Archives

Archives / 2003 / November
  • Whidbey Security Flaw (MembershipUser)

    Revisiting the MembershipUser class, there is something that has perplexed me since day one. Why is there not a UserID associated with it? The simpleton might respond, “but is has a Username property and those are gaurenteed to be unique!” To which I would respond, “yes, until 'jsmith' is fired then another 'jsmith' comes along, you add him to the DB, and now any tables that referenced his username have all of the old 'jsmith''s data.” Of course, some of this can be solved by adding events to the base Membership providers (such as “UserDeleted”), so that you can actually remove user data from the DB if someone deletes them (which should probably happen anyway...), but that requires the user handling those events. If we want things “secure by default,” the solution is to give a proper ID in the first place that will continue to be unique (under AD, you can get the “objectSid” prop, in SQL it will most likely be an identity field or GUID).

  • Flex vs. Avalon

    I've had Flex (Royal) on my machine for quite some time and was able to talk with the product team during the alphas. Now that Macromedia has publically announced a lot of details around MXML and Flex, I can finally say a few things that have been on my mind ever since my sneak peak of Royal.

  • Use Sql Server as Your Indexing Engine

    I didn't realize this until today, but not only does SQL provide the great full text search capabilities everyone knows and loves, it can also index binary content (.doc, .xls), etc. without much extra work on your part.

  • Whidbey Design Flaws (Part 2)

    Rob Howard writes responses to my criticism of the web Security namespace, noting that they had much of this discussion internally before deciding on the final outcome.

  • Whidbey Goes To Far?

    Why is it that Microsoft can't seem to call users “users” and groups “groups?” Role based security is great and all, but how many people outside of the framework team actually call groups “roles?” I guess User wasn't short enough either, because someone thought it had to be called a “MembershipUser” instead.

  • ProGamers

    Korea is an interesting place... especially if you play StarCraft. It is unreal. These guys have like $60,000 a year (USD) salaries in Korea to play StarCraft on TV. It is like football out there (there are 50x as many StarCraft players in Korea as in the rest of the world combined).

  • Ellison on MS

    “...I totally agree with Steve, Microsoft's software is rarely first rate. They never, ever innovate, but —they're pretty good copiers...So what's Microsoft's single greatest innovation? Take your time. —It's a trick question. There aren't any. All that money Microsoft spends on research; what have they got to show for it? Nothing!” [1]

  • Mono to Implement Avalon/Indigo?

    The roadmap for mono dev seems to imply that they are going to try to implement Avalon (XAML and everything) and Indigo. Sounds to me like pretty risky business, as these components are seem to be more OS features, which just happen to be written on top of .NET, than actual .NET Framework features. If they do get Avalon up and running with Indigo on top of Linux, I would imagine that MS might not continue to be so friendly to them...

  • Conspiracy Theory

    “Hmm.. Now this recent blog makes sense: Microsoft employee was fired after posting pictures of Apple G5 computers been delivered to Microsoft .. hehe. Mabe they are allready testing their new Xbox 2 platform on the G5's *wink*” [1]

  • PowerPC + Virtual PC = XBOX 2.0

    “Microsoft's next-generation Xbox will ditch its Intel chip in favor of the same kind of chip used in Apple's Macs -- an IBM PowerPC processor -- IBM and Microsoft announced on Monday.

  • The GPU: A Modern Math Co-Processor?

    Lots of talk lately about exploiting the GPU and using up all that raw power that idles almost all day long. Microsoft wants to eat up those cycles with flashy graphics, these guys have a different idea.

  • PDC DVDs are Out

    “Didn't have time to be in all six tracks at the same time? Not able to attend the PDC this year? Then take the PDC home with you! Take advantage of the opportunity to purchase the official Microsoft PDC 2003 Conference DVD available for $499.00 (USD). PDC attendees will receive a discounted attendee price of $199.00 (USD). This DVD set will contain streaming media files and presentation slides from the breakout presentations, lunch sessions and both the Security and Architecture Symposiums. Note that Pre-conference sessions, Hands-on Labs and Keynote/General Session presentations are not included.”