Business to the Clouds

Most likely that you have heard of Software as a Service, the original “as a service” idea, and you are certainly using this type of service on a daily basis either on your smartphone, tablet or by accessing your online bank account.

The “as a service” world has expanded dramatically in the last decade and we are looking now at a plethora of services that reside “in the cloud”, whatever the type, location or reliability of the cloud may we be talking about.

Here is a top of “as a service” I put together that a business these days should not ignore:

1. UCAAS or Unified Communications as a Service. The UCaaS industry is led by email, collaboration, conferencing and telephony. (Skype, WebEx, NetMeeting, CallTower, Cypress ..)
2. BAAS or Backup as a Service. Basically, backup to the cloud. (Amazon, Windows Azure, Iron Mountain ..)
3. DBAAS or Database as a Service (Daas). Virtually, all major database platforms are "up in the cloud today. This is a service that cannot be ignored. (Amazon RDS, Windows Azure SQL ..)
4. IAAS or Identity as a Service. Identity and access management, administration, audit and verification for cloud based services (Google, IBM, Windows Passport Services, Verizon Business)
5. SAAS or Storage as a Service. Also serving the loved and appreciated CDN (content delivery network) and powering BaaS. (Amazon S3, Windows Azure Storage, Google Docs ..)

I am planning to update this list and provide some insight into the ups and downs of using this and that service. I am personally concentrating on two major cloud solutions out there: Amazon and Windows Azure.

For the iCloud crowd, you have to appreciate the fact that Apple starts with the user and then figures out the technology part. The experience is great!

Implicitly Typed or Named Types

An Implicitly Typed Local Variable, var, is “new” and it is subject to restrictions:

• The declarator must include an initializer.
• The initializer must be an expression.
• The initializer expression must have a compile-time type which cannot be the null type.
• The local variable declaration cannot include multiple declarators.
• The initializer cannot refer to the declared variable itself

Beyond the obvious use of var with LINQ, you may also clear the code for readability:

var d = new Dictionary<string, Dictionary<string, List<SomeClass>>>();

The entire debate around using the var is founded on readability.

Another pair of eyes see differently so the code has to self explain. That being said, using the var for just about anything is also an exageration. A method that returns a “hairy” type (like List<string>) would be easier to digest in a var but that would not tell those other pair of eyes anything about the purpose and the intention behind. So you would not know how that specific return was “intended to be used”. Just compare List<string> list = MyMethod():

• var list = MyMethod()
• IEnumerable<string> list MyMethod()

The second one is actually saying “I am not going to change this, use an index to access list members or modify members.”. It’s quite a lot to say in that few words. But it’s not over because it is also saying “I am going to use this list simply to iterate across it”.

The intention is what you are giving up if you use var. You are not giving anything up where the usage is obvious through the declaration.

var i = 5;
var s = "Hello";
var d = 1.0;
var numbers = new int[] {1, 2, 3};
var orders = new Dictionary<int,Order>();

are equal to

int i = 5;
string s = "Hello";
double d = 1.0;
int[] numbers = new int[] {1, 2, 3};
Dictionary<int,Order> orders = new Dictionary<int,Order>();

I' would write a LINQ query like:

var rows = from DataRow r in parentRow.GetChildRows(myRelation)
           where r.Field<bool>("Flag")
           orderby r.Field<int>("SortKey")
           select r;

But the debate is in the use of var, not in Anonymous Types, Object and Collection Initializers and Query Expressions, but everywhere in your code, for readability.

Here is Eric Lippert’s take on it:

All code is an abstraction. Is what the code is “really” doing is manipulating data? No. Numbers? Bits? No. Voltages? No. Electrons? Yes, but understanding the code at the level of electrons is a bad idea! The art of coding is figuring out what the right level of abstraction is for the audience.

In a high level language there is always this tension between WHAT the code does (semantically) and HOW the code accomplishes it. Maintenance programmers need to understand both the what and the how if they’re going to be successful in making changes. read more ..

LinX BoX

This Friday’s Top 3 interesting sites visited this week:

• Can you run it
• Annomalies Unlimited
• Asian Poses

This list is published every Friday and values originality. Submit your suggestions for next week as comments.

And don't forget my web templates shop at Bynapse.com - the easy web.

Reciprocal link of the week : Volunteer to Nepal

LinX BoX

This Friday’s Top 3 interesting sites visited this week:

 

• Definr
• Hunch
• Seusville

This list is published every Friday and values originality. Submit your suggestions for next week as comments.

 

And don't forget my web templates shop at Bynapse.com - the easy web.

 

Reciprocal link of the week : Termic

PDF and E-book creation

Every now and then, someone tries to edit a PDF file and the old Acrobat and Distiller question pops back. What are the roles of those two and why still use Word to edit? Why is Acrobat still important in e-book creation?

First the basics. Adobe Acrobat only reads PDF files. It does not create PDF files, nor can it be used to create content of any kind. It allows setting of certain attributes and anchors, such as creating hyperlinks and setting document security settings.

Distiller is a print driver that outputs PDF files. It is not a reader, nor an application used to create any content.

Adobe Acrobat (not Acrobat Reader) does not edit files, you create your content in a applications like Word, Photoshop.. then print to Distiller (some applications have a “Save as PDF” functionality like Word does in an optional add-on) and save the resulting file as PDF. All word, spreadsheet or image editing or viewing applications should be able to print.

You may open the PDF in Acrobat for fine tuning:

1) create hyperlinks (see Tools/Locate Web Addresses)
2) create title and author (see File/Document Properties)
3) set your desired security level (see File/Document Security)
4) File SAVE AS whatever.pdf. It is important not to just SAVE but to use SAVE AS because this eliminates unused fonts and makes a smaller PDF.

An important decision is to embed fonts in your PDF, or use system fonts. This impacts the size of your PDF but embedding your fonts guarantees that your reader will see the exact page layout you designed. The better system fonts seem to be the small common ones such as Times Roman or Arial. You should know that embedding fonts is a Distiller option (Printer/Preferences/Adobe PDF Settings/General Conversion Settings).

Currently, High speed internet access is becoming the norm and PDF files are generally small. As I was saying in a previous post, content is King.

LinX BoX

This Friday’s Top 3 interesting sites visited this week: 

• JQuery
• 43 Things
• One Sentence

This list is published every Friday and values originality. Submit your suggestions for next week as comments.

And don't forget my web templates shop at Bynapse.com - the easy web.

Reciprocal link of the week : Smartbyte

Web application security

It's a real possibility that the web server is locked down and secured.

Web application hacking requires the attacker to understand application logic.

A website may be ripped entirely and stored locally. While this does not give out the code behind, it shows how input is passed, what types of error messages are returned, and the types of input that various fields will accept.

Here is a list of vulnerabilities and possible attacks to add to your list. Also check this list that Microsoft put out:

http://msdn.microsoft.com/en-us/library/ms998372.aspx#pagpractices0001_indexofpractices

Check out this article: http://msdn.microsoft.com/en-us/library/ms998375.aspx

Hidden Fields

Hidden fields used for obscuring values are poor coding. The theory is that if end users cannot see it, it is safe from tampering. Many sites use these hidden value fields to store the price of the product that is passed to the web application. An example pulled from a website is shown here:

<INPUT TYPE=HIDDEN NAME="name" VALUE="Mens Ring">

<INPUT TYPE=HIDDEN NAME="price" VALUE="$345.50">

<INPUT TYPE=HIDDEN NAME="sh" VALUE="1">

<INPUT TYPE=HIDDEN NAME="return" VALUE="http://www.vulnerable_site.com/cgi-bin/cart.pl?db=stuff.dat&category=&search=Mens-Rings&method=&begin=&display=&price=&merchant=">

<INPUT TYPE=HIDDEN NAME="add2" VALUE="1">

<INPUT TYPE=HIDDEN NAME="img"

VALUE="http://www.vulnerable_site.com/images/c-14kring.jpg">

Here is an example tampering with a poorly written shopping cart:

1.

Save the page locally and open the source code.

2.

Modify the amount and save the page. As an example, change $345.50 to $5.99:

<INPUT TYPE=HIDDEN NAME="name" VALUE="Mens Ring">

<INPUT TYPE=HIDDEN NAME="price" VALUE="$5.99">

3.

Refresh the local HTML page and then click Add to Cart. If successful, you'll be presented with a checkout page that reflects the new hacked value of $5.99.

This is an extreme example for illustration purposes that an application should never rely on the web browser to set the values for sensitive data. Even without changing the price, an attacker might just try to feed large amounts of data into the field to see how the application responds. Values from hidden fields, check boxes, select lists, and HTTP headers might be manipulated by malicious users and used to make web applications misbehave if the designer did not build in proper validation.

If you think that there is a shortage of sites with these types of vulnerabilities, think again. A quick Google search for type=hidden name=price returns hundreds of hits.

Cookies

Cookies have a legitimate purpose. Security by obscurity is never a good idea. Cookies used with forms authentication or other remember me functionality might hold passwords or usernames and cookies can be viewed with cookie viewers. Example:

Set-Cookie: UID= bWlrZTptaWtlc3Bhc3N3b3JkDQoNCg; expires=Fri, 06-Jan-2010

The UID value appears to contain random letters, but more than that is there. If you run it through a Base64 decoder, you end up with mike:mikespassword. It's never good practice to store sensitive information, encrypted, in a cookie, a hash should be preferred.

Cross-Site Scripting

Cross-site scripting (XSS) is a computer security exploit that occurs when a web application is used to gather data from a victim. Here is an example of a possible entry in a text field:

<A HREF="http://example.com/comment.aspx?mycomment=<SCRIPT> malicious code</SCRIPT>">Click here</A>

XSS can be prevented by HtmlEncoding displayed data and the input from a form is validated. Prevention also requires that the users remain leery of embedded links.

Interception, Inspection, Modification

A web proxy allows interception, inspection, and modification the raw contents of the traffic, as explained in the following:

• Intercept Allows you to see under the hood and watch the traffic move back and forth between the client and the server.
• Inspect Allows you to enumerate how applications work and see the mechanisms they use.
• Modify Allows you to modify the data in an attempt to see how the application will respond; for instance, injection attacks.

These tools make it possible to perform SQL injection, cookies subversion, buffer overflows, and other types of attacks.

ActiveX modal dialogs are pushed behind Internet Explorer's browser window

It has been long since my last article but I must tell you, I have been spending my time doing some beautiful programming lately and, while I was away, Microsoft decided to put another browser out in the world.

For most programmers that have an ActiveX window embedded in a web page, showing a modal dialog from an ActiveX control in internet Explorer 7 was a challenge and here is but one of the hot discussions we had about the topic.

But.. hey, Microsoft did it again and now they're not just multithreading it away.. they're creating a process for each tab you open. We'll not discuss the good, the bad and the ugly of this idea, but your modal dialogs will pop up behind the browser window one more time, and they will stay there !

Here is how the people who know IE say you should go about determining which IE tabs goes to which Iexplore.exe process when using Internet Explorer 8 :
http://blogs.msdn.com/askie/archive/2009/03/20/how-to-i-determine-which-ie-tabs-go-to-which-iexplore-exe-process-when-using-internet-explorer-8.aspx

Now that sheds some light but how do show modal .. in my code ?

Here is an example of my solution for a bunch of ActiveXes I have developed in Delphi an I needed to make compatible with IE8 :

function FormShowModal(aForm: TCustomForm): TModalResult;
begin
try
EnableProcessWindows(MainHandle, False);
SetWindowPos(aForm.Handle, HWND_TOP, 0, 0, 0, 0, SWP_NOACTIVATE or SWP_NOMOVE or SWP_NOSIZE);
Result := aForm.ShowModal ;
finally
EnableProcessWindows(MainHandle, True);
end;
end;

procedure EnableProcessWindows(aHandle : HWND; disableWindow : Boolean);
var
aParentHandle : HWND;
begin
aParentHandle := GetParent(aHandle);
while (NULL <> aParentHandle) and (aParentHandle <> 0) do
begin
EnableWindow(aParentHandle, disableWindow);
aParentHandle := GetParent(aParentHandle);
end ;
end;

Where the MainHandle is the handle of the main form of your application. For an ActiveX, this is the ActiveForm's handle. I let you decide the best way to retrieve or pass that around.

I must tell you that the same solution works beautifully on IE7 and even inside a standalone executable so.. feel free to translate it into any other programming language you are using and go ahead and sell for IE8 too.

Now why did I do the SetWindowPos call ? Well if you click on the taskbar buttons, you will find that the dialog may still go behind the browser window and come back on top but I believe this is totally acceptable.

Write a comment if you found any other solution to this.

Virtual real estate, a high-valued asset

The market is hungry for good readable and easily remembered domain names. For six months I have been searching to build on the right name and I found the market takes domain names as premium real estate. Many believe that buying the domain now is an unnecessary investment and wait until they develop the site (or product) and are ready to sail the cyber-wave.

According to Ron Jackson, editor and publisher of Domain Name Journal, there is a handful of people (between 1000 and 2000 individuals, most of them remaining anonymous to avoid competition) that make a living out of domain names but these are people spending six figures to snap up domains left and right and build an empire on domains.

I'm writing for the rest of us but if you're bitten by the domaining bug, I suggest waiting for Page Howe's Domain Name Investing: How to Make Money in Internet Real Estate. If that is your business, there is a community out there for you.

I was mostly looking to get the right domain name for my idea. I already had bynapse.com, a domain that gave me much joy to own but, as most of us, I had a name for my idea and found that people out there are looking for someone else's good idea. You may hear that ideas are cheap and abundant .. not when it comes to domain names !

I recently had a customer for which I've built a simple site for a good cause. He's trying to convince people to volunteer to help a school in Nepal. So we're chatting about the idea and he's searching at night for domain names and finds the name he always had in mind is available.

A few days later he contacts me so we can start setting things up just to find that the domain has been registered, is parked and offered for sale. Here is a nice article about some less ethical practices on DomainName News and if this isn't something a domainer usually does, its one more thing you have to consider when shopping.

In the end, he had his way and found both the English and French version of the new domain names I helped him to come up with, but this time, he searched and bought them right away and the site came up pretty fast afterwards. Check it out at VolunteerToNepal.org.

As a note, all searches leave a trace and there are always people on the lookout for a nice idea. Well, in this business, ideas don't come cheap and may end up as consistent checks to bring to the bank.

Checkout solutions for your E-commerce

Charge that credit card, get paid and have your e-commerce web site up and running at a decent cost so it can support itself and bring some green. The idea behind an e-shop is to have the conversion from visitor to buyer done fast and in the most secure way so that it happens over and over again.
There are literally thousands of solutions out there for building or hosting your e-commerce. Many of those solutions are free or come with your hosting subscription. If you are a programmer or can get a hold of such an individual you can download and customize code and have your own solution in very little time. It all ends up in the checkout process and here is where all the lines in the water lie.
Having a simple low-cost solution that provides state-of-the-art security and service is not impossible by any stretch of the imagination and many of the most respectable companies out there offer easy to set-up solutions for decent fees.
The things that make me think twice when I look for a service, though, is the nickel-and-dimes type of deal. And when you're dealing with credit cards and other type of payments, reading the fine-print is a prerequisite. And in that fine-print (that often stretches over several pages) you may find that the service provider can change the contract at any time, for any reason.
Do not build your e-commerce around a checkout solution before you make sure you can use it. I've heard a few disappointed voices in Canada that enthusiastically built their web sites to use Google Checkout or certain versions of PayPal just to find that they're not available in Canada .. yet. It's not obvious information since the focus on those sites (as it should be on yours) is conversion.
What payments would you need to Accept or Manage, and don't be afraid to think ahead:

• Credit Cards, Debit, Email Invoices, PayPal (when selling single or multiple items)
• Recurring payments (like a monthly fee.. subscription)
• Promotions (eg. 15 $ first 3 months and 99.99 $ after)
• Shipping and handling
• Bonus points and point partnerships (eg. Travel miles, Bank percentage rebates...)
• TAXES
• Contributions (donations)
• Gift certificates and Coupons

Major sites like Amazon have their own secure systems to store credit card numbers and shipping addresses, but this article is for the rest of us who need security and fraud protection while selling to buyers who are shy of leaving the credit card number all over the place. EBags' Peter Cobb said that “retail is about overcoming objections” as the point here is to enable that transaction and get the money. Big players spend big to lure customers their way. Google offered a fee waiver through the end of the year in their move to take some market off PayPal' hands. But we are not talking from the customer's perspective here, as much as it is a crucial factor in completing the sale and it should not be overlooked, are we?
In the end, if we need to spend hundreds of dollars to integrate some system and pay ridiculous fees on each sale, it's going to kill your infant business before it can build you the income you're doing it for.
So here is a list of the most interesting and capable players I stumbled upon (I urge you to comment on it and add to this list)

• Google Checkout - offers a decent platform for decent fees and comes backed by Google's name. It's not available everywhere though.
• PayPal - much more widely spread and used but I feel the fees are a bit to the upper side of the ladder. I simply don't like paying "one-time installation fees" I guess. Still, a solid and reputable name in the business.
• Amazon FPS - Flexible Payments Service is "designed from the ground up specifically for developers"... Or you can simply create a PayNow Widget and ... Amazon takes care of the rest.

There are others like Payjunction, Card Payment Solutions, Wells Fargo, VersaPlay, CollectivePos,  DriveIt and all have a twist that make them attractive for a certain market or the other. Personally I look at the reliability of the company and I simply hate two-hundred pages contracts you can't keep track of.
From my point of view, those services should empower my business not suck it dry when the "exceptional case you find on page two of the fine-print" happens.