Zaemis

Code metrics are interesting creatures. Some are just raw numbers, such as depth of inheritance or lines of code, while others are a bit more subjective, like a maintainability index. But ultimately they are all meaningless without broader context and an understanding of the code. As a brief example, consider the following C# function which accepts a string and returns the 40-character hexadecimal representation of the string's SHA1 hash . public static String Sha1(String text) { using (SHA1Managed sha1 = new SHA1Managed()) { Byte[] textBytes = Encoding.Unicode.GetBytes(text); Byte[] hashBytes = sha1.ComputeHash(textBytes); return Convert.ToBase64String(hashBytes); } } The function accomplishes one task. Variables are defined closest to their usage. Function calls are clear and do not nest other function calls. Even using ( ) is used so the run-time can automatically dispose of the SHA1Managed resource. Yet a scan using Visual Studio 2010 ...

Code Analysis/FXCop warned me that my credit card application was not signed with a Strong Name, which would make it more difficult to determine if the assemblies had been tampered with. For more information on Strong Names and why they're a good thing, see this Tech Republic article . you first need a cryptographic key before you can sign an assembly. The key is created using the sn.exe tool provided by the Windows SDK . sn.exe -k sgKey.snk I added my sgKey.snk file to my project in Visual Studio, and then in the Application's properties I went to the Signing tab, checked the "Sign the assembly" box, and specified my key file. I had forgotten that I used a 3rd party library to manage logging the user out after a configurable period of inactivity and their assembly was not signed. You can't sign an assembly unless all of its dependencies are signed as well, which makes sense. You need to replace the unsigned assemblies with signed ones first. If you can compile ...

Continuing to play around with Visual Studio 2010 Ultimate , I ran the Code Analysis tool on some code I had written for a customer-- a desktop-based application which securely stores credit card information using hardware identifiers as portions of the encryption key. I started with over 300 warnings and have now worked them down to around 120 warnings or so. Those that remain are Globalization related, which I'm not concerned about since it was a one-off project that is unlikely to be internationalized. FxCop , the utility which Code Analysis is based on, is freely available online .

If you haven't heard the news already (which I hadn't because I typically don't keep up with such things), Visual Studio 2010 came out earlier this month. I've been playing around with Visual Studio 2010 Ultimate (a 90-day trial version is available) and I must say I'm impressed. Microsoft has finally added common features like block editing and text-zoom, an Extension Manager to extend the IDE à la Eclipse, and support for jQuery. If I were a Fortune 500 company hacking out Windows code all day I could justify a couple of licenses if it really helped my developers efficiently produce a more secure and stable application, but the price tag puts it far out of reach for my needs. I'll stick with either VS2005 or C# Express 2010. I'll probably post a few follow-up entries as I explore more throughout the next 90 days, so be sure to keep an eye out!

This is why I don't program in Java: import java.util.ArrayList; class Program { class Person { public Person partner; } class Prostitute extends Person { } class Eunuch extends Person { } private Prostitute prostitute; private Eunuch eunuch; public static void main(String[] args) { Program p = new Program(); p.run(); } public void run() { eunuch.partner = prostitute; } } > Exception in thread "main" java.lang.NullPointerException But if you do, you should check out the nifty online JXXX Compiler Service .

There once was an app called Subversion Who's working was utter perversion; Whether a check in or check out, I'm always in doubt If it's preserving my coding excursion.

My sister's boyfriend showed me a nifty chart which presents the size of by distance from a television before your eyes begin to notice the difference of 1080p resolution. Just out of curiosity, we measured the length of my living room and looked at the chart to see how large of a television I would need. The distance between my couch and television is a bit shy of 20ft... off the chart! The chart goes up to 130 inches, or approximately 11 feet. But an 11 ft diagonal measurement doesn't really mean anything to me other than "big ass TV"*, so I decided to dig out my high school math skills to help me put it into perspective. Assuming a standard 16:9 wide screen display and some liberal number rounding: I would need a television that's almost 6 ft tall, and 10 ft wide if I wanted to see Jay Leno's crow's-feet in high definition! I only have 8 ft ceilings so that gives 2 ft of clearance above it, and the room is 16 ft wide so I'd have 3 ft of clearance ...

A friend of mine was tasked with writing a regular expression that could recognize a Uniform Resource Identifier (URI) and break apart its primary components. Not a terribly difficult task since there are a lot of sample regexs one can just pluck from the Internet. But he asked my opinion and I deferred to RFC 3986 which outlines the generic syntax for URIs. The RFC provides this example expression : ^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\?([^#]*))?(#(.*))? Personally though I think that's rather sloppy. Were I to write the expression from scratch myself then I'd probably be more verbose and restrictive; I'd expressly match patterns specified in the RFC's ABNF . For example, the RFC defines the scheme portion of a URI as: scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." ) The portion ^([^:/?#]+): will match characters that are not lexically permitted, such as an underscore or percent-sign. Assuming the i (case-insensitive matching) modi...

I'm changing shared hosting providers for my websites and the sites I manage for clients as Salt City Tech. Most of the sites are basic websites powered by PHP, share a common code base, and store data in MySQL databases. But I've also been taking advantage of the situation to transition the sites from MySQL to SQLite. There are a lot of things that annoy me about SQLite (such as allowing NULLs in primary-key columns , ignoring foreign key constrains, and incomplete ALTER TABLE support ) and a few things that I think are pretty awesome (such as user-defined functions in PHP ). Pragmatically speaking, SQLite will be more convenient for deployment to and backup from the shared hosting environment and the sites' simple storage requirements fall exactly in SQLite's sweet-spot. The transition hasn't been terribly difficult... the biggest obstacle has been configuring a development environment that adequately mirrored the shared hosting deployment environment. I happened ...

Happy New Year! I hope everyone has had a rewarding holiday and will have a prosperous new year! Last year I tentatively designated 2009 as my "Year of Balance." I wanted to make a concerted effort to focus more on what's really important in life. With a busy full-time job, a death in the family, juggling several side-projects, and buying a house this year (2009 was probably my "Year of Expense" in retrospect with the new house and all the joys that come with home ownership)... my head would probably have exploded had I not been making that effort. I'm not sure what my theme for 2010 will be, but I'll still be doing my best live, laugh, and love as much as I can and I hope you will be to!