Hosam Kamel

Sandcastle Source Code published in Codeplex

HosamKamel — Fri, 04 Jul 2008 15:49:46 GMT

Sandcastle team has announced the pulpishing of SandCastle source code to CodePlex.

Project Page at CodePlex http://www.codeplex.com/Sandcastle

Source code : http://www.codeplex.com/Sandcastle/Release/ProjectReleases.aspx?ReleaseId=13873

http://www.codeplex.com/Sandcastle/SourceControl/ListDownloadableCommits.aspx

Read the formal announcement here SandCastle Blog

Free SQL Injection Vulnerability Scanner By HP

HosamKamel — Mon, 30 Jun 2008 21:35:49 GMT

Scrawlr is a free software for scanning SQL injection vulnerabilities on your web applications.

It is developed by HP Web Security Research Group in coordination with Microsoft Security Response Center.

Scrawlr crawls a website while simultaneously analyzing the parameters of each individual web page for SQL Injection vulnerabilities.

After the scanning process, if it can find, it even shows your database table names as a proof of the possible SQL injection vulnerabilities.

via :webresourcesDepot

Software Development and Programming Podcasts

HosamKamel — Sun, 22 Jun 2008 18:02:30 GMT

A list of software development and programming podcats by by alanlok

Take a look here Software Development and Programming Podcasts

The Geek toolbox

HosamKamel — Sat, 21 Jun 2008 19:04:48 GMT

The Geek Toolbox is a Facebook group which provide it's members with a collection of geek tool which are used in the day-to-day activities such as development and general operating system tools and hacks.

It also provide the members with some geek tools for fun and customization software.

hurry up and join it now The Geek Toolbox

Web.Maps.VE 2.0 Released - ASP.NET Virtual Earth Mapping Server Control

HosamKamel — Sat, 21 Jun 2008 18:55:00 GMT

Chris Pietschmann has released Web.Maps.VE v2.0.

Some of the key features in Web.Maps.VE v2.0 are:

Plot Pushpins, Polylines and Polygons with Multiple Shape Layer Support
Perform "Find" searches from Server-side ASP.NET code
Reverse Geocoding (via FindLocations) from Server-side ASP.NET code
Plot Multi-Point Driving (and Walking) Directions
Implemnt MS Virtual Earth mapping from within Server-side ASP.NET code; No JavaScript Required
Server-side Handling of Client-side Map Events (onclick, endzoom, endpan, etc.)
Ability to easily build Dynamic/Interactive style Map-based searches
Supports ASP.NET 3.5 and Visual Studio 2008 with Design-Time Support

There are many more features to Web.Maps.VE v2.0; go Download the FREE Trial to see for your self.

New .NET 3.5 Webcasts are Coming... Mark Your Calendars!

HosamKamel — Fri, 13 Jun 2008 23:16:51 GMT

A list of Webcasts which explain .NET 3.5 feature in details ... Mark you calendars

Live Webcasts

MSDN Webcast: ADO.NET Data Services Overview (Part 1 of 2) (Level 100)

Tuesday, June 17, 2008 11:00 A.M.–12:00 P.M. Pacific Time

MSDN Webcast: Beyond the Endpoints with Windows Communication Foundation with Juval Lowy (Level 100)

Wednesday, June 18, 2008 10:00 A.M.–11:30 A.M. Pacific Time

MSDN Webcast: geekSpeak: Workflow Services in .NET 3.5 with Jon Flanders (Level 200)

Wednesday, June 18, 2008 12:00 P.M.–1:00 P.M. Pacific Time

MSDN Webcast: Calling Services from Silverlight 2.0 with Jon Flanders (Level 300)

Monday, June 23, 2008 9:00 A.M.–10:00 A.M. Pacific Time

MSDN Webcast: ADO.NET Data Services Overview (Part 2 of 2) (Level 100)

Tuesday, June 24, 2008 11:00 A.M.–12:00 P.M. Pacific Time

MSDN Webcast: Windows Communication Foundation and Windows Workflow Foundation Integration in Depth with Jesus Rodriguez (Level 400)

Wednesday, June 25, 2008 10:00 A.M.–11:00 A.M. Pacific Time

MSDN Webcast: Windows Workflow Communication in Depth with Matt Milner (Level 400)

Thursday, June 26, 2008 9:00 A.M.–10:00 A.M. Pacific Time

Via : Ravings of a Developer TS

Social Bookmarking for the Tech Community

HosamKamel — Fri, 13 Jun 2008 13:20:25 GMT

To help members of the technical community bookmark useful pages and share them with others, both the MSDN and the TechNet teams recently released a preview of a new social bookmarking tool designed just for their sites. With this tool, you can browse, filter, tag, and manage your bookmarks in a way that’s very much like using the social sharing site del.icio.us or any other online bookmarking service. You can click to see what the most popular bookmarks have been over the past 7 days and you can filter the list of links to display the bookmarks that came from forums versus those that are just from regular web pages.

To get started using the social bookmarking service, you can visit any of these sites:

MSDN for Developers http://msdnbookmarks.com
TechNet for IT Professionals http://technetbookmarks.com
Expression for Designers http://expressionbookmarks.com

After signing into the service, you can use a browser bookmarklet like the one from TechNet available here to begin tagging and saving your links.

There’s also a crazy Silverlight-powered app called TICKER that offers a way to visualize the bookmarks that others are tagging via the social bookmarking system. The links float by on the screen, color-coded as to whether they originated from TechNet or MSDN. If you hover your mouse over the bookmark, it will pause and allow you to save it for yourself.

Via : Channel 10

WCF Security Guide - Formal beta now available

HosamKamel — Fri, 13 Jun 2008 11:39:58 GMT

patterns & practices Improving Web Services Security (Beta Release)

Welcome to the patterns & practices Improving Web Services Security: Scenarios and Implementation Guidance for WCF project site! This guide shows you how to make the most of WCF (Windows Communication Foundation). With end-to-end application scenarios, it shows you how to design and implement authentication and authorization in WCF. Learn how to improve the security of your WCF services through prescriptive guidance including guidelines, Q&A, practices at a glance, and step-by-step how tos. It's a collaborative effort between patterns & practices, WCF team members, and industry experts. This guide is related to our WCF Security Guidance Project.

Download the Beta Guide

Final release is available! Start using the guide today, while we continue to make improvements.

Download the Improving Web Services Security Guide(BETA)

Parts

Part I, "Security Fundamentals for Web Services"
Part II, "Fundamentals of WCF Security"
Part III, "Intranet Application Scenarios"
Part IV, "Internet Application Scenarios"

Create Your Own E-Learning with Microsoft LCDS

HosamKamel — Sat, 17 May 2008 20:07:15 GMT

What is the LCDS?

The Learning Content Development System (LCDS) is a tool that enables you to create high quality, interactive, online courses. Virtually anyone can publish e-learning courses by completing the easy-to-use LCDS forms that seamlessly generate highly customized content, interactivities, quizzes, games, and assessments—as well as Silverlight-based animations, demos, and other multimedia. Register to download the free LCDS release, then start creating your own e-learning courses today!

•Register to download the free LCDS tool

What does the LCDS offer?

With the LCDS, you can:

•Develop and deliver content quickly, while it is timely and relevant.

•Distribute your content via the Web or in a learning management system.

•Deliver Web content that conforms to Sharable Content Object Reference Model (SCORM) 1.2, and which can be hosted in a learning management system.

•Upload or attach your existing content. (LCDS supports multiple file formats.)

•Choose from a wide variety of forms for authoring rich e-learning content.

•Develop your course structure and easily rearrange it at any time.

Enterprise Library 4.0 Released

HosamKamel — Sat, 17 May 2008 15:39:18 GMT

Enterprise Library is a collection of application blocks intended for use by developers who build complex, enterprise-level applications. Enterprise Library is used when building applications that are typically to be deployed widely and to interoperate with other applications and systems. In addition, they generally have strict security, reliability, and performance requirements.

The goals of Enterprise Library are the following:

Consistency. All Enterprise Library application blocks feature consistent design patterns and implementation approaches.
Extensibility. All application blocks include defined extensibility points that allow developers to customize the behavior of the application blocks by adding their own code.
Ease of use. Enterprise Library offers numerous usability improvements, including a graphical configuration tool, a simpler installation procedure, and clearer and more complete documentation and samples.
Integration. Enterprise Library application blocks are designed to work well together or individually.

These are typically rationalized through:

Online Guidance
Scenarios or QuickStart samples
QuickStart Walkthroughs
Hands-On Labs
Sample Source Code

There will be a webcast in June 2008 giving an overview of the new features of Enterprise Library 4.0. You can find more detail on the Enterprise Library landing page.

What's New

This release of Enterprise Library includes the following:

Integration with the Unity Application Block
Windows Management Instrumentation (WMI) 2.0 support and improved instrumentation
Performance improvements (particularly, in the Logging Application Block)
Pluggable Cache Managers
Visual Studio 2008 support
Bug fixes

Note: existing public APIs (v3.1) are still supported.

Links

MSDN site: http://msdn.microsoft.com/entlib
Community Forum: http://go.microsoft.com/fwlink/?LinkID=119312
Community Extensions: http://codeplex.com/entlibcontrib

VIA : Mike Walker's Blog

Yahoo! Internet Location Platform

HosamKamel — Wed, 14 May 2008 21:00:06 GMT

Welcome to the developer preview of the Yahoo! Internet Location Platform. The Yahoo! Internet Location Platform provides a resource for managing all geo-permanent named places on Earth. Our purpose in creating the Internet Location Platform is to provide the Yahoo! Geographic Developer Community with the vocabulary and grammar to describe the world's geography in an unequivocal, permanent, and language-neutral manner.

The Internet Location Platform is designed to facilitate spatial interoperability and geographic discovery; users can traverse the spatial hierarchy, identify the geography relevant to their users and their business, and in turn, unambiguously geotag, geotarget, and geolocate data across the Web.

Getting Started

Get an Application ID
Read the online documentation
Fire up a web browser or your favorite scripting language and explore the world

Understanding the error message: “Login failed for user ''. The user is not associated with a trusted SQL Server connection.”

HosamKamel — Sat, 03 May 2008 09:35:21 GMT

a wonderful explanation about the error message: “Login failed for user ''. The user is not associated with a trusted SQL Server connection.”

read it here SQL Protocols

Live Mesh: First Look at Microsoft's New Platform

HosamKamel — Wed, 23 Apr 2008 11:55:00 GMT

The new Live Mesh service that just launched as an invite only "technology preview" is Microsoft's attempt to tie all of our data together. Live Mesh synchronizes data across multiple devices (currently just Windows computers, but theoretically it will extend to mobile and other devices in the future) as well as to a web desktop that exists in the cloud. It can sync data across devices used by a single users, as well as create shared spaces for multiple users. On the surface, Mesh is a lot like competing file sync services such as Dropbox, SugarSync (which we covered in January), and even Microsoft's own FolderShare product. But what sets Live Mesh apart is its platform approach.

How It Works

Essentially, Live Mesh is a collection of feeds (which can be expressed as ATOM, JSON, FeedSync, RSS, WB-XML, or POX). Every piece of data entered into a user's Mesh -- be it a file, a folder, a message, a user permission, or a new device -- is rendered as a piece of information in a feed. The feeds are then synced with other devices that are part of that Mesh following rules for how to sync each particular piece of information (i.e., File A may sync with Users 1, 2, and 3, while File B may only be told to sync with Users 1 and 2).

Mesh is a combination of web based services that sync files and information across a cloud environment, and client software that allows individual devices to sync with the Mesh. This is a continuation of Microsoft's "software plus services" strategy, in which client software is augmented by (or reliant upon) web services.

The News Feed

While Mesh doesn't have any version control capabilities yet -- a must for a service that syncs data between multiple users -- it does borrow a popular feature from the web for keeping users up-to-date on what's going on across a system: the news feed. The Live Mesh Notifier is a news feed of all the activity on a user's Mesh. Right now that means changes made to files, folders, devices, user permissions, and comments left on files/folders.

However, because Live Mesh is a platform that seeks to interact with third party services (more on that below), it is easy to envision how much more could be pushed through the news feed. We were shown a demo application that synced tweets on Twitter with the Mesh Notifier, for example. As more services use the Live Mesh platform, could it, or a service built on top of it, eat FriendFeed's lunch?

The Platform

What makes Live Mesh potentially very special is that Microsoft has turned synchronization into a platform. Eventually, services as well as devices will be able to hook into Mesh. We were shown some early demos of the type of things Microsoft envisions for the Mesh service that were quite impressive. In one proof-of-concept demo, a photo that was taken via a cell phone camera, was automatically synced to a Mesh that pushed the pictures out to a Facebook photo album.

It was certainly impressive to see data -- in this case a cell phone camera picture -- almost instantly synced across multiple devices and saved to a web service immediately after it was created. Microsoft envisions Mesh as a platform for data synchronization for any service we use and for any type of data. Ideally, for example, if someone were to comment on that photo at Facebook, the comment would sync to anywhere else that photo was hosted (your desktop computer, the desktop computers of anyone sharing the photo, your laptop, other photo sharing sites, etc.).

Taking On Google Gears?

Perhaps the most interesting bit that Microsoft demoed to us was an offline compontent of the Mesh platform. Web apps using the Mesh platform will be able to lean on the client software to take their web applications offline, including all user data, and sync it up when the user gets back online at a later time.

Microsoft is taking an offline approach that is more akin to Google Gears or Mozilla Prism than Adobe AIR -- the web-to-desktop functionality of Mesh is essentially a wrapper for the actual web app. The same HTML and JavaScript, etc. runs in a desktop window in offline mode, data is stored locally, and synced later. The difference is that Microsoft is ting offline access into the Mesh service, so developers don't just get the technology to take their apps offline, but also access to the synchronization and cloud storage services to move their data back and forth.

We've talked about the importance of web apps on the desktop on this blog, so this could be an important component of Mesh.

Will It Work?

It is still very early for Mesh. Microsoft intends to invite key development partners to try out the system in the next few weeks, and will roll out support for other devices (including mobile and Mac) over the next year. One thing that could hinder Mesh, though, is Microsoft's rather confused marketing around its online services. Between Mesh, SkyDrive, Live Spaces, and FolderShare there is so much overlap in Microsoft's services that users are bound to get confused.

Ideally, Mesh will be a platform that will tie all of Microsoft's online storage, synchronization, and sharing services together -- along with other, third party services. But the confusing muddle that is Microsoft Live could stymie mainstream adoption. Microsoft needs to clean up their act and present a more clear marketing message.

Software + services is also a potentially tougher sell than software as a service -- people don't like downloading things. Still, Microsoft has created a compelling product that they hope will standardize synchronization across the universe of devices and web services we each use every day. The prospect of getting easy access to user data on multiple devices could be attractive for developers and prompt them to embrace the platform, but it is probably too early to make any specific predictions.

Ray Ozzie Memo

Accompanying the launch of Live Mesh is a new memo from Microsoft Chief Software Architect, Ray Ozzie. It notes that Microsoft sees the Web as "the Hub of our social mesh and our device mesh." Ozzie calls this "social mesh" and writes that "in scenarios ranging from productivity to media and entertainment, social mesh notions of linking, sharing, ranking and tagging will become as familiar as File, Edit and View."

VIA : ReadWriteWeb

patterns & practices WCF 3.5 Security Guidelines Now Available

HosamKamel — Sat, 19 Apr 2008 06:18:42 GMT

"

For this week's release in our patterns & practices WCF Security Guidance project, we released our first version of our WCF 3.5 Security Guidelines. Each guideline is a nugget of what to do, why, and how. The goal of the guideline format is to take a lot of information, compress it down, and turn insight into action.

The downside is that it's tough to create prescriptive guidelines that are generic enough to be reusable, but specific enough to be helpful. The upside is that customers find the guidelines help them cut through a lot of information and take action. We contextualize the guidelines as much as we can, but ultimately you're in the best position to do the pattern matching to find which guidelines are relevant for your scenarios, and how you need to tailor them.

Here's a snapshot of the guidelines, but you can see our security guidelines explained at our WCF Security Guidance project site.

Categories
Our WCF Security guidelines are organized using the following buckets:

Auditing and Logging
Authentication
Authorization
Binding
Configuration Management
Exception Management
Hosting
Impersonation and Delegation
Input/Data Validation
Proxy Considerations
Deployment considerations

Auditing and Logging

Use WCF auditing to audit your service
If non-repudiation is important, consider setting SuppressAuditFailure property to false
Use message logging to log operations on your service
Instrument for user management events
Instrument for significant business operations
Protect log files from unauthorized access
Do not log sensitive information

Authentication

Know your authentication options
Use Windows Authentication when you can
If you support non-WCF clients using windows authentication and message security, consider using the Kerberos direct option
If your users are in AD, but you can’t use windows authentication, consider using username authentication
If your clients have certificates, consider using client certificate authentication
If you need to streamline certificate distribution to your clients for message encryption, consider using the negotiate credentials option
If your users are in a custom store, consider using username authentication with a custom validator
If your users are in a SQL membership store, use the SQL Membership Provider
If your partner applications need to be authenticated when calling WCF services, use client certificate authentication.
If you are using username authentication, use SQL Server Membership Provider instead of custom authentication
If you need to support intermediaries and a variety of transports between client and service, use message security to protect credentials
If you are using username authentication, validate user login information
Do not store passwords directly in the user store
Enforce strong passwords
Protect access to your credential store
If you are using Windows Forms to connect to WCF, do not cache credentials

Authorization

If you use ASP.NET roles, use the ASP.NET Role Provider
If you use windows groups for authorization, use ASP.NET Role Provider with AspNetWindowsTokenRoleProvider
If you store role information in SQL, consider using the SQL Server Role Provider for roles authorization
If you store role information in Windows Groups, consider using the WCF PrincipalPermissionAttribute class for roles authorization
If you need to authorize access to WCF operations, use declarative authorization
If you need to perform fine-grained authorization based on business logic, use imperative authorization

Binding

If you need to support clients over the internet, consider using wsHttpBinding.
If you need to expose your WCF service to legacy clients as an ASMX web service, use basicHttpBinding
If you need to support remote WCF clients within an intranet, consider using netTcpBinding.
If you need to support local WCF clients, consider using netNamedPipeBinding.
If you need to support disconnected queued calls, use netMsmqBinding.
If you need to support bidirectional communication between WCF Client and WCF service, use wsDualHttpBinding.

Configuration Management

Use Replay detection to protect against message replay attacks
If you host your service in a Windows service, expose a metadata exchange (mex) binding
If you don’t want to expose your WSDL, turn off HttpGetEnabled and metadata exchange (mex)
Manage bindings and endpoints in config not code
Associate names with the service configuration when you create service behavior, endpoint behavior, and binding configuration
Encrypt configuration sections that contain sensitive data

Exception Management

Use structured exception handling
Do not divulge exception details to clients in production
Use a fault contract to return error information to clients
Use a global exception handler to catch unhandled exceptions

Hosting

If you are hosting your service in a Windows Service, use a least privileged custom domain account
If you are hosting your service in IIS, use a least privileged service account
Use IIS to host your service unless you need to use a transport that IIS does not support

Impersonation and Delegation

Know the impersonation options
If you have to flow the original caller, use constrained delegation
Consider LogonUser when you need to impersonate but you don’t have trusted delegation
Consider S4U when you need a Windows token and you don’t have the original caller’s credentials
Use programmatic impersonation to impersonate based on business logic
When impersonating programmatically be sure to revert to original context
Only impersonate on operations that require it
Use OperationBehavior to impersonate declaratively

Input/Data Validation

If you need to validate parameters, use parameter inspectors
If your service has operations that accept message or data contracts, use schemas to validate your messages
If you need to do schema validation, use message inspectors
Validate operation parameters for length, range, format and type
Validate parameter input on the server
Validate service responses on the client
Do not rely on client-side validation
Avoid user-supplied file name and path input
Do not echo untrusted input

Proxy Considerations

Publish your metadata over HTTPS to protect your clients from proxy spoofing
If you turn off mutual authentication, be aware of service spoofing

Deployment considerations

Do not use temporary certificates in production
If you are using a custom domain account in the identity pool for your WCF application, create an SPN for Kerberos to authenticate the client.
If you are using a custom service account and need to use trusted for delegation, create an SPN
If you are hosting your service in a Windows Service, using a custom domain identity, and ASP.NET needs to use constrained trusted for delegation when calling the service, create an SPN
Use IIS to host your service unless you need to use a transport that IIS does not support
Use a least privileged account to run your WCF service
Protect sensitive data in your configuration files

My Related Posts

"

VIA : J.D. Meier's Blog

.NET 3.5 Enhancements Training Kit released

HosamKamel — Thu, 17 Apr 2008 07:18:25 GMT

There are some great enhancements coming to .NET 3.5 with the SP1 release scheduled for later this year. If you'd like to get started with these new enhancements early, and want some great training on them this is the way to do it. All you need to do is download the kit from here: http://go.microsoft.com/?linkid=8719735

For more information check out Jonathan Carter's blog post on the Training Kit.

VIA : US ISV Developer Evangelism Team