I worked in Java for a number of years at Nike, writing an order management application that would run on four platforms. We used to joke that we"d "write once, debug everywhere." Now, this was the early days of Java, but the thing was, every form and control was "owner drawn." That meant that a button looked the same everywhere because it wasn"t a real button as far as the operating system was concerned. It was a picture of a button. We used to use Spy++ and different Windows inspector programs to explore our applications and they could never see a Java program"s controls. This meant that the app pretty much worked everywhere, but the app always LOOKED like a Java App. They didn"t integrated with the underlying platform.

With MVVM (Model, View, View-Model) patterns, and techniques like the Universal apps work on Windows Phone 8.1 and Windows 8.1, code sharing can get up into the high 90% for some kinds of apps. However, even for simple apps you"ve still got to create a custom native view for each platform. This is desirable in many cases, but for some app it"s just boring, error prone, and tedious.

Xamarin announced Xamarin.Forms today which (in my words) effectively abstracts away native controls to a higher conceptual level. This, to my old eyes, is very similar to the way I wrote code in Java back in the day - it was all done in a fluent code-behind with layouts and flows. You create a control tree.

"Xamarin.Forms is a new library that enables you to build native UIs for iOS, Android and Windows Phone from a single, shared C# codebase. It provides more than 40 cross-platform controls and layouts which are mapped to native controls at runtime, which means that your user interfaces are fully native."

What"s interesting about this, to me, is that these "control/concepts" (my term) are coded at a high level but rendered as their native counterparts. So a "tab" in my code is expressed in its most specific and native counterpart on the mobile device, rather than as a generic tab control as in my Java example. Let"s see an example.

My buddy from Xamarin, James Montemagno, a fellow Chipotle lover, put together the ultimate cross-platform Hanselman application in a caffeinated late night hack to illustrate a few points for me. This little app is written in C# and runs natively on Windows Phone, Android, and iOS. It aggregates my blog and my tweets.

Here is the menu that switches between views:

And the code that creates it. I"ve simplified a little for clarity, but the idea is all MVVM:

public HomeMasterView(HomeViewModel viewModel){ this.Icon = "slideout.png"; BindingContext = viewModel; var layout = new StackLayout { Spacing = 0 }; var label = new ContentView { Padding = new Thickness(10, 36, 0, 5), BackgroundColor = Color.Transparent, Content = new Label { Text = "MENU", Font = Font.SystemFontOfSize (NamedSize.Medium) } }; layout.Children.Add(label); var listView = new ListView (); var cell = new DataTemplate(typeof(ListImageCell)); cell.SetBinding (TextCell.TextProperty, HomeViewModel.TitlePropertyName); cell.SetBinding (ImageCell.ImageSourceProperty, "Icon"); listView.ItemTemplate = cell; listView.ItemsSource = viewModel.MenuItems;
//SNIP

 listView.SelectedItem = viewModel.MenuItems[0]; layout.Children.Add(listView); Content = layout;}

Note a few things here. See the ListImageCell? He"s subclassed ImageCell, which is a TextCell with an Image, and setup data binding for the text and the icon. There"s recognition that every platform will have text and an icon, but the resources will be different on each. That"s why the blog and Twitter icons are unique to each platform. The concepts are shared and the implementation is native and looks native.

That"s the UI side, on the logic side all the code that loads the RSS feed and Tweets is shared across all three platforms. It can use async and await for non-blocking I/O and in the Twitter example, it uses LinqToTwitter as a PCL (Portable Class Library) which is cool. For RSS parsing, it"s using Linq to XML.

private async Task ExecuteLoadItemsCommand(){ if (IsBusy) return; IsBusy = true; try{ var httpClient = new HttpClient(); var feed = "http://feeds.hanselman.com/ScottHanselman"; var responseString = await httpClient.GetStringAsync(feed); FeedItems.Clear(); var items = await ParseFeed(responseString); foreach (var item in items) { FeedItems.Add(item); } } catch (Exception ex) { var page = new ContentPage(); var result = page.DisplayAlert ("Error", "Unable to load blog.", "OK", null); } IsBusy = false;}

And ParseFeed:

private async Task> ParseFeed(string rss){ return await Task.Run(() => { var xdoc = XDocument.Parse(rss); var id = 0; return (from item in xdoc.Descendants("item") select new FeedItem { Title = (string)item.Element("title"), Description = (string)item.Element("description"), Link = (string)item.Element("link"), PublishDate = (string)item.Element("pubDate"), Category = (string)item.Element("category"), Id = id++ }).ToList(); });}

Again, all shared. When it comes time to output the data in a List on Windows Phone, Android, and iPhone, it looks awesome (read: native) on every platform without  having to actually do anything platform specific. The controls look native because they are native. Xamarin.Forms controls are a wrapper on native controls, they aren"t new controls themselves.

Here"s BlogView. Things like ActivityIndicator are from Xamarin.Forms, and it expresses itself as a native control.

public BlogView (){ BindingContext = new BlogFeedViewModel (); var refresh = new ToolbarItem { Command = ViewModel.LoadItemsCommand, Icon = "refresh.png", Name = "refresh", Priority = 0 }; ToolbarItems.Add (refresh); var stack = new StackLayout { Orientation = StackOrientation.Vertical, Padding = new Thickness(0, 8, 0, 8) }; var activity = new ActivityIndicator { Color = Helpers.Color.DarkBlue.ToFormsColor(), IsEnabled = true }; activity.SetBinding (ActivityIndicator.IsVisibleProperty, "IsBusy"); activity.SetBinding (ActivityIndicator.IsRunningProperty, "IsBusy"); stack.Children.Add (activity); var listView = new ListView (); listView.ItemsSource = ViewModel.FeedItems; var cell = new DataTemplate(typeof(ListTextCell)); cell.SetBinding (TextCell.TextProperty, "Title"); cell.SetBinding (TextCell.DetailProperty, "PublishDate"); cell.SetValue(TextCell.StyleProperty, TextCellStyle.Vertical); listView.ItemTapped += (sender, args) => { if(listView.SelectedItem == null) return; this.Navigation.PushAsync(new BlogDetailsView(listView.SelectedItem as FeedItem)); listView.SelectedItem = null; }; listView.ItemTemplate = cell; stack.Children.Add (listView); Content = stack;}

Xamarin Forms is a very clever and one might say, elegant, solution to the Write Once, Run Anywhere, AND Don"t Suck problem. What"s nice about this is that you can care about the underlying platform when you want to, and ignore it when you don"t. A solution that HIDES the native platform isn"t native then, is it? That"d be a lowest common denominator solution. This appears to be hiding the tedious and repetitive bits of cross-platform multi-device programming.

 

There"s more on Xamarin and Xamarin Forms at http://xamarin.com/forms and sample code here. Check out the code for the Hanselman App(s) at https://github.com/jamesmontemagno/Hanselman.Forms.

SOURCE: http://www.hanselman.com/blog/XamarinFormsWriteOnceRunEverywhereANDBeNative.aspx

Much has been written and much will be written about the Windows 10 announcement.

Windows 10, because 7 8 9.

— Scott Hanselman (@shanselman) September 30, 2014

I"m pretty stoked, and am playing with the Windows 10 Technical Preview now. I can see that there"s lots of new enhancements to the shell, the Start Menu/ Screen, how Universal apps work, and so much more. But, let"s focus on the "other shell." The console!

The console (conhost) that cmd.exe (often incorrectly but colloquially called the DOS Prompt) and PowerShell live within hasn"t had much love in the last several years, IMHO. But then, suddenly, on stage at the Windows 10 announce we"ve got a VP showing folks that Ctrl-V (paste) works in the command prompt. Why would he do such a crazy thing?

remember when microsoft demoed the command prompt in windows on a stage in 2014

— spooky dan seifert (@dcseifert) September 30, 2014

Well, from what I can tell looking at the Preview, there"s a LOT of cool Console goodness coming in Windows 10.

Here"s a list of hotkeys in the Windows 10 Technical Preview console. This is just hotkeys! Be sure to explore the Properties dialog as well, resize, word wrapping, and more.

Text selection keys

These combinations interoperate with the mouse so you can start selecting with the mouse and continue with one of these commands, or vice versa. 

Selection Key Combination	Description
SHIFT + LEFT ARROW	Moves the cursor to the left one character, extending the selection.
SHIFT + RIGHT ARROW	Moves the cursor to the right one character, extending the selection.
SHIFT + UP ARROW	Selects text up line by line starting from the location of the insertion point.
SHIFT + DOWN ARROW	Extends text selection down one line, starting at the location of the insertion point.
SHIFT + END	If cursor is in current line being edited * First time extends selection to the last character in the input line. * Second consecutive press extends selection to the right margin. Else Selects text from the insertion point to the right margin.
SHIFT + HOME	If cursor is in current line being edited * First time extends selection to the character immediately after the command prompt. * Second consecutive press extends selection to the left margin. Else Extends selection to the left margin.
SHIFT + PAGE DOWN	Extends selection down one screen.
SHIFT + PAGE UP	Extends selection up one screen.
CTRL + SHIFT + RIGHT ARROW	Extends the selection one word to the right.
CTRL + SHIFT + LEFT ARROW	Extends the selection one word to the left.
CTRL + SHIFT + HOME	Extend selection to the beginning of the screen buffer.
CTRL + SHIFT + END	Extend selection to the end of the screen buffer.
CTRL + A	If cursor is in current line being edited (from first typed char to last type char) and line is not empty and any selection cursor is also within the line being edited Selects all text after the prompt.  (phase 1) Else Selects the entire buffer.  (phase 2)

Extra Fun with CTRL + A

CTRL + A behavior is interesting. Regardless of the state of mark mode and quick edit mode, one of two things should happen. Either the entire buffer is selected, or (only in a single case) "2-Phase select" starts.  2-Phase select is the process where the first CTRL-A selects the characters to the right of the edit line prompt, and the second press selects the entire buffer.

Editing keys

As I mentioned above you can copy and paste text with the keyboard. When copying text, you might worry that CTRL + C has always been the BREAK command. This is a nice touch, it will still send the break signal to the running application when no text is selected. The first CTRL-C copies the text and clears the selection, and the second one signals the break. Nice attention to detail, IMHO.

Editing Key Combination	Description
CTRL + V	Paste text into the command line.
SHIFT + INS	Paste text into the command line.
CTRL + C	Copy selected text to the clipboard.
CTRL + INS	Copy selected text to the clipboard.

Mark mode keys

These keys function in mark mode. You can enter this mode by right-clicking anywhere in the console title bar and choosing Edit->Mark from the context menu as before, or via the new shortcut combination, CTRL-M. In the original console, mark mode resulted in block mode text selection. While in mark mode, you can hold down the ALT key at the start of a text selection command to use block mode in the new console. The selection key combinations above are all available in mark mode. CTRL + SHIFT + ARROW operations select by character and not by word while in mark mode.

Mark Mode Key Combination	Description
CTRL + M	Enter "Mark Mode" to move cursor within window.
ALT	In conjunction with one of the selection key combinations, begins selection in block mode.
ARROW KEYS	Move cursor in the direction specified.
PAGE KEYS	Move cursor by one page in the direction specified.
CTRL + HOME	Move cursor to beginning of buffer.
CTRL + END	Move cursor to end of buffer.

History navigation keys

Navigation  Key Combination	Description
CTRL + UP ARROW	Moves up one line in the output history.
CTRL + DOWN ARROW	Moves down one line in the output history.
CTRL + PAGE UP	Moves up one page in the output history.
CTRL + PAGE DOWN	Moves down one page in the output history.

Other keys

Other Key Combination	Description
CTRL + F	Opens "Find" in console dialog.
ALT + F4	Close the console window, of course!

If you are like me and also love the console and want it to get even better, head over to the Windows Command Prompt Uservoice and be heard!

SOURCE: http://www.hanselman.com/blog/Windows10GetsAFreshCommandPromptAndLotsOfHotkeys.aspx

I had an interesting chat recently at a conference in the "hallway track." The hallway track is all the great conversations that happen in the hallway between sessions.

What drives your development processes? Are you a TDD house, where your tests drive development? Or, perhaps there"s a chief architect who isn"t a very nice person. We call this ADD - Asshole Driven Development. However, this chat was about FDD - Fear Driven Development.

Organizational Fear

Organization fear can have developers worried about making mistakes, breaking the build, or causing bugs that the organization increases focus on making paper, creating excessive process, and effectively standing in the way of writing code.

This "analysis paralysis" slows the entire project down. Every one is so afraid of the process that forward motion stops. There"s a great post called "10 ways to lose a team" that covers many negative behaviors that can affect a team. Things like

• Forbidding one-on-one meetings
• Don"t share information
• Implying that everyone can be replaced
• Micromanaging

All of these behaviors increase ambient fear and can cause a cloud of anxiety to loom over the organization.

Losing Your Job Fear

Other kind of Fear Driven Development is when an organization tries to get developers to stay far too late, work unreasonably hard, by implying that they"ll lose their job at the sign of any problems with the project. Threatening jobs will never create a more productive team. It only perpetuates negative feelings and will always lead to people quitting. This also can cause management to believe that heroic effort is a common and acceptable part of the software development. An occasional "work push" is one thing, but if EVERY RELEASE cycle means a heroic effort at the cost of your personal relationships, you"ve got problems.

Fear of Changing Code

Another kind of Fear Driven Development is when your development organization (or your entire organization) is afraid of the code. Perhaps the code is older (legacy code) but more likely it"s just not fully understood. It mostly works, but folks are afraid that a small change to the code could cost unpredictable side-effects. Fear of bug regressions - a closed/fixed bug coming back to life also stresses developers out.

Can you think of other flavors of Fear Driven Development?

* Photo by Stacy Brunner, used under Creative Commons

---

Sponsor: Many thanks to Aspose for sponsoring the blog feed this week! Aspose.Total for .NET has all the APIs you need to create, manipulate and convert Microsoft Office documents and a host of other file formats in your applications. Curious? Start a free trial today.

SOURCE: http://www.hanselman.com/blog/FearDrivenDevelopmentFDD.aspx

Most folks learn how to use Task Manager pretty quickly. We"ve all been on the phone with non-technical-relative and ask them to open up Task Manager.

As we move from user to technical-user we are introduced to SysInternals tools and perhaps Process Monitor for finding out what"s happening to a disk. However, I find that for quick questions that using Resource Monitor is faster to access and the information is easier to interpret.

You can bring Task Manager up, of course, by right clicking the Taskbar and clicking Task Manager. Or, hit Ctrl-Alt-ESC as a hotkey for Task Manager.

From Task Manager, you may never have noticed the Open Resource Monitor link at the bottom of the Performance tab.

Click that and open up a whole new insight into what"s going on.

Disk

This is all great stuff but I find myself exploring the Disk tab the most.

Remember to sort by Read or Write bytes/sec. I often sort by Total and often find things like DropBox in there.

CPU and the CPU usage of Services

Task Manager is great but it doesn"t easily show how much CPU is being used by a Service. Resource Monitor not only lets you easily Filter processes with a checkbox, but you can also sort services by CPU usage.

On the CPU tab, is an Associated Handles pane. If Resource Monitor is a well-kept secret, then Associated Handles is a secret within a secret. You can search across all processes for an open file name (or any handle), as well as filter by Process or Service.

Network Activity

The Network Activity tab is super useful and jam-packed with information. It makes it easy to find a process from a port or TCP connection.

You have this tool and all these views now, and I suspect you might not be using it to the fullest. Perhaps you pull from a number of smaller applets or shareware utilities to pull it all together.

Once I reminded myself that Resource Monitor could be launched directly from the Task Manager (an app that I have open often a lot already) I started using it even more. I may just pin it to the Taskbar!

SOURCE: http://www.hanselman.com/blog/YouArentUsingResourceMonitorEnough.aspx

About a year ago we thought it would be a good idea to do a talk on "What not to do in ASP.NET?" - basically an anti-patterns talks. We kept seeing folks falling into the same traps and wanted to be prescriptive as there"s aspects to ASP.NET that are 10 years old and don"t apply to today"s internet, but there are also new aspects to ASP.NET that are only a year old, and perhaps haven"t soaked into the zeitgeist quite yet.

Damian Edwards gave his version of this talk at NDC 2013 and you can watch the video here if you like, it"s very entertaining.

We took the information we gathered from people like Damian, Levi Broderick and others, and Tom FitzMacken put together a whitepaper on the topic. It"s not complete, but it covers some of the most common "gotchas" folks run into.

Here are the areas we call out in the whitepaper so far, with highlights below from me.

• Standards Compliance
  • Control Adapters - Control adapters were a good idea in .NET 2, but it"s best to use solid adaptive CSS and HTML techniques today.
  • Style Properties on Controls - Set CSS classes yourself, don"t use inline styles.
  • Page and Control Callbacks - Page Callbacks pre-date standard AJAX techniques, so today, stick with SignalR, Web API, and JavaScript.
  • Browser Capability Detection - Check for features, not for browsers whenever possible.
• Security
  • Request Validation - While Request Validation is useful, it"s not focused and it doesn"t know exactly what you app is doing. Be smart and validate inputs with the full knowledge of what your app is trying to accomplish. Don"t trust user input.
  • Cookieless Forms Authentication and Session - Don"t pass anything auth related in the query string. Cookieless auth will never be secure. Don"t do it.
  • EnableViewStateMac - This should never be false. Ever.
  • Medium Trust - Medium trust isn"t a security boundary you should count on. Put apps in separate app pools.
  • - Don"t disable security patches with appSettings.
  • UrlPathEncode - This doesn"t do what you think it does. Use UrlEncode. This method was very specific, poorly named, and is now totally obsolete.
• Reliability and Performance
  • PreSendRequestHeaders and PreSendRequestContext - Leave these alone making managed modules. These can be used with native modules, but not IHttpModules.
  • Asynchronous Page Events with Web Forms - Use Page.RegisterAsyncTask instead.
  • Fire-and-Forget Work - Avoid using ThreadPool.QueueUserWorkItem as your app pool could disappear at any time. Move this work outside or use WebBackgrounder if you must.
  • Request Entity Body - Stay out of Request.Form and Request.InputStream before your handler"s execute event. It may not be ready to go.
  • Response.Redirect and Response.End - Be conscious of Thread.Aborts that will happen when you redirect.
  • EnableViewState and ViewStateMode - There"s no need to hate on ViewState. Turn it off everywhere, then turn it on only for the individual controls that need it.
  • SqlMembershipProvider - Consider using ASP.NET User Providers, or better yet, the new ASP.NET Identity system.
  • Long Running Requests (>110 seconds) - ASP.NET isn"t meant to handle long running requests that are a minute (or two) long. Use WebSockets or SignalR for connected clients, and use asynchronous I/O operations.

I hope this helps someone out!

---

Sponsor: Big Thanks to Aspose for sponsoring the blog this week! Aspose.Total for .NET has all the APIs you need to create, manipulate and convert Microsoft Office documents and a host of other file formats in your applications. Curious? Start a free trial today.

SOURCE: http://www.hanselman.com/blog/ChecklistWhatNOTToDoInASPNET.aspx

There"s an ancient cliché that drives a lot of my thinking about personal productivity. "Excessive busy-ness is a common form of laziness."

Busy-ness in the Tibetan tradition is considered the most extreme form of laziness. Because when you are busy you can turn your brain off. You’re on the treadmill. The only  intelligence comes in the morning when you make your To Do list and you get rid of all the possible space that could happen in your day. - Elephant Journal, 2008

The Tibetan term lelo, as I understand it, begins to describe this kind of laziness.

Kausidya (Sanskrit; Tibetan Wylie: le lo) is a Buddhist term translated as "laziness" or "spiritual sloth".

Alan Wallace explains that kausidya (lelo in Tibetan) refers to a very specific type of laziness, that is concerned only with virtuous activity. Wallace explains from Wikipedia:

[...]lelo in Tibetan, is often translated as ‘laziness,’ but it is much more specific. If a person is working sixteen hours a day, hellbent on earning a whole lot of money with absolutely no concern for virtue, from a Buddhist perspective you could say that person is subject to lelo. A workaholic is clearly not lazy, but such a person is seen as lelo in the sense of being completely lethargic and slothful with regard to the cultivation of virtue and purification of the mind. Our translation of this term is ‘spiritual sloth,’ which we have taken from the Christian tradition, where it is very comparable to the Buddhist notion.

I"m not saying you"re lazy so don"t get mad quite yet. I"m saying that using "I"m too busy" as an excuse or a reason to not do something important to you, then you might want to give your situation a closer look. I"m saying that sometimes we are busy with work, but not the kind of work we should be busy with.

Sakyong Mipham states: "Speediness is laziness when we use it as a way to avoid working with our minds."

Of course, there"s busy people who are literally on fire and being chased by ninjas, I"ll give them a pass. But when someone says "I"m too busy" perhaps they are letting you know they are too important to talk to you, or they are just using it as an excuse to not engage. Often I"ve said in the past that "I"m busy" when I really mean "I"m not really that into your idea to take the time to think deeply about it."

So when we say "being busy is a form of being lazy" we"re saying think about what"s important, and think about the work you"re doing. Is it moving the ball forward? Is it moving YOUR BALL forward. The Ball that you care about?

I have an hour set aside once a week that"s for a meeting. The meeting is with myself. No one else comes to this meeting but me. I think about what I"m doing, where I"m going, and what I need to be working on. I use this meeting to think about the business and busyness of my previous week. I think about what busy work I did that was a waste of time, and try to setup myself up for success in the coming week.

My parents and brother are convinced that I"m too busy to hang out or have lunch. I constantly hear "Well, we didn"t want to bother you." I"m never too busy for them. Time can be made. It"s amazing how quickly a day of meetings (or a half-day) can be cancelled or moved. Days can be cleared and time can be made.

It"s easy to get caught up in the chaos of business. It"s fun to play Tetris with your Outlook calendar. It"s satisfying to pack those productive meetings in and feel important and urgently needed. It"s cathartic to delete email and think that getting rid of that email is moving my life forward, but often it"s not. Often I"m just on a treadmill, running to keep up. I know this treadmill and my inertia keeps me going.

The hard work is to consciously step off the treadmill, step away, turn around and look at it. What can be removed? What can be refined? In what ways have we taught our bosses or co-workers how to treat us and our time?

I was in Egypt once and the hosts wanted to take me to the Sphinx, but I didn"t want to miss a weekend with my sons. They may have thought me rude, but it was about consciously choosing one priority over another. I knew my time and my priorities and made a conscious choice on how I was going to spend it.

In what way are you buying into the idea of being always busy? What are you doing to find balance?

---

Sponsor: Thanks to friends at RayGun.io. I use their product and LOVE IT. Get notified of your software’s bugs as they happen! Raygun.io has error tracking solutions for every major programming language and platform - Start a free trial in under a minute!

SOURCE: http://www.hanselman.com/blog/PersonalProductivityBusinessVsBusynessVsLaziness.aspx

There"s few things that get me too riled up when it comes to advice. I love hearing about other people"s lives and their life systems. From the mundane and familiar, like how they pack their kids lunches, how they manage their finances, or how they manage their email.

The only thing to do with good advice is to pass it on. It is never of any use to oneself. - Oscar Wilde

We are an amalgamation of all the advice we"ve ever been given. The first 18 years of my life I was trapped in my parents" house and subjected to their "advice." Most of which turned out to be spot on. I am currently forcing my children to take my advice until their brains full form (which I suspect will happen in about 25 years).

A word to the wise ain"t necessary - it"s the stupid ones that need the advice. - Bill Cosby

I did a post yesterday called "Don"t Check Your Email in the Morning." It"s not that controversial, I think. However, it"s been characterized as "The singular most life-changing productivity tip I"ve received" as well as "Simply terrible advice."

Come on. This is simply an issue of self-reflection. Look at your personal habits, your routine, and how you go about your day. Do you go about your workday on auto-pilot, or with a sense of intentionality?

Don"t check email in the morning is a rule of thumb. The essential point is "Don"t get caught up in the minutiae of unimportant morning email checking if you"re unknowingly using email checking as an way to procrastinate."

Maybe checking email every 5 min works for you. Perhaps that morning quick email sweet is essential to your business. Hey, more power to you. You check email 365 days a year. I wonder what would happen if you didn"t check it in the morning for a day? Might be useful advice. Totally might not. You"ll never know unless you try.

I like trying on shoes. But if the shoe pinches, I don"t wear it.

Consider not checking your email in the morning, if you think it might help you. Enjoy the comments.

Related Links

• The Three Most Important Outlook Rules for Processing Mail
• Photo by Ben Grey used under CC

---

Sponsor: Many thanks to Aspose for sponsoring the blog feed this week! Aspose.Total for .NET has all the APIs you need to create, manipulate and convert Microsoft Office documents and a host of other file formats in your applications. Curious? Start a free trial today.

SOURCE: http://www.hanselman.com/blog/SimplyTerribleAdviceIfTheShoePinchesDontWearIt.aspx

You know how we"re always telling out non-technical non-gender-specific spouses and parents to be safe and careful online? You know how we teach non-technical friends about the little lock in the browser and making sure that their bank"s little lock turned green?

HTTPS & SSL doesn"t mean "trust this." It means "this is private." You may be having a private conversation with Satan.

— Scott Hanselman (@shanselman) April 4, 2012

Well, we know that HTTPS and SSL don"t imply trust, they imply (some) privacy. But we have some cues, at least, and after many years while a good trustable UI isn"t there, at least web browsers TRY to expose information for technical security decisions. Plus, bad guys can"t spell.

But what about mobile apps?

I download a new 99 cent app and perhaps it wants a name and password. What standard UI is there to assure me that the transmission is secure? Do I just assume?

What about my big reliable secure bank? Their banking app is secure, right? If they use SSL, that"s cool, right? Well, are they sure who they are talking too?

OActive Labs researcher Ariel Sanchez tested 40 mobile banking apps from the "top 60 most influential banks in the world."

40% of the audited apps did not validate the authenticity of SSL certificates presented. This makes them susceptible to man-in-the-middle (MiTM) attacks.

Many of the apps (90%) contained several non-SSL links throughout the application. This allows an attacker to intercept the traffic and inject arbitrary JavaScript/HTML code in an attempt to create a fake login prompt or similar scam.

If I use an app to log into another service, what assurance is there that they aren"t storing my password in cleartext? 

It is easy to make mistakes such as storing user data (passwords/usernames) incorrectly on the device, in the vast majority of cases credentials get stored either unencrypted or have been encoded using methods such as base64 encoding (or others) and are rather trivial to reverse,” says Andy Swift, mobile security researcher from penetration testing firm Hut3.

I mean, if Starbucks developers can"t get it right (they stored your password in the clear, on your device) then how can some random Jane or Joe Developer? What about cleartext transmission?

"This mistake extends to sending data too, if developers rely on the device too much it becomes quite easy to forget altogether about the transmission of the data. Such data can be easily extracted and may include authentication tokens, raw authentication data or personal data. At the end of the day if not investigated, the end user has no idea what data the application is accessing and sending to a server somewhere." - Andy Swift

I think that it"s time for operating systems and SDKs to start imposing much more stringent best practices. Perhaps we really do need to move to an HTTPS Everywhere Internet as the Electronic Frontier Foundation suggests.

Transmission security doesn"t mean that bad actors and malware can"t find their way into App Stores, however. Researchers have been able to develop, submit, and have approved bad apps in the iOS App Store. I"m sure other stores have the same problems.

The NSA has a 37 page guide on how to secure your (iOS5) mobile device if you"re an NSA employee, and it mostly consists of two things: Check "secure or SSL" for everything and disable everything else.

What do you think? Should App Stores put locks or certification badges on "secure apps" or apps that have passed a special review? Should a mobile OS impose a sandbox and reject outgoing non-SSL traffic for a certain class of apps? Is it too hard to code up SSL validation checks? "

Whose problem is this? I"m pretty sure it"s not my Dad"s.

---

Sponsor: Big thanks to Red Gate for sponsoring the blog feed this week! Easy release management: Deploy your SQL Server databases in a single, repeatable process with Red Gate’s Deployment Manager. There’s a free Starter edition, so get started now!

SOURCE: http://www.hanselman.com/blog/HowDoWeKnowIfMobileAppsAreSecure.aspx

Last week I was exploring today"s varied choices we have for Automated Browser Testing. There"s headless WebKit "browsers" like PhantomJS and cloud powered multi-browser testing tools like BrowserStack and SauceLabs.

Selenium is kind of the gold standard and offers not only a lot of "drivers" but also a lot of language bindings with which drive a browser. Sometimes browsers update so fast there can be some version incompatibilities with Selenium, but for the most part it works great once you"ve settled in.

One option I"ve been looking at is FluentAutomation. It"s a fluent automation API that supports Selenium as well as WatiN along with all their flavors and drivers. Since Fluient supports Selenium, that means you can use the Selenium ChromeDriver, IEDriver, Remote Web Driver or even the headless PhantomJS. FluentAutomation is on GitHub, of course, as well as on NuGet.

FluentAutomation has great (and growing) documentation and has adopted and interesting fluent style for it"s API.

Now, not everyone likes a "fluent" API so it may take a while to get used to. Often you"ll be doing things over many lines when it"s really just one line, for example, this is one line:

I.Open("http://automation.apphb.com/forms")
 .Select("Motorcycles").From(".liveExample tr select:eq(0)")
 .Select(2).From(".liveExample tr select:eq(1)")
 .Enter(6).In(".liveExample td.quantity input:eq(0)")
 .Expect
 .Text("$197.72").In(".liveExample tr span:eq(1)")
 .Value(6).In(".liveExample td.quantity input:eq(0)");

Notice the method chaining as well as the use of CSS selectors.

FluentAutomation also has the cool concept of a PageObject to take your potentially brittle scripts and give them more structure. PageObjects group your actions, expectations, and assertions and let you reuse code when a page appears in multiple tests.

For example you could have a high level test (this is XUnit, but you can use whatever you want):

public class SampleTest : FluentTest {
 public SampleTest() {
 SeleniumWebDriver.Bootstrap(SeleniumWebDriver.Browser.Chrome);
 }

[Fact]
 public void SearchForFluentAutomation() {
 new BingSearchPage(this)
 .Go()
 .Search("FluentAutomation")
 .FindResultUrl("http://fluent.stirno.com/blog/FluentAutomation-scriptcs/");
 }
}

Then you can have separate PageObjects that have your own public methods specific to that page, as well as assertions you can reuse.

public class BingSearchPage : PageObject {
 public BingSearchPage(FluentTest test) : base(test) {
 Url = "http://bing.com/";
 At = () => I.Expect.Exists(SearchInput);
 }

 public BingSearchResultsPage Search(string searchText) {
 I.Enter(searchText).In(SearchInput);
 I.Press("{ENTER}");
 return this.Switch();
 }

 private const string SearchInput = "input[title="Enter your search term"]";
}

public class BingSearchResultsPage : PageObject {
 public BingSearchResultsPage(FluentTest test) : base(test) {
 At = () => I.Expect.Exists(SearchResultsContainer);
 }

 public BingSearchResultsPage FindResultUrl(string url) {
 I.Expect.Exists(string.Format(ResultUrlLink, url));
 return this;
 }

 private const string SearchResultsContainer = "#b_results";
 private const string ResultUrlLink = "a[href="{0}"]";
}

You don"t have to be all structure and OO if you don"t want. You can just as easily write scripts with FluentAutomation and head in a different direction.

FluentAutomation along with ScriptCS = Automating your Browser with C# Script

I"ve usually used Python with my Selenium scripts. I like being able to just make a text file and start scripting, then run, debug, continue, all from the command line. It feels simple and lightweight. Creating a DLL and running Unit Tests in C# usually comes later, as I can move faster with a "scripting language."

You can do that with ScriptsCS as it gives you project-less C# that effectively is C# as scripting language. Combine this with FluentAutomation and you"ve potentially got the best of both worlds.

To install, first you need the Windows apt-get open source equivalent, the oddly-named and -spelled Chocolatey. Then you get ScriptCS and the packages for FluentAutomation.

• Install Chocolatey - one line installation here
• Run "cinst ScriptCS" from your command line to use Chocolatey to install ScriptCS
• Now, get the ScriptCS script packages for FluentAutomation like this:
  • scriptcs -install FluentAutomation.SeleniumWebDriver
  • scriptcs -install ScriptCs.FluentAutomation

Now, as a quick test, create a folder and put a text file called start.csx in it with just these contents:

var Test = Require()
 .Init()
 .Bootstrap("Chrome")
 .Config(settings => {
 // Easy access to FluentAutomation.Settings values
 settings.DefaultWaitUntilTimeout = TimeSpan.FromSeconds(1);
 });
 
Test.Run("Hello Google", I => {
 I.Open(http://google.com);
});

Notice how there"s no namespace, no classes, no main. It"s just a script, except it"s using C#. You can change the "Chrome" to "IE" or "Firefox" as well, to play around.

Random: I love this Selenium feature, exposed by FluentAutomation...take screenshot!

// Take Screenshot
I.TakeScreenshot("LoginScreen");

If you don"t want ScriptCS, while it can act as a REPL itself, there is also the start of a dedicated FluentAutomation REPL (read–eval–print loop). This is basically a command prompt that lets you explore you app interactively and facilitates building your scripts. You can get the Repl as a Chocolatey package as well and just "cinst FluentAutomation.Repl"

You"ve got LOTS of choices in the world of automated testing. There"s so many choices that there"s just no good excuse. Pick a library, pick a language, and start automating your web app today.

Related Links

• Explorative Web application scripting using scriptcs and FluentAutomation video and blog post.
• FluentAutomation homepage

---

Sponsor: Big thanks to ComponentOne, a division of GrapeCity, for sponsoring the blog this week. Their widely popular .NET control suite, Studio Enterprise contains hundreds of data and UI controls such as grids, charts and reports that offer the functionality, features and support you need for current and future application development. Download your trial today!

SOURCE: http://www.hanselman.com/blog/NuGetPackageOfTheWeekFluentAutomationForAutomatedTestingOfWebApplications.aspx

In 2007 ScottGu"s team announced they were releasing the .NET Framework source code for reference. Just a little later, Microsoft made it possible to step through the .NET Framework Source code while debugging. This was announced to much fanfare, and for a while, it was very cool. It wasn"t "Open Source" but it"s definitely "Source Opened."

However, as time passed, the original Reference Source website for the .NET Framework sucked for a number of reasons, mostly because it wasn"t updated often enough.

Fast forward to today...we"re back and the .NET team is launching the fresh new and updated .NET Reference Source site with a Roslyn-powered index!

The new beta site is at http://referencesource-beta.microsoft.com and it"ll move over to replace the existing http://referencesource.microsoft.com site soon.

It"s easy to browse the code, but if you"d prefer you can also download the .NET Framework source in a ZIP from the download link at the top of the site.

The Roslyn-powered .NET Reference Source browser

There"s some very cool .NET-related stuff happening this year, and you"ll be hearing about it all soon. The new "Roslyn" compiler-as-a-service replacements for the C# and VB compilers have had the "Big Switch" flipped. We"re now getting an amazing totally-rewritten managed compiler that can enable features that weren"t possible when .NET started over a decade ago.

Today there"s a new team working on the .NET Reference Source, and Roslyn let the team generate a complete syntactic and semantic index of the .NET Framework Sources.

From the team: The version of the framework that we currently have indexed is .NET framework version 4.5.1.  If this is something that folks agree is useful, our ongoing commitment towards this feature is to update this every major release i.e. an update for 4.5.2 and so on.  

This is a crucial feature, IMHO, and they are recommitted to making it happen, and most importantly, keeping it fresh and updated. They are also thinking about maybe using the Monaco editor for the site as well.

Be sure to explore the browser and click on everything, as there"s a lot more there than just "search box and results."

Here"s a few cool things you can do with the URLS on the new site that you should explore. I like being able to reference a line number in the URL for tweeting or IM"ing.

• Link to assembly /#System.Core
• Link to file /#mscorlib/system/environment.cs
• Link to line number /#mscorlib/system/environment.cs#56
• Link to a type/member /mscorlib/a.html#1f55292c3174123d (right-click the definition and choose Copy Shortcut)
• Link to search results /#q=Button%20PresentationFramework

There"s also a lot of flexibility in the search:

• Search for any full or partial type, or member name.
• Add any keyword like assembly, type, class, struct to filter the results
• Find projects by path like ndp\fx\src\data
• Find string literals like GUIDs: 03973551-57A1-3900-A2B5-9083E3FF2943

You can also actually click on types directly within the editor and find where they are referenced in the code.

They will switch the beta site at http://referencesource-beta.microsoft.com/ to take over the existing Reference Source site soon. Until then, use the Feedback link on the site and email the team directly! They are listening and actively working on this site.

The next thing the team is working on, and they are very close, is getting .NET Source Stepping (meaning you can just F11 into the .NET source code) to again work reliably when debugging, no matter what patch version you have of the .NET Framework on your local machine. Look for that in a few days on the .NET Team Blog.

BONUS: Community Visual Studio Extension

Here"s an exciting bonus. Community member and fabulous coder Schabse Laks has created a Visual Studio extension for VS2010, 2012, and 2013! This extension sends calls to Go To Definition (or pressing F12 on a symbol) directly to the code online (when it"s .NET Framework code, not yours).

You can download this companion "Ref12" Visual Studio Extension now! Just Goto Definition on any .NET type we have source for and it"ll launch your default browser so you can explore the .NET Framework source yourself! Thanks Schabse!

.NET Reference Source Code Licensing Clarified

Finally, the licensing before was originally the very straightforward Microsoft Reference Source License,  but then started to get other caveats tacked on like "don"t look at this if you aren"t using Windows" until it wasn"t really the MS-RSL at all.

They"ve changed that stuff. They"re back to the straight MS-RSL which is easy to read and clear. This means that folks can now look at this Reference Source and not have to gouge their eyes out afterwards. Which is great!

We all hope you like the new site and the team looks forward to your comments!

---

Sponsor: Big thanks to Red Gate for sponsoring the blog feed this week! Easy release management: Deploy your SQL Server databases in a single, repeatable process with Red Gate’s Deployment Manager. There’s a free Starter edition, so get started now!

SOURCE: http://www.hanselman.com/blog/AnnouncingTheNewRoslynpoweredNETFrameworkReferenceSource.aspx

I used to be slightly obsessed with getting a high "WEI" in Windows. The Windows Experience Index was a number meant to give you an idea of how strong your PC was. The idea would be that you"d go get a game at the store and it would say "WEI 5 or greater" and you"d say, "oh, I have a 6, so this game will run great."

Under Windows 7 the maximum WEI was a 7.9, so I, of course, set off to build a machine that got a perfect 7.9 WEI.

In Windows 8 and 8.1, however, the friendly UI for showing your WEI is gone.

However, you can still get the RAW numbers in Windows 8.1, I"m told from a tipster who emailed me. (Thanks!)

First, run a cmd.exe prompt run "winsat prepop." If it fails to generate much output, try "winsat formal."

Then, open a Powershell command prompt and run "Get-WmiObject -class Win32_WinSAT" and you"ll see all your scores!

Looks like this machine is limited only by the SSD, but otherwise is an 8 class machine! I"m happy to be able to confirm my WEI again!

Does anyone know if Windows 8.1 maxes out at 8.9 or 9.9 WEI? Sound off in the comments!

---

Sponsor: Many thanks to Izenda for sponsoring the blog feed this week. Please do check out their Intuitive Ad Hoc Reporting with Stunning Visualizations - Embed real time dashboards into your ASP.NETapplications for easy, custom reports across all devices. Download a FREE TRIAL of Izenda Today!

SOURCE: http://www.hanselman.com/blog/CalculateYourWEIWindowsExperienceIndexUnderWindows81.aspx

Microsoft just released OneNote for Mac today. They also made OneNote for PC free, which means there"s a free OneNote app on Windows, Windows Phone, iOS, Mac, Android and a really full featured HTML5 web version at http://www.office.com. This is all very cool of course, but I"m interested in the APIs.

Now, to be clear, I have worked for Microsoft for the last few years on ASP.NET and Azure, but I don"t know anyone in the Office team. I am not privy to any secret info and I get most of my news from The Verge, just like you.

But from my perspective, the real story here is that Microsoft has woken up to the power of the API. Some may argue that they"ve always had powerful web APIs, which is true, however the breadth and scope of these APIs and their ubiquity seems to have accelerated in recent years. They are clearer, more open, simpler, and more cross-platform than ever before.

The Azure cloud and the Azure HTML5 Portal where folks manage their apps uses a REST API, and the SDKs to use them - as well as a cross platform nodejs command line application - are on GitHub. If you use the main portal, write your own, or use Visual Studio, it all calls the same open API. Duh.

Exchange has APIs, Microsoft IDs use OAuth, Azure"s Portal has an API and uses it themselves, SharePoint is one giant REST/OData API, Office 365 has been quietly releasing APIs for Mail, Calendar, and Contacts, and even now Lync has a REST Web API now.

Today when the Office team launched OneNote for Mac, they also launched http://dev.onenote.com along with integration partners like Feedly, JotNot, IFTTT, Weave News Reader and more all integrating with their REST API.

The moral of the story here is - if you have no API then you have no story.

Using the OneNote API

There"s even more evidence of a change in thinking inside the big house. It"s clearly of note that the API example in the OneNote API documentation on MSDN used Objective-C. They also link to a OneNote interactive Console at Apigee.

The API appears to be basically RESTful, with a POST of HTML to https://www.onenote.com/api/v1.0/pages creating a new OneNote page in your authenticated notebook.

You authenticate with your Microsoft ID using the SDK, get the token from the SDK object to be used in the authentication header then POST.

What has surprised me is that they have tutorials and samples across all platforms:

• Android - Create an Android capture app - OneNoteServiceSamplesAndroid
• iOS  - … an iOS capture app - OneNoteServiceSamplesiOS
• Windows Phone - …a Windows Phone capture app - OneNoteServiceSamplesWinPhone
• Windows Store - …a Windows Modern UI capture app - OneNoteServiceSamplesWinStore
• REST - Use the apigee.com API console - Open the interactive console

And, heck, the samples are all on GitHub too: https://github.com/OneNoteDev.

It looks like the focus for this initial launch is POST/Create for capture apps, photos, text, clippers, etc, but all the verbs are coming, clearly at the top of their backlog.

I like this direction, and to me, it"s representative of a larger shift to recognize that the world doesn"t always run Windows. I"ve said it before, and I"ll said it again - The Web will always win.

Related Links

• OneNote Dev Blog
• OneNote on StackOverflow
• Office.com

---

Sponsor: Big thanks to Red Gate for sponsoring the blog feed this week. Check out the Free Starter Edition of their release management tool! Deploy your SQL Server databases, .NET apps and services in a single, repeatable process with Red Gate’s Deployment Manager. Get started now with the free Starter Edition.

SOURCE: http://www.hanselman.com/blog/OneNoteAndMicrosoftsQuietAPIRevolution.aspx

I"ve had an iPhone since the 3GS (I have a 5S right now) but I"m always flirting with the Windows Phone. It"s just prettier than my iPhone, but my iPhone has a lot of apps...so I stay with it. Folks tease me at work and at conferences for not using a Windows Phone. I always say "when it"s an awesome phone platform, I"ll use it."

Man, Windows Phone 8.1 is definitely more than "point 1 better." Seriously.

It"s the platform Windows Phone should have been from the beginning. From a general functionality perspective, this 8.1 update brings the Windows Phone (finally) on par with my iPhone 5s, and in some cases, takes it beyond. It"s REALLY tempting now.

There"s a lot of new stuff, but a few things really grabbed my attention that my iPhone doesn"t have yet:

• Notification Center - Finally. Swipe down from the top and get notifications in one place. Just like an iPhone you get quick access buttons for airplane mode, wireless, etc. Even better, those buttons are configurable. I added Internet Sharing to mine. You can also swipe down then press Settings as a fast way to get to the main settings page.
• Transparent Live Tiles - You can use a background image for your whole start screen, and it will show through transparent tiles. It also has a nice parallax effect when scrolling. Check it out in the video below.
• "Show more Tiles" on smaller resolution devices - The 1520 on the right has the 1080p screen, while the 920 is a lower resolution screen. Previously only high-res screens got the extra column of tiles. Now smaller screen devices can choose their start screen size and add LOTS more info to a single screen.
• Pinnable Website Tiles - This one surprised me. I recently added support to my blog for IE11 Pinned Tiles, so you can pin this website to your start screen and get an updated Live Tile showing the latest stories. I talked to the front end developer at The Verge and he added the feature for theverge.com as well. His implementation is REALLY impressive. The surprise was that Windows Phone 8.1 now supports that same technique and I didn"t need to do anything. See on the 920 on the right, at the bottom, that"s a pinned flipped tile showing a story from my blog. Very nice.
• Cortana Voice Assistant - You could say this is the Windows" Siri, but it"s more like Google Now with a personality. The voice recognition happens as you speak as opposed to after the fact, which is nice. You can ask questions like "How old is Oprah" and she (or he) just knows. You can say "Call my wife" and she"ll say "Who is your wife?" then associate a contact with that nomenclature.
• Quiet Hours - I use Do Not Disturb on my iPhone. Quiet Hours takes this a little further with the concept of an "Inner Circle" and a more sophisticated series of configurable rules like "Don"t bother me at night on weekdays unless it"s these three people, and text everyone else back that I"m not answering calls."
• Driving Mode - This was added in a Windows Phone 8 update but I love it. It knows you"re driving because you associate your cars" Bluetooth with it, then it will text folks "I"m driving, I"ll get back to you" if they text you. You can choose to never see the text until you stop. Very cool.
• Keyboard Swiping - It"s built into the main keyboard now, no separate app. The predictive text has gotten better as well.
• Battery Sense - The phone can tell you what apps are eating the battery, and when they are eating it. It"ll show if the battery is being used by apps in the background or in the foreground.

I recorded a video on a real phone (the 1520 above, in fact) and demonstrated a LOT of the new feature. Check it out as part of my Windows 8 YouTube video playlist, or embedded below. I used the Project My Screen app (MSI) and turned it on in Settings on the phone, connected with USB.

If you have a Windows Phone 8 now and want to get the preview of Windows Phone 8.1:

• Go register free at http://appstudio.windowsphone.com.
• Then go to "Windows Phone Preview for Developers" and install the "Preview for Developers" app.
• Go to Settings, then System Update and update your phone. Depending on how up-to-date your phone is, this might take 2-3 visits. One of my phone needed just one update, another needed 3. It"ll take 10-15 min.

If you get the Preview today,your phone will update to the final version automatically, I"m told. Go check it out!

Related Links

• From Concept to Code in 6 hours: Shipping my first Windows Phone App
• Updating my Windows Phone App to Windows Phone 8
• Trying a Nokia Lumia 1020 - A Camera with a Phone Inside
• "I can"t even think about switching phones without these apps." Windows Phone 7, a Nokia Lumia 800 and the Essential Apps

---

Sponsor: Big thanks to Red Gate for sponsoring the feed this week. 24% of database devs don’t use source control. Do you? Database source control is now standard. SQL Source Control is an easy way to start - it links your database to any source control system. Try it free!

SOURCE: http://www.hanselman.com/blog/WindowsPhone81HasMyAttentionNow.aspx

Open Source is hard.

Security is hard

There"s been lots of articles about the recent OpenSSL "Heartbleed" bug. You can spend a day reading all the technical analysis, but one headline that stood out to me was "OpenSSL shows big problem with open source; underfunded, understaffed." A fundamental part of the fabric of The Internet Itself is mostly just one person plus a bunch of volunteers.

"The fascinating, mind-boggling fact here is that you have this critical piece of network infrastructure that really runs a large part of the Internet, and there’s basically one guy working on it full time."

Moreover, we don"t sing contributor"s praises for their hard work and success while their software work, instead we wait until a single line (albeit one of the more important lines) fails to live up to expectations. Darn that free stuff, mostly working, and powering our connected global network.

Open Source is largely a thankless job. Sometimes in the Microsoft .NET community, it feels more futile because it"s often hard to find volunteers. Many folks use the default stuff, or whatever ships with Visual Studio. With Rails or Node, while they have corporate backing, there"s a sense that the projects are community driven. The reality is in-between, but with open source projects built on the Microsoft stack volunteers may say "we"ll just use whatever the ship."

There"s anger around past actions by Microsoft, but as I"ve said publicly before, they"ve come a LONG way. I will keep pushing open source at Microsoft until I think I"m done pushing and can push no more. There"s a seismic shift going on inside. Mistakes get made, but it"s moving in the right direction. Everyone is learning.

Visibility is hard

Jeremy Miller"s team recently stopped active development on the "FubuMVC" open source .NET framework. In his exit blog post, the question of the viability of .NET open source comes up:

"Setting aside the very real question of whether or not OSS in .Net is a viable proposition (it"s largely not, no matter how hoarse Scott Hanselman makes himself trying to say otherwise), FubuMVC failed because we — and probably mostly me because I had the most visibility by far — did not do enough to market ourselves and build community through blog posts, documentation, and conference speaking."

It"s very true that in a large way visibility drives viability for many open source projects. Jeremy"s retrospective is excellent and you should read it.

I think it"s harder to bootstrap a large framework project that is an are alternatives to existing large frameworks because for many, it"s easier to use the default. Frameworks like FubuMVC, OpenRasta, ServiceStack, Nancy and others all "reimagine the default." They are large opinionated (in a the best way) frameworks that challenge the status quo. But it"s much more difficult to cultivate support for a large framework than it is a smaller library like Humanizer or JSON.NET.

Still, without these projects, we"d all still be using the defaults and wouldn"t be exploring new ideas and pushing limits as a community like the FAKE F# build system, or Chocolatey, or Boxstarter.

Microsoft can better support OSS projects not just with licenses and money, but with visibility. I"d propose dedicate Open Source tracks at all Microsoft conferences with speaking slots for open source community members. DotNetConf is a start, but we can go bigger.

Organizing is hard

OWIN is an example of a small, but extremely important project that affects the .NET world that is struggling with organization. Getting it right is going to be important for the future. There"s a small, but influential group of community members that having been trying for months to find middle ground and build consensus around a technical issue.

ASP.NET Web API and SignalR both build on top of an open source project called OWIN (Open Web Interface in .NET) that aims to decouple servers, frameworks, and middleware from each other.

There"s an issue open over on GitHub about what may seems like an obscure but important point about OWIN. The OWIN specification doesn"t include an interface called IAppBuilder, but IAppBuilder is used by default in most Microsoft examples. Can the underlying OWIN framework remain neutral? The issue is a long one, and goes off on a few tangents. It"s a complex problem that perhaps 20 people fully understand.

Scott Koon worked hard on a Governance document for OWIN and hasn"t seen any forward motion. He vented his frustration on Twitter, rightfully so. Under the often-used "Lazy Consensus" technique, if folks are silent or don"t reply in 72 hours, that is effectively consent and can change the direction of a project. Active involvement matters.

The fun part of open source is the pull requests and writing code, but before the code building, there"s the consensus building. Ownership is the most contentious part of this process. Ownership means control; control over direction. The key to finding control and working through ownership issues is by thoroughly understanding everyone"s differing goals and finding a shared vision that the community can rally around, then move forward.

This sausage making process is tedious, messy, but necessary. These discussions are as much a part of OSS as the code is. It takes equal parts patience and pushing.

Getting involved is hard

I get dozens of emails every week that all ask "how can I get involved in open source?" Everyone assumes my answer will be "write code" or "send a pull request," or sometimes, "help write documentation."

In fact, that"s not all you can do. What you can do is read. Absorb. Understand. Be welcoming, inclusive, and kind. Offer thoughtful analysis and ask questions. Avoid hyperbole and inflammatory language. Show code examples when commenting on issues. Be helpful.

Your blog posts are the engine of community, your open source commits, documentation, promotion, samples, talks, gists are important. But getting involved in open source doesn"t always mean "fork a project and send a giant pull request with your worldview." Sometimes it"s the important but unglamorous work of writing a governance document, organizing a conference call, or thoroughly reading a giant Github issue thread before asking a question.

Why do we do this? It"s not for the glamour or the money. It"s because we are Builders. I encourage you all to get involved. There"s lots to be done.

* photo by Sweet Chili Arts, used under CC

---

Sponsor: Big thanks to Novalys for sponsoring the blog feed this week! Check out their security solution thatcombines authentication and user permissions. Secure access to features and data in most applications & architectures (.NET, Java, C++, SaaS, Web SSO, Cloud...). Try Visual Guard for FREE.

SOURCE: http://www.hanselman.com/blog/OpenSourceIsAThanklessJobWeDoItAnyway.aspx

I"m a longtime Kindle fan. Love it. It"s not a tablet, not a computer, my Paperwhite Kindle represents books for me.

I have a first-generation Kindle Paperwhite and use it almost every day. It"s my go-to reading device. I originally gave it a mixed review but the game-changer was the addition of the magnetic cover, specifically the Kindle Paperwhite Leather Cover in Black. The Kindle turns on and off when it opens and closes, which is lovely, but the important point is the thickness it adds to the bezel. For my hands, a Paperwhite is an insubstantial thing that"s too small to hold comfortably. This cover adds just a fraction of an inch all around the Kindle and effectively the cover subsumes the Kindle. The cover melds with the Kindle in a firm and crisp way and you"ll never take it off. It"s perfectly sized, plus protected enough that I throw it in my bag without worry.

I recently came into possession of a second-generation Kindle Paperwhite and didn"t know what to make of it. It"s "one better" right? It"s the new version. It looks the same.

The main improvement they say is a clearer and higher-contrast display. Here are my 1st and 2nd gen Kindles next to each other, which is the Second Generation Paperwhite?

There"s a little glare here but the second gen has a whiter background and darker blacks.

The first gen has a fantastic screen...

But the second gen has darker blacks and crisper text.

The second generation is definitely faster, they say 25% faster. Turning pages is quicker and the screen updates faster. The new updated software also includes a fast "skim" ability so you can move WAY faster around a book to find your place.

They also added GoodReads (a social network for readers) integration directly into the Kindle. This is a fun way to discover new books and see what your friends are reading.

It also includes "Kindle Freetime," a special mode for kids where you can limit the books they see and tracks their reading time, as well as set goals for the number of minutes they read each day.

Upgrade your Kindle Software

Speed and clarity is nice but the most dramatic difference was the software. This new 2nd gen Kindle had a bunch of new software features that my 1st didn"t have. Unacceptable! ;) I checked, and I can get many of these new features by manually upgrading my Kindle"s software.

If you have a Kindle, head over to https://www.amazon.com/kindlesoftwareupdates and get updated. Most Kindles update themselves, but more and more I"m seeing that these updates roll out either slowly, or not at all. My first-gen was many versions behind.

• Kindle Software Update
• Kindle Paperwhite 1st gen Update
• Kindle Paperwhite 2nd gen Update

It"s a basic process, just connect a USB cable and drag the update file into the ROOT (top) of the Kindle Directory. Disconnect and reboot and wait.

Now both my 1st and 2nd gen Kindle Paperwhite"s share the same software features!

Conclusion

It"s not a "must upgrade" but it"s a nice generational step. If you don"t have a Kindle reader, this is a great Kindle. If you"re a fan (as I am) and your partner needs a Kindle, get a new 2nd gen and pass the 1st gen along with updated software. Everyone wins.

Related Links

• Amazon Kindle - Original Review
• Amazon Kindle Paperwhite 3G/Wi-Fi Review
• A year with an Amazon Kindle (and new Kindle Cases)
• Amazon Kindle 2 gets Better Battery Life and Native PDF Support
• Amazon Kindle vs. Amazon Kindle DX - The Final Word
• Reading more than ever: An analysis of four lazy years with an Amazon Kindle and no dead trees

* FYI: I use Amazon affiliate links

---

Sponsor: Big thanks to Novalys for sponsoring the blog feed this week! Check out their security solution thatcombines authentication and user permissions. Secure access to features and data in most applications & architectures (.NET, Java, C++, SaaS, Web SSO, Cloud...). Try Visual Guard for FREE.

SOURCE: http://www.hanselman.com/blog/AmazonKindlePaperwhiteSECONDGENERATIONReviewPlusNewKindleSoftwareUpdate.aspx