More Thoughts on Techies and Modelers

You may recall that Ted recently talked about the distinction between techies and modelers. I then questioned his "technieness" - by his reaction you'd have thought I questioned his parentage and sexuality both. :)

Regardless, Ted now has this to say on the same subject:

The more I come to know people at Microsoft, the more I'm realizing that most of the technical folk at Microsoft are techies--people who keep a careful eye on the underlying details and implementation. This attitude of "performance first" or "scalability first" definitely plays out well in certain scenarios, but can lead to some interesting and perhaps undesireable consequences.

While I'm all for maintainability, in this debate I often come back to a statement that Tim Ewald once made: "Your users will never come to you and maintain that your system isn't object-oriented enough." They will, of course, tell you when it's slow.

I'm not saying that Ted is claiming that OO == maintainable. But I think there's a general perception out there that this is the case. Our notions of "well designed" or "elegant" code have come to encompass the bill of goods that the OO purists sold us in the 1990s. But that's an aesthetic metric, and therefore a subjective one. I ask the question: is there something about OO that is inherently more maintaintable than a well-designed procedural system? I'm not sure there is. And when you combine the performance issues with objects in distributed systems with the fact that everyone gets procedural programming but OO takes like three years to penetrate your brain properly, the picture starts to get even more muddy.

I'm not saying that objects are bad. I'm just saying, they don't equal goodness. And linear programming doesn't equal badness. I'm sure Ted would agree.

Gadgetry

This looks cool and I want one.

The Birthday Problem Calculator

A friend of mine wrote me up on IM the other day, asking how to use a hash algorithm to generate short, unique identifiers out of a longer piece of information. I suggested that she ditch the hash idea and just generate random numbers. It's pretty much the same thing, after all, since she was going to be storing the lookup information in a database anyway.

Her first (and fairly natural) reaction was "What about collisions?" After thinking about it for a second, she remembered that a hash isn't guaranteed to be unique - how can you come up with a one-to-one mapping from all possible four-page documents to a single 32-bit number? - so she had to have the code in place to check for duplicates anyway. But it did raise the question, "How likely is a collision to occur?"

In this article, I explain how we answered that question.

Richard Blewett Joins the Fold

My friend and fellow DevelopMentor instructor Richard Blewett now has a blog. Here's the URL. Here's the RSS.

I've had dozens of conversations with Rich - including this one - but we've never actually met face-to-face, since he lives in the UK and we've never happened to teach together.

Subscribed!

Another Sort of SOAP

Here's what the really hard-core web service zealots play when they're not working: SOAP.

XML Is a Virus

In the beginning, there was the .INI file.  Then, Microsoft created the Registry, and only an idiot would ever store configuration in some text file just lying around on disk.  Then, Microsoft brought us .NET, and .NET brought us .config.  We're back to .INI files, they're just XML .INI files.  And, you can use an XPathNavigator to search the registry.  How weird is that?

Clever post.

The Middle 70%

 Steve Loughran has a great quote on Sam Ruby's blog, in a thread about whether or not SOAP sucks:

You can see the latter on the axis user mail list, where users complain that they are getting a 'connection refused' error, AxisFault 'HttpResponse:404' or 'ClassNotFoundException'and can somebody please help them. These people should not be helped. There is an informal mountaineering rule that you never help incompetents up a mountain to killed higher up, only down, to get out alive. Wannabe SOAP developers should be told to work through Bruce's TIJ book, TCP Illustrated, RFC2516, Hunter's Servlets, Box and Skonnard on XML and then maybe write a first web service.

First of all, I love the analogy. But I have to admit I go back and forth on this one a lot. As a trainer, I run into a lot of developers who probably shouldn't be writing software. At a guess, I'd say it's about 25% of them. They'll never get it. The worst of them actually think they're good. Around 5% are really quite smart - these people will create software worth using.

But that leaves 70%: what do we do with them? It's a real conundrum: systems are getitng larger, more complex, and therefore harder to do right, regardless of what vendors want you to believe. You can't do SOAP right without understanding XML, and surveys of classes find that very few developers claim to understand even XML namespaces. Security? Forget it - few can tell you the difference between signing and encryption.

There are several possibilities:

• 
  
  Yell "screw it!" and gather a team of only the smartest people to build stuff. Obviously, not everyone can do this.


• 
  
  Give up. Go into hotel and restaurant management.


• 
  
  Come up with some new way of doing things that enables the middle 70% to Do Things Right. I know I'm not smart enough to pull this one off.


• 
  
  Go with the old saying, "Educate the able, console the rest".

I think I'm somewhere in the neighborhood of the last one. As a consultant, I try argue strongly for what I feel is the right approach right up to the point where it's obvious that no one is going to change their mind. At that point, I just implement what the client has asked for, hoping that I've eroded their assumptions a little and maybe incrementally improved the product.

Another One Bites the Dust

Chris Sells has joined Microsoft as a full-time employee. Don could barely contain himself. :) It's definitely good news for Microsoft, for Chris, and for anyone that wants to learn about Longhorn over the coming months and years. Congrats!

Dave Winer Is An Idiot

As you might have guessed from the title of this post, I started off writing a big tirade about this. After thinking about it a bit, I decided I'd rather say this:

I have been lucky enough to meet many of the "big names" in our particular corner of the industry. I will admit to being slightly taken aback when my DevelopMentor interview/audition was with Don Box, Chris Sells, Keith Brown, Ted Pattison, and Brent Rector. "I've read these guys' books! I've seen them speak at conferences!"

Having been lucky enough to associate with these sorts of people for the last few years, I've come to realize that they're just people. Duh, of course, but it's one thing to know something, and another to Know it. Anyway, I can tell you right now that they make mistakes. They have lapses in judgement. They take erroneous stances on certain points. At the end of the day, it comes down to this: what is the quality of their work? Not "How famous are they?"

I'm not going to speak to Mr. Winer's overall quality of work - opinions on that are well documented elsewhere. But I will say this: I've disliked Radio almost from the moment I installed it. I strongly suspect that it was responsible for the recent deletion of my entire website. It's low-quality software. So I'm going to make an effort to switch this blog to something that Dave didn't have a hand in. I don't know if I'll get to it this week, but I hope so.

Tao Open GL Library for .NET

I haven't played with it at all, but sellsbrothers.com reports:

New OpenGL binding for .NET from the CsGL people, supporting GL 1.1, GLU 1.3, and GLUT 3.7.6. CLS-compliant, cross-platform, yada, yada.

Interesting - the cross-platform support makes it a much more compelling choice than DirectX for people that want to target Mono. It's still in initial release, and I don't think I'll have time to play with it any time soon, but since I cover DirectX on this blog, I thought it was worth a mention.

Direct3D - Materials Basics

Here's the latest in my Managed Direct3D series. A little exerpt:

I know I said last time in our discussion about textures, that I?d go on to talk about meshes. But I lied.

 

Actually, I made a mistake. What happened was, I started writing about meshes and realized that using meshes and textures together at the same time is a bit much for an introduction. So I decided that we should talk about materials, which will give us a nice gentle way to get started with meshes. After we talk about zbuffers, too, of course.

 

We?ve now talked about two ways to get objects in our scenes to have some color: we can either use a vertex format that has color information, or we can use a texture to warp a bitmap onto a triangle or set of triangles. But it turns out there is at least one more way: we can set up a material.

 

A material is a bunch of global settings that tells the Device, ?Hey, the next time you draw a triangle, I?d like it to look like this.? The settings are captured in a structure of type Material, and are associated with the Device by assigning to its property of the same name. It goes something like this:

I'll Take It

Don thinks his old BMW is too LA. Well, I'm from MN, and I live in DC, but here goes:

Don, I want you to know I'd be more than happy to give your old car a good home. I'll only drive it on weekends, I promise. Just mail me the title and I'll take care of the rest.

Book Idea

I had what I thought was an interesting idea for a book the other day. Since I doubt I'll ever write the darn thing, I'll post it here in case it inspires someone.

Basically, I thought it would be cool to write a list of 10 or 20 or whatever common myths/mistakes. More or less the converse of stuff like Effective COM. Could call it Ineffective Programming or something. It would be things like:

• Creating a one-to-one mapping between database entities and objects is a good idea.


• You should design your application with performance foremost in mind.


• SOAP toolkits should hide XML.


• etc.

I like the idea of making statements that seem reasonable to many people but in fact are a Bad Idea or Just Plain Wrong.

Do-It-Yourself (Not)

So I've been doing a bunch of security work lately. Because of a slightly strange mix of requirements, I wound up spending about a week working on an authentication and key exchange protocol that was halfway between Kerberos and SSL. We've since ditched that effort, which made me happy: inventing our own security made me really nervous. As I was perusing the absolutely excellent Secrets & Lies (by Bruce Schneier) yesterday, I found a quote that was all too appropriate. In it, Schneier is addressing the prevalent but INCREDIBLY STUPID myth that products that don't tell you the details of their security implementation are somehow more secure. (Microsoft has historically been a bad offender in this category, but there are plenty of other examples.)

He says:

The problem can be best illustrated with a story. Suppose your doctor said, "I realize we have antibiotics that are good at treating your kind of infection without harmful side effects, and that decades of research support this treatment. But I'm going to give you a pulverized pretzel instead, because, um, it might work." You'd get a new doctor.

In other words, use what's there.  

Symmetric Encryption/Decryption Example

A friend of mine asked me today how one would go about encrypting something using the Rijndael algorithm (also known as AES) using the .NET framework. I?ve done some crypto work, so I whipped up a quick example for him. It turns out to be pretty much exactly the same as using any other symmetric algorithm like DES. I've posted the code and a brief explanation here.

Free eBooks

I always keep an eBook or two stored on my PocketPC for those times when I'm sitting around waiting for something. Well, I came across the University of Virginia's eBook Library, which is chock full of booky goodness. Now, if you're looking for the latest Stephen King or Tom Clancy, you're not going to find it here - the books are free, so I assume the whole collection is in the public domain. But they've got tons of good stuff, from Aesop to Zogbaum. I'm currently reading Moby Dick, which I can't say I care for too much, but My Bondage and My Freedom was excellent.

Consumer Search

I was looking online for a pair of new monitors - one CRT and one LCD - and a number of other things, when I happened to come across this site. It's an aggregation of reviews from other sites. So they go out and read all the reviews they can find about, say, video cards, and then post their interpretation of the results. I found it really helpful - just exactly the sort of meta-information I needed to figure out what to buy.

I bought three of their recommendations. I'll let you know what I think when the merchandise arrives.

Hi There - Where Are You In From?

Like any good egomaniacal blogger, I check my referrers fairly often. It's interesting to see where people are coming from. For my blog, I get a few referrals from other peoples' blogs, and a lot of traffic from people Googling for information on DirectX - hopefully they like my tutorial series when they wind up here. And yes, I'm still writing it - just a bit busy at the moment.

Anyway, I noticed a few days ago that I'm starting to see a new thing in my referrer list. As you can see for yourself, there are now a number of entries like "Hidden referrer" and "undefined". I have no idea where these are coming from - but then again blogreading software is sprouting like mushrooms, so maybe one of the new ones sends this when someone gets referred to a page.

Really, it's too bad: I give information away for free, and in return I get to find out where you came from. I won't stop writing, but it does make it slightly less interesting for me.

Understanding GC

Ted may well deny being a modeler despite my keen analysis of him, but one thing is for sure: he knows Java and knows how to write about it. (OK, I guess that's two things.) His latest blog entry talks about garbage collection in the JVM...and is totally applicable to the CLR.

Nothing New Under the Sun

So, I was teaching a DevelopMentor class at Rice university, and went out for lunch with one of the professors. He asked me if the license plate on his Corvette meant anything. It said, "Zork". I said, "Of course! I'm not that young." Turns out he was one of the original three developers! My brush with fame. :)

Interestingly in these days of JVMs and CLRs, he told me that Zork used a virtual machine architecture. In fact he wrote the VM, another guy wrote the game engine on the VM, and the third guy wrote the story. Which is how they were able to port it to other platforms easily. It just goes to show you that there's nothing new under the sun.

You can apparently still play Zork in several places online. Here's a downloadable version I found Googling for a few minutes.

Know When Not to Plan to Use XHTML

From The .NET Guy:

I used to use XHTML for my site and blog, but I don't any more. If you want to know why, Ian Hickson is the guy who convinced me. I do believe that the issues he brings up and real and important.

I'm going to partially disagree. Having read Ian's argument, I think he ignores a very real and important phenomenon: the standards aren't set in stone. Things on the Internet frequently evolve when a bunch of people decide to do something, it breaks a bunch of other things, and the authors of those things then fix them to work with the new stuff. Observe the recent rapid evolution of blog reading software.

In other words, the fact that XHTML doesn't work with existing software doesn't mean we should avoid it in all cases. For example, using it in RSS feeds might be fine, since the software for RSS readers is still evolving rapidly and can quickly adapt to the changes. And it's easy to see that XHTML is easier to parse than HTML 4.01, which can have all sorts of nice benefits.

Notice that I'm not arguing for a complete switchover to XHTML right now today. I agree with Ian's points that it is currently problematic, and I probably wouldn't go that route if I were authoring the main page of my company's website. But not everything I do is that mission-critical, so I won't eschew its use, either.

A Little Science First Thing in the Morning

I've always been interested in science. Here are a few links I ran across this week.

First [1], evidence that global warming may not be quite the phenomenon that some have thought.

Second [2], an interesting site devoted to scientific skepticism.

And speaking of skepticism, if you've never heard of the Amazing Randi, go here [3].

[1] http://www.dailytelegraph.co.uk/news/main.jhtml?xml=/news/2003/04/06/nclim06.xml&sSheet=/news/2003/04/06/ixhome.html
[2] http://www.don-lindsay-archive.org/skeptic/index.html
[3] http://www.randi.org/research/index.html

Website Somewhat Restored

I've got most of the content restored from backup, thanks to the DM IT staff. Now I merely need to convince FrontPage (which I stupidly used to move things around) to fix all the links it broke. That may take a while. Looks like the blog is fine, but other areas of the site might take a while to set straight.

Eh, I'm going to bed.

This Website Totally Disappears

For some (as yet) unknown reason, today my entire site disappeared off the hard drive of the machine where it's hosted. We're working on finding backups and an explanation. As I press 'Post', I'm not even sure this message will show up - here's hoping!

Update - well, I've got some of the content restored, but if a lot of stuff on this site shows up as busted, you know why.

Cool Word Shortcut

I mentioned a few posts ago that I'd been spending all my time writing specs lately.

One side benefit is that Tommy Williams told me that Word maps the 'F4' key to the last operation you completed. If you are deleting rows from a table (Alt-A, D, R), F4 saves you a lot of keystrokes. Maybe everyone else in the world new about this (if so, why didn't you tell me?), but it was a new to me, and very useful. [Pushing the Envelope]

I certainly didn't know about this one. Cool!

To BCL or Not to BCL

Debate rages on:

• 
  
  Use the BCL type names
  
  
• 
  
  Don't redefine your type's names to match your old habits ;-)

[Ingo Rammer's DotNetCentric]

Sorry.... string, int, char and long are part of the language. Int32 is just some detail of the underlying platform. The fact that C# and VB.NET very convienently map onto the CLR type system doesn't mean that all languages do. Using BCL types also takes away the flexibility only a high level language and its abstraction over the platform can provide. Mind WPARAM and LPARAM in Win16 (16bits,32bits) vs. Win32 (32bits) vs. Win64 (64bits). (For the younger amongst us, the "W" in WPARAM used to mean "WORD" as in "16bit processor word" and "L" used to mean "LONG" as in, ahem, "long" or "double word"). Been there, hated that. If a language can fix those problems for me by providing a layer of abstraction ... thank you, will buy. [Clemens Vasters' Enterprise Development & Alien Abductions]

Sorry again...I don't think I quite agree. Reading the C# specification, int is defined as a 32 bit integer, period. In fact, the specification even says:

Each of the predefined types is shorthand for a system-provided type. For example, the keyword int refers to the struct System.Int32.

So I don't think I understand the comment about this in any way taking away flexibility. The platform abstraction is provided by the CLR, not the language. Given that the biggest problem with WPARAM and LPARAM (and int) was the fact that they changed size, I would think tying the language keyword to a particular type is a good thing. If you really need a type that means "the sort of natural size of the underlying platform" that's what System.IntPtr is for.

Also, we can certainly use the type names (as opposed to the keywords) in C# and VB.NET only. If there are other languages that provide a "layer of abstraction," then great. In the meantime, given how many times I've had to explain to people that int and System.Int32 are the same thing, that a long is actually always 64 bits, and that Integer in VB.NET is 32 bits not 16, I think using the CLR type names is a great idea, particularly in sample code.

Of course, the spec also says:

As a matter of style, use of the keyword is favored over use of the complete system type name.

and as with any question of style there is no "right" answer. :)

Sharpreader - It's Sort of Cool

OK, I installed Sharpreader today and ran it. I don't like that there's no way to mark a group of messages as read or unread. I don't like that it doesn't notify you when new messages arrive. These things have been said before.

I sort of like the way it groups related messages, but so far I haven't found this to be a killer feature, the way running inside of Outlook is (ala NewsGator). If NewsGator never develops this feature, I won't miss it a ton, as the temporal locality of related messages is currently high enough that I can remember what went on in a thread. Telling me about related posts in feeds I don't subscribe to would be way cooler.

The one thing about SharpReader that I really like is that it is insanely fast. Really really fast.

Anyway, you should try it out to see if you like it - it truly is a nice piece of software from what I've seen. Looking over my post from this morning, I see that it might seem that I was dismissive of it. That was not my intention:  I want to say a hearty, "Well done!" to the author, Luke Hutteman.

Oh, and the issue with not running as non-Administrator is almost definitely that it wants to read from the program directory. Someone suggested that I just run it from some other directory (e.g. My Documents), but not only is that a horrible hack, but it still doesn't solve the problem of it not being multiuser. Still, it's an early version, and (I suspect) an easy fix.

Sharpreader - It Might Be Cool But I Can't Tell

Sharpreader is the latest three-paned aggregator to hit the scenes. Although I'm a big time NewsGator fan, I thought I'd try it. You never know.

Unfortunately, Sharpreader doesn't seem to want to run as non-administrator right now. It looks like it wants to write to the Program Files directory. God, that's annoying, not to mention it usually makes the program completely single-user.

 I'll play around with it and see if I can get it to work in a non-administrative context. Then I can let you know what I think. In the meantime, here's hoping the author fixes it in the next release.

Tales of Hair

If you've seen me any time in the last seven years, you know I cut my hair short. Really short. But Alice wanted me to grow it out a little bit for wedding pictures, so I did. For six weeks I didn't touch a clippers to my head. It bugged me to have long(er) hair, but if that's what Alice wanted then I was all too happy to comply.

Naturally, when we got back from Hawaii, the first thing I did was cut my hair. Or rather, I had Alice cut it. Along the way, she decided to give me a new hairstyle. I didn't keep it, but I thought I would share it with you here:

Oregon and Open Source

Chris Sells has a very interesting experience helping shape Oregon state laws that would set up barriers to non-open-source solutions.

Chris is an interesting guy. I'm looking forward to seeing him again at WinDev. I'll be talking about DirectX - I've got three sessions this year!

Building an Array

A question that comes up occasionally on the mailing lists revolves around how to manipulate arrays of things. The problem is that once created, arrays can't change size. But what if you don't necessarily know how big it'll be right off the bat. Here's my favorite way to deal with arrays.

ArrayList al = new ArrayList();

 

for (loop over some set of things)

{

  al.Add(thing);

}

 

Thing[] things =

  (Thing[]) al.ToArray(typeof(Thing));

In other words, System.ArrayList is a convenient way to keep track of a list of things that you can later turn into an array.

Even better is the fact that you can construct an ArrayList from any array, like so:

ArrayList list = new ArrayList(things);

And you can remove a particular item like this:

list.Remove(particularThing);

Combine these three things, and you have a convenient way to remove an item from a list: turn the array into an ArrayList, remove the item you care about, then turn it back into an array. Or use Add instead of Remove, and you've got a convenient way to append things.

Taiwan, Thailand - What's the Difference?

My wife is going to be in Taiwan for a few weeks to visit her family. We already have an international calling plan, but I asked around to see if anyone knew of anything cheaper, since we'll be calling a lot. Franci Penov (among others) thoughtfully replied. Here's an exerpt:

Since they specialize in low prices for Bulgaria, their rates for Thailand [2] are somewhat higher - $0.11 per minute if you call Bangkok, between $0.16 and $0.27 for the other cities and $0.365 for cell phones. If you live in New York and use their local number, the prices are with about $0.02 less.

There might be other cheaper phone cards that specialize in low pricez to Thailand that offer even better prices. :-)

You'll notice that he thought I said "Thailand" rather than "Taiwan". Hey, they're both Asia, right? An honest mistake. But being the smartass I am, I responded:

I'm not sure my wife would appreciate me calling Thailand while she's in Taiwan. ;)

"Ha ha," I thought, "I'm so funny!"

Then I got Franci's response, which made me realize that I'm clearly only bush-league funny.

Craig,

I agree that the problem you state below can be a big issue for some of our customers. However, that doesn't mean our feature implementation is not right. Let's me expand on this little bit more.

The original problem we wanted to solve was how to call in Taiwan without paying much. The implementation cost for "call cheap any location in Asia" feature is essentially the same as the cost of implementing the "call cheap Taiwan" scenario, so the management decided that we should implement this feature instead, as it will address broader set of customer scenarios. We had to provide a default value for the particular location to call in the case the customer does not provide one; we choose the default value of 'Thailand', but of course this value can change after the proper usability study is conducted by the UE team. Our current implementation of this feature is the correct although probably not the most optimized one, as specified by the feature design.

If we need to add the feature "talk with the customer's wife", the PM team should write the appropriate feature design document. One possible issue with such feature will be how to find the location of the customer's wife, so we might need to design this feature as well. I can write small architecture document describing tri-tier distributed solution for this problem after that which will use as underlying way of communication the "call cheap any location in Asia" feature (provided that the customer's wife was located to be in Asia) or the corresponding "call cheap any location in Europe" or "call cheap any location in Africa" features (although these two are not implemented currently).

I will reflect the necessary time for the architectual design of this feature in my schedule. The cost of the actual implementation will be reflected there as well, although at this point i can provide only SWAG and the actual costing will happen after the architecture design review.

As for the particular bug you are refering below (customer's wife not being happy) - there is an easy workaround the customers can deploy - don't tell the customer's wife that the customer called somebody in Thailand. Of course we all know that security through obscurity approach is not in general favored; however it will have low impact on the customer's TCO and as such it should be recommended unless the customer's wife is known to implement active data mining on the customer's call logs. In future we will need to add new feature - role-based security for the access to the phone line logs and the customer's bank statements. Given it's cost though, we will not be able to add it to our current product version and will have to make it v.next feature.

I hope this explanation presents clearly the current state of the product and our future plans and addresses your and customer's concerns. If you have further questions/comments on this particular feature or any other feature in our product, please do not hessitate to contact me.

Thanks,
Franci

Awesome.

RSACryptoServiceProvider Creation Slow

So, at work yesterday, I finally got around to pointing a profiler at the 10,000 lines of code I wrote in December. It's a security prototype that uses RSA signatures to issue security tickets, similar to what Kerberos does. Since it accesses a database to record session information and verify passwords, I fully expected that the profiler would show everything in the noise relative to network roundtrips.

Imagine my surprise when the slowest line of code was this:

RSACryptoServiceProvider rsa = new RSACryptoServiceProvider(csp);

What?! But sure enough, it's "slower than molasses in January", as my dad always says (excuse him, he's from South Dakota). Well, 20 minutes of coding later, I'd added a simple synchronized Queue where I pool the instances when I'm done with them, and the code got a lot faster - like 25% per request. I scheduled some performance tests last night to see exactly how much difference it makes.

What's great is, my client has been after me to make a different optimization - one he thought of. And it's a good optimization, but it's not likely to have a tenth the impact. There's just no way we would have guessed that this particular line of code would be so expensive. In fact, I'm not sure it's worth it at this point to do his optimization at all.

The moral of the story is, "beware premature optimization." Profile, fix the slowest thing you can, and for the most part don't bother optimizing at design time.

Exploding App

So, I'm playing around with DirectSound, in addition to the Direct3D stuff I've been doing. Turns out, the basics of Managed DirectSound are really easy. In fact, here's a little zip file that's a ton of fun for me. But then, I'm easily amused. Download it and run it - you'll need DirectX 9.0 installed, though.

There's so little code to it, I've attached it to the end of this posting. I can think of all sorts of uses for it, the primary example being for use in the unhandled exception filter. :)

using System;

using System.Drawing;

using System.Collections;

using System.ComponentModel;

using System.Windows.Forms;

using System.Data;

 

using Microsoft.DirectX;

using Microsoft.DirectX.DirectSound;

using Buffer = Microsoft.DirectX.DirectSound.Buffer;