GetPublicKeyParam()); 
    return RSAalg.VerifyData(digestInput, new SHA1CryptoServiceProvider(),signed);
}

private static RSAParametersGetPublicKeyParam()
{ 
    RSAParameters param = new RSAParameters();
    param.Exponent = Convert.FromBase64String(“…”);
    param.Modulus = Convert.FromBase64String(“…”); 
    return param;
}

从 XML 中生成 public key 来验证数字签名，只要用两个参数：Exponent, Modulus. 别人即使从你散发出去的程序本身破解得到了public key，没有其它多大用处。

当然，破解不仅仅是要得到密码。如果来个暴力破解，把你的程序反编译出来，把你的 public key 换成他的，与他自己的注册机配合的，那你不就被抢劫一空了，或者反编译出来删掉前文所述的 LicenseProvdier，或者 …….，还有很多办法。

.NET 提供的许可证监测机制，非对称加密是否能真正发挥，还得看程序本身的加扰程度。下一篇文章介绍。

Tags: shareware asymmetric cryptography rsa private key public key

Add comment March 16th, 2005

.NET 下制作 Shareware 的关键技术探讨一：Licensing

制作 Shareware 有三个关键点：

• 如何保护对象(程序)，在创建对象的时候检测许可证 (License)。
• 加密/解密 用户信息和注册信息。
• 程序加扰 (obfuscate) 或者程序加密，反破解。

.NET 为前两者提供了基本支持，非常方便。这里先说检测许可证。许可证可以有通用注册码、验证用户名的注册码、验证用户机器的注册码等形式。当用户花钱购买了 Shareware 程序，Shareware 程序拥有者就会发送注册码给用户。(Share-It æœ‰åœ¨çº¿æ³¨å†Œç ç”ŸæˆåŠŸèƒ½ï¼Œä¸€æ”¶åˆ°é’±ç«‹å³è‡ªåŠ¨ç”Ÿæˆæ³¨å†Œç )。

Shareware 程序运行时要检测和验证用户是否具有有效的注册码，以决定用户是否能执行程序。

.NET 下的程序都是面向对象的，所以 .NET 在对象的创建机制上，提供了许可证检测的一个接口，Shareware 程序开发可以在此基础上加入自己的注册码验证算法。

.NET Licensing 一文介绍了许可证检测的办法：

[LicenseProviderAttribute(typeof(LicFileLicenseProvider))]
public class LicensedClass : IDisposable
{
    private License license = null;
    public LicensedClass()
    {
        license = LicenseManager.Validate(typeof(LicensedClass), this);
        Console.WriteLine(“Hello from the licensed class.”);
    }
    public void Dispose() 
    {
        if (license != null) 
        {
            license.Dispose();
            license = null;
        }
    }
}

有了这么个结构，程序开发可以把检测许可证交由 .NET 完成，而自己集中精力设计如何验证注册码。把上面的 LicFileLicenseProvider 换成自己的 Custom LicenseProvider。比如，不读文件而去读注册表，见：CodeGuru: Licensed Applications using the .NET Framework 。我的一些文章收藏 (RSS格式) 。

不论是从文件或者从注册表得到注册码，它包含了户是否可以运行程序的信息，而且它一定是只能 Shareware 程序拥有者说了算。因此这个信息是必须加密的。

.NET 提供了非对称加密 (Asymmetric Cryptography) 工具可以用来处理注册码。下一篇文章里继续介绍。

Add comment March 3rd, 2005

WB Editor 2 的口号

随着 WB Editor 2 的发布，它提出的口号是： Blogging is not just editing and posting. Feel the fun and the power with WB Editor 2. 

在 再议 WB Editor 插件 ä¸€æ–‡ä¸­æåˆ°äº†ä¸å°‘浏览器无法实现的功能。这里再比较一下即使浏览器也用上了 htmlarea, FreeTextBox, CuteEditor, FCKEditor ç­‰ç¼–辑器，也不能达到 WB Editor 提供的那种细致程度。

1、快速格式文本

Wiki 里面有一派观点是 WYSIWYG 是不利的，再重点在写作而不是排版的人眼里，排版打断了创作的思路。因此，Wiki 使用了 Textile 风格的排版。WB Editor 在主要支持 WYSIWYG 编辑的同时，也通过 Quick Format 插件来实现 Textile 的排版功能。 类似的功能也可以在 word 2003 里面看到。

*加粗*、 _斜体_  按快速键就变成了： 加粗、 斜体

2、处理连接 (hyperlink)

把普通文本变成超文本，加入连接的过程很是繁琐。WB Editor 有三种办法来简化它，都是浏览器不可能做到的。

• 一是 Add link 对话框具有 Auto-Complete 的功能，就如同在 IE 地址栏里输入地址，随着输入，它从浏览历史中找出相近的 URL。
• 二是 Textile 风格的快速格式化，能把 “WB Editor”:http://www.wbeditor，格式化成：<a href=”http://www.wbeditor.com”>WB Editor</a>。
• 三是 Hyperlink Wizard 插件，它能识别文章中的连接，保存下来，按个快速键就能分析文章，自动加上连接。