3 hours ago, figuerres wrote

some guy made a .Net wrapper with all the stuff but it looks like he had to spend a lot of time doing something one off that if they had a WSDL file most of the code could be generated like we do with ASMX or WCF services.

I have only had to deal with a couple of cases but to me it seems like REST / json is a step backwards to the dark ages ....

JSDL? I suggest that when I want to see people explode. One of the points of json / rest is they're not strongly type, so there's no need for a proxy. You have to remember it came out of javascript where there is no real typing. It's not so bad though, you should be marshalling it into your own domain objects after validation, and Newtonsoft's json.net

4 hours ago, MasterPie wrote

@blowdart: Do you ever get to review Ion's code? I'm sure you'd give him a pass, right?

Not unless he's committing into asp.net, or the azure sdks

29 minutes ago, kettch wrote

@blowdart: Charles probably has access to the source repository. Aren't you the guy who shows up and asks "Would you like security with that". Maybe it's time for a security audit?

The c9 guys don't fall under my beady eye

11 minutes ago, DeathBy​VisualStudio wrote

*snip*

I wasn't fretting; I was actually trying to compliment you. Sorry if that came off as sarcasm.

Ah it didn't. I was being self deprecating because I was embarrassed!

3 minutes ago, DeathBy​VisualStudio wrote

@blowdart: That's understandable. How about the MSDN site in general? If I were a noob and didn't know where to begin for web development I don't think the "Development & Platform Tools" categories they have presented would suggest "pick me".

It's good to know that guys like you are working on ASP.NET.

I'll point that out to the MSDN folks - it's an understandable reaction.

And don't fret, it's only a couple of weird edge case auth providers, generally I'm still doing threat models and code reviews for the asp.net platform and tools bits.

9 minutes ago, DeathBy​VisualStudio wrote

Looking at the MSDN site and the revised Dev Center it seems to leave out ASP.NET. Why not a "Web Developer" category?

Because that Dev Center is for writing apps for Windows. Not apps for the web.

Heck I've just finished some code you'll see in asp.net v.next, so no, it's not dead. At least not to me.

37 minutes ago, Dr Herbie wrote

@blowdart: Have you tried just deleting every post Charles makes?

Herbie

Oh the ban button is there for you ....

29 minutes ago, fabian wrote

@blowdart: Can you ban yourself?

Nope Makes me wonder if there are server side checks too (I assume so, but I am unwilling to check *grin*)

6 minutes ago, Sven Groot wrote

How did it even prove it was an employee? The only people who could check the hash's authenticity are other employees, aren't they?

Or people that have the file. The SHA could be produced by anyone that has the file.

3 hours ago, davewill wrote

@blowdart: only in the name of testing.  YES YES  YES YES YES YES YES YES YES YES YES YES YES YES YES YES YES YES YES YES

Damnit, I can't Button isn't even there.

1 hour ago, BrianD wrote

Can anyone think of any way a SHA1 has of a file can be used inappropriately or cause any issues?

I'm more bemused it's proof of anything. Gee, it's not like anyone outside of the kernel team could produce a SHA1 hash... oh wait a minute...

7 minutes ago, evildictait​or wrote

If your code (and the frameworks you are using) don't ever use eval or write HTML to the DOM directly, then there is no path for attacker controlled data to be executed as a script*

Much better. I keep finding this and it makes me weep.

15 hours ago, Charles wrote

@blowdart: You can't ban me, can you? If so, we'll need to fix that

C

Shall we find out boys and girls?

42 minutes ago, evildictait​or wrote

That way you won't have to think about any ASP shenanigans, and your site will magically have no XSS vulnerabilities (so long as you avoid using eval) either!

Oh if only this were true.

2 hours ago, evildictait​or wrote

Windows 8.1 isn't a service pack.

Yup - service packs don't add features.

1 hour ago, cbae wrote

@exoteric: @Charles:

You guys need to go see your doctors and get yourselves an Rx.

Charles why can't I ban people for bad puns? This was painful.

21 minutes ago, Bas wrote

Charging for a service pack would be ridiculous.

Oh I dunno, Apple get away with it

14 minutes ago, wtfhIs​Microsoft​Doing wrote

@blowdart:

*snip*

https://www.facebook.com/video/video.php?v=778890205865

Yes, the "push karma".

*snip*

Automated blackbox testing only goes so far. The reason is that with new code, those tests may not get updated and may pass on old functionality but fail the new code.

My point was that this is very different from the dev-branch/merge/CI cycle run by most comparable companies with test/staging/prod.

The whole partial roll out to a select # of nodes with Chef to sample how the public absorbs the changes is vastly different as well.

So I'm sorry if I made it sound like Mark Zuckerberg was sitting alone behind his keyboard committing stuff to the SVN trunk to roll them out in the weekly release by himself. But I think that's obviously not what I meant.

Fair enough. I'd still disagree, there is a dev branch, it just gets pushed public faster than, say, msdn.microsoft.com. Of course web sites are rather different to frameworks, or Windows, but even with frameworks you'll find the likes of signalr, or owin/katana pushed faster than you would expect. The dev branches of those are public. However before release there is a quality bar to pass, in terms of the SDL, backwards compatibility and so on. I do sometimes wonder if we abandoned backwards compatibility how much faster we could be in delivering. But then we're not releasing Android

1 hour ago, wtfhIs​Microsoft​Doing wrote

*snip*

Yes, exactly. Facebook only has one branch, trunk  and it's SVN. Developers version on their own machines with Mercurial, git or whatever then commit directly to trunk. That gets pushed out to staging then production with Chef.

Again not exactly. It goes for internal use, then to some limited public servers (where they test performance etc.), then eventually to the world at large. Of course there's a metric f*ck tonne of unit and automated tests too. It is not, as I read your summary, a check-in, don't test, go live as soon as you check-in. Nor does everyone get to check into the source tree. There are merge requests which Chuck Rossi (or whoever does it now) evaluates and can reject - devs that break things get an internal "thumbs down", and that's taken into account in merge requests.

1 hour ago, wtfhIs​Microsoft​Doing wrote

Conversely a company like Facebook does not have dev branches or unit testing that you know of. The developers there are all good enough to commit directly to the main SVN trunk with no other review, and Chef pushes their changes public to all the node clusters.

Not exactly. All facebook employees run the latest build, and it gets tested that way before it gets pushed to live.

9 hours ago, fanbaby wrote

Where are Microsoft employees on this issue?

You expect employees to comment on legal matters? You need to manage your expectations better.

13 hours ago, Bass wrote

You'd need a heck a lot more then baseline POSIX to accomplish that.

Indeed. Heck the moans about POSIX that I've seen usually end up being because the Windows thread model isn't what they expected and change is bad.

24 minutes ago, evildictait​or wrote

Microsoft might be considering spending all of the money they should be spending on the Desktop on building a cupcake-catapult to fling and enormous cupcake into the sea.

Silly boy. Everyone knows we fire cup cakes into Lake Washington. They're being floated up now to make the new 520 bridge.