All interview tips,questions, programming tips,tips tricks,solutions,Latest Technology News Events

Explore the Problem Steps Recorder in Windows 7

2009-01-31T08:21:00.000-08:00

If you’ve ever worked a Help Desk and become extremely frustrated while trying to coax an end user into accurately describing the problem they are encountering, you are going to love a new tool in Microsoft Windows 7 called the Problem Steps Recorder. When started, this new tool will essentially record each and every step a user takes and document the entire operation in both screen captures and step-by-step details. When stopped, the Problem Steps Recorder will save the recorded information as a compiled HTML file and package it up in a ZIP file that the end user can then e-mail to the Help Desk.
In this issue of the Windows Vista and Windows 7 Report, I’ll introduce you to Windows 7’s Problem Steps Recorder.
Launching the tool
At this point in the beta, finding the Problem Steps Recorder is a bit tricky if you didn’t know that it existed as it really does not have a prominent access point. That may change as the UI matures a bit, but then again, it may remain hidden until needed-such as when a Help Desk tech tells the user to run it.
In any case, you can launch the Problem Steps Recorder in the beta by typing PSR in the Start menu’s Search box and pressing [Enter]. However, I also located it in the Control Panel by searching with the keyword “Problem”,

Use Process.Start to open files in their native applications

2008-12-24T00:23:00.000-08:00

Use Process.Start to open files in their native applications

Dim ps As System.Diagnostics.Process

ps = Process.Start("C:\dhad.pdf")

or

ps = Process.Start("C:\text.txt")

to open Internet explorer Using Vb.net

Dim ps As System.Diagnostics.Process
'to open
ps = Process.Start("IEXPLORE.EXE")

'to kill

ps.kill()

Visual Basic : Generate A Csv File

2008-12-24T00:00:00.000-08:00

First Add reference to Microsoft Activex Data Objects 2.5 Library

Option Explicit

Private m_cnDatabase As ADODB.Connection

Private Sub cmdExport_Click()

Call ExportToCVS("tbl_Watcher")

End Sub

Private Sub Form_Load()

Set m_cnDatabase = New ADODB.Connection

With m_cnDatabase

.CursorLocation = adUseClient

.ConnectionString = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=D:\folder\Project1\AccessDirectory.mdb;"

.Open

End With

End Sub

Private Sub ExportToCVS(ByRef sTable As String)

Dim sExportLine As String

Dim rsData As ADODB.Recordset

Dim sSql As String

Dim hFile As Long

Dim oField As ADODB.Field

On Error GoTo PROC_ERR

' ' Open the table. '

Set rsData = New ADODB.Recordset

With rsData

.ActiveConnection = m_cnDatabase

.CursorLocation = adUseClient

.CursorType = adOpenForwardOnly

.LockType = adLockReadOnly

.Source = "SELECT * FROM " & sTable

.Open

If (.State = adStateOpen) Then

hFile = FreeFile Open "C:\Temp\" & sTable & ".CSV" For Output As hFile

' Print file header with fieldnames.

sExportLine = ""

For Each oField In .Fields

sExportLine = sExportLine & oField.Name & ","

sExportLine = VBA.Left$(sExportLine, Len(sExportLine) - 1)

Print #hFile, sExportLine

Do Until .EOF

sExportLine = ""

For Each oField In .Fields

sExportLine = sExportLine & oField.Value & ","Next

sExportLine = VBA.Left$(sExportLine, Len(sExportLine) - 1)

Print #hFile, sExportLine

.MoveNext

Loop

End If

End With

PROC_EXIT: ' ' Clean up and exit gracefully. '

If (Not rsData Is Nothing) Then

With rsData

If (.State <> adStateClosed) Then

.Close

End If

End With

End If

If (hFile <> 0) Then

Close hFile

End If

PROC_ERR:

Select Case Err.Number

Case Is <> 0

MsgBox "Error " & Err.Number & " (" & Err.Description & ") in procedure ExportToCVS of Form frmMain"

Err.Clear

Resume PROC_EXIT

End Select

End Sub

C# Tutorial For Beginners - Fourth tutorial

2008-12-22T02:21:00.000-08:00

Fourth tutorial

Congratulation you would soon be able to hack CsGL but there is one last step you should understand : interop (with C code).You will need a C compiler, I advise gcc for windows called MinGW, it's free, it's good, it's GCC!We will create 3 file:

echo.c

#include

#define DLLOBJECT __declspec(dllexport)

DLLOBJECT void writeln(char* s)
{
printf("%s\n", s);
}
echo.cs using System;
using System.Runtime.InteropServices;

namespace HelloUtil
{
public class Echo
{
[DllImport("echo.native.dll", CallingConvention=CallingConvention.Cdecl)]
static extern void writeln(string s);

string myString;

public Echo(string aString)
{
myString = aString;
}

public void Tell()
{
writeln(myString);
}
}
}
hello.cs using System;
using HelloUtil;

public class Hello
{
public static void Main()
{
Echo h = new Echo("Hello my 1st interop code !");
h.Tell();
}
}
Hehe, here you discover a completly new thing, Attribute."[DllImport(.." is an attribute.You could tag any method/field/class with any number of attribute.They generate extra information that could be used by anyone who could understand them.This DllImport attribute is understand by the compiler and told him that the function below is in fact in a DLL whose name is "echo.native.dll". I add a calling convention parameter as the default .NET calling convention is __stdcall whereas, in C, it's __cdecl.By the way, if you look for DllImport in the documentation, look for DllImportAttribute, because you remove "Attribute" to attribute classname when using them, it's like this.
And now let's compile this! > csc /nologo /t:library /out:echo.dll echo.cs
> csc /nologo /out:hello.exe /r:echo.dll hello.cs
>
> rem "if the following line don't work, read bellow.."
> gcc -shared -o echo.native.dll echo.c
> strip echo.native.dll
the 2 last line (the gcc & strip command) are for building the "C-DLL".If they don't work maybe gcc is not in a directory listed in your path environment variable ? check with: %lt; echo %PATH%Well it's probably not,anyway, so type, assumin mingc is in C:\MinGW: set PATH=C:\MinGW;%PATH%And try again... you sure it's not a syntax error ?If it compile test it now: helloGreat isn't it ?
Now I should admit I didn't tell you all the truth. echo.dll and echo.native.dll are not the same kind of DLL. It's not just the language (C / C#) the C one is a plain executable full of, probably, x86 instruction, whereas the C# one is what MS call a portable executable.. anyway they are different.If you install echo.dll in the GAC it wont work because it won't find echo.native.dll except if you put in into the PATH (like C:\Windows\System32).In the same manner when you add the reference in VS.NET echo.native.dll is overlooked and your program won't work....So either put the native one in your path or copy it in the debug/release directory of VS.NET.Or do everything by hand (makefile? build.bat?) and put all your dll in you build directory, and everything work fine..

C# Tutorial For Beginners - Third tutorial

2008-12-22T02:20:00.000-08:00

Third tutorial

Now you become to be pretty confident, I guess, so we could start using multiple file, and even a dll ? go into an other directory (or stay in this one, I won't mind) and create 2 file:hello.cs using System;

public class Hello
{
public static void Main()
{
HelloUtil.Echo h = new HelloUtil.Echo("Hello my 1st C# object !");
h.Tell();
}
}
echo.cs using System;

namespace HelloUtil
{
public class Echo
{
string myString;

public Echo(string aString)
{
myString = aString;
}

public void Tell()
{
Console.WriteLine(myString);
}
}
}
Note in hello.cs I have used the syntax "HelloUtil.Echo" it's because Echo is in the namespace HelloUtil, you could have typed (at he start of the file) using HelloUtil and avoid HelloUtil., that's the way namespace work.
Now you could compile both in one .exe with > csc /nologo /out:hello.exe *.csBut it's not my intention, no.Well.(Have you tried?)Let's go building a DLL: > csc /nologo /t:library /out:echo.dll echo.csthat's it (dir will confirm).Now we could use it ... > csc /out:hello.exe /r:echo.dll hello.cs if you typed "hello" it will worked as usual..., but if you delete "echo.dll" the program will now crash: it use the DLL. You could also change Echo.cs, rebuild the DLL and see... that's the advantage of DLL!
You could also put your DLL in the global assembly cache (GAC), and any program would be able to access it, even if the DLL is not in its directory! to put it in the GAC, I sugest you read MS doc but here are the unexplained step:
create your assembly key, create it once and use it for every version. you create it with: sn -k myKeyName.snkthe .snk file should be in your compilation directory (the one where your run csc)
create a strong asssembly title by adding in any .cs source file the following directive at top level: using System.Reflection;
using System.Runtime.CompilerServices;
[assembly: AssemblyTitle("My Lib Title")]
[assembly: AssemblyVersion("1.2.3.4")]
[assembly: AssemblyKeyFile("myKeyName.snk")]

now add it to the GAC: > gacutil.exe /if myLib.dll
By the way, did I tell you ? when I referenced the hello.dll while compiling, remember? csc /out:hello.exe /r:echo.dll hello.cs, it could have been any assembly, even a .exe !!!

C# Tutorial For Beginners Second tutorial

2008-12-22T02:19:00.000-08:00

Second tutorial

Congratulation you've done the most difficult, let increase the difficulty. and create an object instance. in the DOS shell create a new directory: > md ..\learncs2
> cd ..\learncs2
> notepad hello.cs
and then type, in the notepad using System;

public class Echo
{
string myString;

public Echo(string aString)
{
myString = aString;
}

public void Tell()
{
Console.WriteLine(myString);
}
}

public class Hello
{
public static void Main()
{
Echo h = new Echo("Hello my 1st C# object !");
h.Tell();
}
}
Wouah, 25 lines! That's a program! Save it, compile it, run it...What happened? csc look for a Main() function in your program, it should find one (and only one) and it will be the entry point of your program.In this tutorial we create 2 classes: Echo & Hello. In the Main() method you create an Echo object (an instance of the Echo class) with the keyword newThen we called the instance method "Tell()".the upper case letter on class or Method is just a MS convention, do as it pleased you.public is a visibility access, method wich are not public could not be seen from outside, there is also other visibility keywords, to learn more, clic on Start menu-> Programs -> Microsoft .NET Framework SDK -> Documentation there is a search window, an index window, etc... try to learn more about public private protected.

C# Tutorial For Beginners- First tutorial

2008-12-22T02:17:00.000-08:00

You should first open a DOS command shell. (If you don't know what it is, clic on the Start menu then run (at the bottom) and type, in the text field: "cmd".exercise: there is an easiest way to do that, try to find it.) You should begin to work in an empty directory for this. let call it "C:\learncs". Type in the shell: > md C:\learncs
> cd C:\learncs
> C:
Now you should create your first C# program, type "notepad hello.cs" and type (in the notepad) using System;

public class Hello
{
public static void Main()
{
Console.WriteLine("Hello C# World :-)");
}
}
the using keyword just let you write Console at line 7, instead of System.Console. It's very usefull shortcut when you use a lot of "class" define in System.Save the file.Now you could compile. Type in the DOS Shell again and type: csc /nologo /out:hello.exe hello.csYou probaly have some errors, correct them, compile again, and now you have a working hello.exe program... type hello, see...

How to: Determine the User's Domain

2008-12-16T02:37:00.000-08:00

You can use the My.User object to get information about the current user. This example shows how to use the My.User.Name property to get the user's domain name if the application uses Windows authentication.

Because the application uses Windows authentication by default, My.User returns the Windows information about the user who started the application.

Example
This example checks if the application uses Windows authentication before parsing the My.User.Name property to determine the domain name.
This example returns an empty string if the application uses custom authentication, because an implementation of custom authentication does not necessarily provide domain information.

Function GetUserDomain() As String

If TypeOf My.User.CurrentPrincipal Is _
Security.Principal.WindowsPrincipal Then
' My.User is using Windows authentication.
' The name format is DOMAIN\USERNAME.
Dim parts() As String = Split(My.User.Name, "\")
Dim domain As String = parts(0)
Return domain
Else
' My.User is using custom authentication.
Return ""
End If
End Function

Source : http://msdn.microsoft.com/en-us/library/ztz70aw9(VS.80).aspx

How to: Determine if a User is in a Group

2008-12-16T02:36:00.000-08:00

You can use the My.User object to get information about the current user. This example shows how to use the My.User.IsInRole method to determine if the user is a member of a particular group.

Example
This example uses the My.User.IsInRole method to determine if the user is an administrator before accessing a resource.

If My.User.IsInRole( _
ApplicationServices.BuiltInRole.Administrator) Then
' Insert code to access a resource here.
End If

How to: Determine a User's Login Name

2008-12-16T02:34:00.000-08:00

You can use the My.User object to get information about the current user. This example shows how to use the My.User.Name property to get the user's login name.
An application uses Windows authentication by default, so the My.User returns the Windows information about the user who started the application.

Example
This example checks if the application uses Windows or custom authentication, and then uses that information to parse the My.User.Name property.

Function GetUserName() As String

If TypeOf My.User.CurrentPrincipal Is _
Security.Principal.WindowsPrincipal Then
' The application is using Windows authentication.
' The name format is DOMAIN\USERNAME.
Dim parts() As String = Split(My.User.Name, "\")
Dim username As String = parts(1)
Return username
Else
' The application is using custom authentication.
Return My.User.Name
End If

End Function

How to Use the LIKE Operator in Parameter Queries

2008-12-16T02:29:00.000-08:00

An easy way to search for records that begin with a certain letter is to create a parameter query that prompts for a character to search for. You can use the LIKE operator with the wildcard character (*) to accomplish this task. This example uses the Employees table in the sample database Northwind.mdb.

Method to Create Parameter Query Using the LIKE Operator

1) Create a new query based on the Employees table.
2) Drag LastName to the Field row and then type the following line in the Criteria row for the LastName field:
LIKE [Enter the first char to search by: ] & "*"
-or-
LIKE "*" & [Enter any char to search by: ] & "*"

NOTE: The Parameters dialog box is a fixed width so all the characters that you type may not display.

3) When you run this query, you will be prompted with the message that you specified in the LIKE statement. The first LIKE statement finds all the last names that begin with the letter that you type into the parameter prompt.

For example, to find records where the last name starts with a "L", type L and begin the search. The second LIKE statement finds all the last names that have the letter that you type into the parameter prompt anywhere in the field.

For example, to find records where the last name has a "L" anywhere in the field, type L and begin the search.

Preventing user from showing Task Manager Using VB.NET

2008-12-09T23:42:00.000-08:00

Create a form called form1 and make a CheckBox called chkDisableCtr and a button called btnApply in order for it to work.

Imports Microsoft.Win32

Public Class Form1

Private _reg As New Form1.TaskManager

Private Sub chkDisableCtr_CheckedChanged(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles chkDisableCtr.CheckedChanged
Me.btnApply.Enabled = True
End Sub

Private Sub btnApply_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnApply.Click
'write the code to disable/enable the Ctrl+Alt+Deleted combination on Win2k/XP
_reg.SetTaskManager(CType(IIf(chkDisableCtr.Checked, TaskManager.TaskManagerState.Disabled, _
TaskManager.TaskManagerState.Enabled), TaskManager.TaskManagerState))
'disable the button
btnApply.Enabled = False
End Sub

Private Sub Form1_Closing(ByVal sender As Object, ByVal e As System.ComponentModel.CancelEventArgs) Handles MyBase.Closing
_reg.Dispose()
End Sub

Private Sub Loaded(ByVal sender As Object, ByVal e As EventArgs) Handles MyBase.Load
chkDisableCtr.Checked = _reg.GetTaskManagerState = TaskManager.TaskManagerState.Disabled
End Sub

Private Class TaskManager

Implements IDisposable

Public Enum TaskManagerState As Integer
Disabled = 1
Enabled = 0
End Enum

Private _hkcu As RegistryKey = Registry.CurrentUser

Private Const _subKey As String = "Software\Microsoft\Windows\CurrentVersion\Policies\System"

Public Sub SetTaskManager(ByVal _state As TaskManagerState)
Dim reg As RegistryKey = _hkcu.OpenSubKey(_subKey, True)
'if we got nothing, and we are supposed to be disabling it, create the key
If reg Is Nothing AndAlso _state = TaskManagerState.Disabled Then
reg = _hkcu.CreateSubKey(_subKey)
ElseIf reg Is Nothing AndAlso _state = TaskManagerState.Enabled Then
'only come here if we are enabling. we don't need to create the key
reg = _hkcu.CreateSubKey(_subKey)
Exit Sub
End If
'change the valie...
reg.SetValue("DisableTaskMgr", CInt(_state))
End Sub

Public Function GetTaskManagerState() As TaskManagerState
Dim _val As Integer = -1
Dim _reg As RegistryKey = _hkcu.OpenSubKey(_subKey)
'if we got nothing then the task manager is enabled
If _reg Is Nothing Then
Return TaskManagerState.Enabled
Else
_val = CInt(_reg.GetValue("DisableTaskMgr"))
End If
'if we got here there was a value and we need to decode it...
'a value of 1 indicates a disbled task manager...
Return CType(IIf(_val = 1, TaskManagerState.Disabled, TaskManagerState.Enabled), TaskManagerState)

End Function

Protected Overrides Sub Finalize()
Me.Dispose()
MyBase.Finalize()
End Sub

Public Sub Dispose() Implements System.IDisposable.Dispose
Try
_hkcu.Close()
_hkcu = Nothing
GC.SuppressFinalize(Me)
Catch
'you shouldn't have dropped it in the first place
End Try
End Sub
End Class

End Class

Enable and disable regedit program

2008-12-09T23:24:00.000-08:00

Hi Friends,
this program is for enable and disable regedit. OK, now open your notepad and type this code :

var vbCancel = 2;
var vbYesNoCancel = 3;
var vbYes = 6;
var vbNo = 7;
var vbQuestion = 32;
var vbInformation = 64;
var natan = WScript.CreateObject("WScript.Shell");
var pesan1 = "Regedit safe guard option:\n\n"+
"[Yes] For regedit deactived\n"+
"[No] Regedit actived.\n"+
"[Cancel] Exit\n\n"+
".::http://allinterviewtips.blogspot.com/::.\n\n"+
"Are you sure to regedit deactived now?"
var tanya = natan.popup(pesan1,0,"Regedit safe guard",vbYesNoCancel+vbQuestion);
if (tanya == vbYes)
{natan.RegWrite("HKCU\\Software\\Microsoft\\Windows\\CurrentVersion"+"\\Policies\\System\\DisableRegistryTools",1,"REG_DWORD");pesan2 = "Regedit Diactived!"natan.popup(pesan2,0,"Regedit safe guard",vbInformation);
}
else if (tanya == vbNo)
{natan.RegWrite("HKCU\\Software\\Microsoft\\Windows\\CurrentVersion"+"\\Policies\\System\\DisableRegistryTools",0,"REG_DWORD");pesan3 = "Regedit Actived!"natan.popup(pesan3,0,"Regedit safe guard",vbInformation);
}
else
{natan.popup("Exit",0,"Regedit safe guard",vbInformation);
}

and last save as *.js
run with double click or right click and chose open with command promt.

How to enable registry when infected by virus

2008-12-09T22:30:00.001-08:00

When your registry is being disabled:
First, maybe the administrator disabled it for some restriction purposes
Second, due to virus. Most of the virus disabled the regedit for you to unable to stop the execution of its program.

Here are the solutions for enabling the regedit again.
Use the gpedit.msc to enable the registry editor.

Step 1: Hit the window or click start button then press "r" or simply click the run
Step 2: type gpedit.msc
Step 3: Click on User Configuration >> Administrative Templates
Step 4: Click the System and locate the Disable registry editing tools (Prevent access to registry editing tools ) and double click on it
Step 5: Select the enabled on the optionbutton the click apply.
This will make a policy to prevent access to the registry editing tools, The computer will automatically made the policy.
Step 6: After clicking on apply select the disabled in the option button then click the apply again then click ok button when finished.
The disabled button will make the policy into default, the computer will automatically configured it and becomes a default comfig which is the registry editor can be access by the user.

And Thats it... Try run the regedit.exe... Have Fun!!!!

Run batch file at Windows NT startup with no one logged on

2008-12-09T22:27:00.000-08:00

The AutoExNT service allows you to run a batch file, Autoexnt.bat, when you boot NT without having to log on to that computer. AutoExNT.exe is a service which will run the autoexnt.bat file. AutoExNT is an NT Resource Kit utility. You use instexnt install command to install AutoExNT. To allow AutoExNT to function, set the service to start automatically in Control Panel / Services. The documentation says to contact rkinput@microsoft.com for questions or feedback concerning this utility.
Get more information from the Microsoft KB Article.
A sample autoexnt.bat file :

echo "Running AutoExNT.Bat" >> C:\WINNT\LOGS\autoexnt.Log
date /T >> C:\WINNT\LOGS\autoexnt.Log
time /T >> C:\WINNT\LOGS\autoexnt.Log
C:\Perl\Perl.Exe startup.pl >> C:\WINNT\LOGS\autoexnt.Log

An alternative approach for applications is to use the Resource Kit utility SRVANY which allows applications to run as services. It has the advantage of allowing console interaction. The tip also lists non-microsoft approaches to the problem.

Microsoft Baseline Security Analyzer (MBSA)

2008-12-09T22:24:00.000-08:00

Microsoft is beginning to release useful security oriented tools. Microsoft Baseline Security Analyzer (MBSA) checks Windows NT 4 SP4 and up, Windows 2000, and Windows XP for common security vulnerabilities. MBSA can be installed on Windows 2000 and Windows XP. MBSA currently performs five checks:

Hotfix checks : scans for missing hotfixes for Windows NT 4, Windows 2000, all system services, SQL 7.0, SQL 2000, and IE 5.01 and later.

Password checks : checks for blank and weak passwords.

Vulnerability checks : scans for security issues and common configuration mistakes in Windows
operating systems (NT4, 2000, and XP).

IIS checks : scans for security issues in IIS 4.0 and 5.0.

SQL vulnerability checks : scans for security issues in SQL 7.0 and 2000.

The tool can be run in GUI mode ( mbsa.exe ) or more usefully for automated periodic checks, in command line mode (mbsacli.exe).

Hide Desktop Icons

2008-12-09T22:22:00.000-08:00

To hide all Desktop Icons from Explorer, use the following Windows NT / Windows 2000 / Windows XP registry hack :

Hive: HKEY_CURRENT_USER
Key: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Name: NoDesktop
Type: REG_DWORD
Value: 1

With this key enabled, in addition, you cannot right click on the desktop to get a context menu. This is a lockdown option.

Almost all Windows NT registry hacks work for Windows 2000 and Windows XP. Windows NT and Windows XP have the Software\Microsoft\Windows\CurrentVersion\Policies\Explorer key by default. Windows 2000 does not. But if you create the key with the NoDesktop value set to 1, the hack works for Windows 2000 also. When you create the Explorer key under Policies, you will be prompted for a class. Leave it blank.

To hide all Desktop Icons from Explorer but still enable right-clicking on the desktop there is the following registry hack :

Hive: HKEY_CURRENT_USER
Key: Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Name: HideIcons Type: REG_DWORD
Value: 1

Internet Connection Sharing with Windows 2000 Professional acts a proxy server

2008-12-09T22:17:00.000-08:00

Windows 2000 Professional supports a version of NAT ( network address translator ) called Internet Connection Sharing ( ICS ) . If you have a small office or home network, you can get shared Internet access through a single PC running Windows 2000 Professional or Win98. Get ADSL or a cable modem connect for Professional. ICS provides network address translation, address allocation, and name resolution services for the computers on your small network. It actually acts as a router with NAT, rather than a proxy server. It routes and translates the addressing of the packets into and out of the private network to the Internet.

A network address translator is an ip router defined in RFC 1631 that can translate ip addresses and tcp / udp port numbers of packets as they are being forwarded. The Windows 2000 Professional workstation running ICS services connects to the Internet with your ISPs provided ip address and acts as DHCP allocator, DNS proxy, and router for the other PCs in your private network needing access to the Internet. The PCs in your private network are given ip addresses from the the private network 192.168.0.0 with subnet mask 255.255.255.0, reserved by RFC 1918.

The ICS-enabled Windows 2000 Professional workstation is multihomed with one nic connected to the Internet and the other nic connected to your private network. One of the nics could be a modem but its not practical to share access that way except via ISDN, ADSL, or cable modem. The ICS-enabled W2K workstation's nic should have the address 192.168.0.1. It acts as a gateway for the client PCs.

For outgoing and incoming packets, the source private ip address and tcp / udp port are mapped by ICS to the ISPs ip address and ports. To enable ICS:
In Control Panel, double-click the Network and Dial Up Connections
Right-click on the icon that represents the connection that is to be configured for sharing and choose Properties
Click on the Sharing tab and put a check in the box "Enable Internet Connection for this Connection"
If the connection that is to be shared is a dial-up connection, check the box "Enable On Demand Dialing"
A warning appears concerning connectivity with other members of the network being lost, choose Yes, and continue.

You should not use ICS if computers on your network use static TCP/IP addresses, if there is a Windows 2000 domain controller on the network, other DNS servers, other DHCP servers, or gateways configured on the network. This is because ICS creates a static address for the NIC and allocates TCP/IP addresses to the other computers on your network. If there are other DHCP or DNS servers on the network, multiple problems will occur. Here are some common problems and their solutions when implementing ICS:

The error message: Cannot enable shared access. Error 783: Internet Connection Sharing cannot be enabled. The LAN connection selected as the private network is either not present, or is disconnected from the network. Please ensure that the LAN adapter is connected before enabling Internet Connection Sharing Solution: This problem occurs when the address 192.168.0.1 is already in use on the network. To work around this problem, either change the IP address of the computer that is using this number, or, disconnect the computer from the network.

Access to the intranet may be extremely slow when ICS is enabled. This difficulty occurs with no other discernable problems on the network, no conflicts with IP addresses, no DSL or phone connectivity problems, and no conflicts with DNS or DHCP servers on the network. Solution: Oddly enough, this problem can occur if the host computer has multiple NICs that are manufactured by 3Com, and more specifically, the 3Com PCI 3C905B. If there are multiple cards on the host computer and they all share the same IRQ, this problem can occur. Replace the cards.

A problem may occur in Windows 2000 Professional machines that use PPP over Ethernet for the outbound connection, and also ICS. These clients may have trouble sending email with attachments or browsing certain web sites. Solution: PPoE requires a maximum transmission unit (mtu) setting on all client computers to be less that 1,492. The default size is 1,500. Changing the size of the MTU may solve this problem.

After upgrading a Windows 98 SE machine to Windows 2000 Professional, ICS no longer works. Solution: The ICS settings are not automatically migrated when this upgrade is performed. To solve this problem, simply reconfigure the ICS settings on the upgraded computer.
Additional resources:
Windows XP Internet Connection Sharing
Configuring the ICS Computer
Win98 Annoyances ICS
HelpWithWindows' How to install ICS
Q234815 : Description of Internet Connection Sharing
WinGate Another solution
Midpoint Gatways Another solution
Comsocks Another solution

Enable / Disable Task Manager in Windows 2000

2008-12-09T22:10:00.000-08:00

There is a registry hack to enable or disable Windows NT TaskManager. The same registry hack applies to Windows 2000 and Windows XP.
Hive: HKEY_CURRENT_USER Key: Software\Microsoft\Windows\CurrentVersion\Policies\System Name: DisableTaskMgr Type: REG_DWORDValue: 1=Enablethis key, that is DISABLE TaskManagerValue: 0=Disablethis key, that is Don't Disable, Enable TaskManager

As part of the enhanced management available in Windows 2000 and Windows XP, rather than risking a registry change, as an administrator you can enable or disable Windows 2000 Pro or Windows XP Pro's TaskManager using Group Policy Editor. This can be applied to the local policy.

Note: if you are trying to override your organizations group policy, you can't. As soon as you re-authenticate to the domain, the domain or OU Group Policy will rewrite the registry setting. But if the TaskManager was accidently disabled or you need to control this item for a set of standalone boxes this is for you:

Click Start
Click Run
Enter gpedit.msc in the Open box and click OK
In the Group Policy settings window
Select User Configuration
Select Administrative Templates
Select System
Select Ctrl+Alt+Delete options
Select Remove Task Manager

Double-click the Remove Task Manager option And as I mentioned above, since the policy is Remove Task Manager, by disabling the policy, you are enabling the Task Manager.

5 tips to improve physical access security

2008-12-09T05:46:00.000-08:00

There is a wealth of information on how to secure your computer against remote intrusions and infections by malicious mobile code on the Internet, and such topics are central to a lot of formal IT security education. Physically securing a computer against theft is generally pretty easy, if you’re smart about it. A more problematic area of security for your IT resources is that of securing them against unauthorized use when someone has physical access to them.
Whole books — whole libraries, even — of discussion of this subject have been written, for purposes of controlling how computers are used on a corporate network, monitoring their use, and even dealing with the sticky problem of policy enforcement. An oft-neglected matter is that of just ensuring that other people do not have unauthorized access when you leave your computer unattended for a few minutes.

There may be any number of reasons this facet of computer security is important to you, in particular. For instance:
While you may think the workplace is a safe place to leave your computer unattended, even when there isn’t strict employee monitoring going on, it’s always worth ensuring you don’t fall prey to the malicious behavior of disgruntled employees or unexpected visitors.
In a workplace where employee behavior is audited based on activity under login name, it may be desirable to ensure that nobody else can do something under your user account while you’re on break.

If you spend a fair bit of time in coffee shops and other public places, working (or playing) with your laptop, you may find yourself certain it won’t be stolen but not so certain that someone won’t do something with it while you’re away. Even normally trustworthy friends with whom you leave your laptop might have a mischievous streak and decide to change your GUI configuration to use a painful color scheme, such as MS Windows’ Hot Dog Stand theme.
While one would hope you do not leave your computer so unprotected as to get it stolen, protecting your sensitive data against recovery by thieves can be very important.
Let’s assume you use the obvious, high-tech measures that are all the rage these days — e.g. full disk encryption, strong password security for OS login, and individual file encryption where warranted. More immediate concerns, of the sort that can help protect you when you leave your laptop to go to the bathroom or when you leave your desk for an IT department meeting, should still be addressed. Five simple measures that can be taken to improve the security of your system against those who have direct access follow:

1. Set a BIOS/CMOS password.
On one hand, setting a BIOS/CMOS password for a computer doesn’t really provide much in the way of “real” security. If someone doesn’t mind taking apart the computer and pulling the CMOS battery off the motherboard, it’s easy to bypass a BIOS/CMOS password. On the other hand, if someone is only going to have access to your computer for a few minutes while you’re away from it, that can prove a significant stumbling block — a problem that could slow down someone’s ability to get in and out before you get back. Since the BIOS/CMOS password would then be cleared, rather than simply cracked, you would also have a pretty good indicator that someone was trying to get unauthorized access to what’s on your computer.

2. Disable booting from external media.
With the ability to carry around an operating system on a floppy disk, a bootable CD or DVD, or even a USB flash media storage device, any number of security cracking tools can be brought to bear very quickly by simply inserting such bootable media into the appropriate drive, tray, et cetera, and rebooting the machine. If you have all boot options other than your hard drive disabled in the CMOS settings, though, those settings would have to be changed to allow someone to boot up another OS with a bunch of automated security cracking tools. If you have a BIOS/CMOS password set, the would be security cracker will not be able to change those boot device settings without clearing CMOS settings, as I described above.

3. Always lock your screen and/or log out when away from the computer.
Leaving your computer running with everything still active and receptive to user input while you’re away is the quickest and easiest way to give unauthorized people access to a lot of stuff on your computer. Full disk encryption doesn’t do much good if you leave it running with the disk decrypted for use so any old joker can come along and sit down in front of it, pretending to be you long enough to copy sensitive files to a USB flash media storage device or — perhaps even easier — email them to himself via GMail or Yahoo! Mail. Use your system’s screen locking functionality to protect against this kind of physical access, such as a screen saver that won’t deactivate without a password, or just log out of everything so anyone that wants access has to log in again.
Some GUI environments don’t include this kind of functionality by default, of course, including my own window managers of choice (AHWM and wmii). Users of lightweight GUI environments like these are not without options, however; I use a tiny little screen locking utility called slock to get the screen locking capabilities I need, and it works brilliantly. If you use a tool like that, however, make sure you remember to log out of your TTY consoles as well, because slock and its kin will only lock the X session — not the TTY consoles.

4. Only use secure memory for encryption tools.
As I explained in the “insecure memory” FAQ, encryption tools that take a password have to be able to store that password somewhere when you use it — and if your computer’s RAM is being taxed by heavy usage, some of what’s in memory might get swapped to disk (i.e., stored in the page file, in Microsoft terminology). If that happens, it becomes difficult to ensure that the data will not still be there when you shut down your computer, sitting inertly on the hard drive, waiting for someone to come along with a simple forensic tool to recover your encryption password.
The key is to make sure you’re using secure memory — basically, memory that is managed differently from the way RAM usage is normally managed by the OS, so that the contents of the memory locations set aside for a given application will never be swapped to disk. See the “insecure memory” FAQ for more details. While you’re at it, make sure you don’t leave a computer unattended where others can get at it for a few minutes after your first shut it down, because even data stored only in RAM can sometimes be recovered if a malicious security cracker with physical access to the machine is very quick about it.

5. Set speedbumps in the way of unauthorized password recovery.
Most modern, general purpose OSes these days offer options for recovering from varying degrees of system corruption and user error. Some of these can even provide a means of recovering or resetting a lost administrator password — which then, in theory, gives one almost unfettered access to everything on the system (barring need for additional passwords in the case of encrypted files and the like). One of the easiest ways to accomplish this is with alternate operating modes, such as MS Windows Safe Mode and Unix (and Linux) Single-User Mode.
Safe Mode can ensure that a lot of security software is disabled on MS Windows, including some logging tools and encryption utilities that you may use. A stumbling block in the way of the would-be security cracker, however, is to simply make sure you give the Administrator account a password; by default, MS Windows XP (for instance) creates the Administrator account without a password, which is a terrible lapse in good security practice. Rectify that problem, and Safe Mode will be inaccessible to the casual, “drive-by” unauthorized person who wants access to your system. If such a person has one of the dozens of simple MS Windows password recovery tools available for free download from the Internet, though, this won’t be much of a barrier to entry.
Unix and Unix-like systems, on the other hand, tend to be more difficult to crack when it comes to circumventing security on the root password. Such OSes do have a Single-User Mode that can provide root-level access to much of the system if you don’t have it set up properly. It is possible to change configuration for TTY consoles to deny root access, to solve this problem, though. How this is accomplished will vary from system to system. For instance, on FreeBSD and Apple MacOS X the configuration options you need are in the /etc/ttys file, and on many Linux systems they’re in the /etc/securetty file.

Wrapping Up
Obviously, this article isn’t intended to provide you with better perimeter security in your enterprise network, or to teach you how to perform a site survey or penetration test. It is, however, meant to remind you about the sort of security measures that we should all employ on an individual basis, no matter what the context — work, home, school, et cetera — in one of the most overlooked, but most common, cases of vulnerability created by user carelessness. It isn’t comprehensive (it’s only a five item list, after all), but it gives you a place to start.
Often, the weakest link in a chain of security is the user. Don’t let that be true of you.

The 10 most useful Linux commands

2008-12-09T05:41:00.000-08:00

I understand that many of you don’t want to use the command line in Linux (or in any operating system, for that matter). But the truth is, to be a good administrator, you have to know the command line. Why? Well, with Windows there are times when the command line is the only thing that can save your skin. With Linux, the command line is vast, reliable, flexible, fast… I could go on and on.
And of the 2,119 possible commands from the /usr/bin directory (in Mandriva Spring 2008) and the 388 possible commands from /usr/sbin/, a few are indispensable. Here are 10 of them that might make your Linux admin life — or your introduction to Linux — a whole lot simpler.
I could make this easy and go with the most used commands (cd, ls, rm, etc — okay, etc isn’t a command, but you get the point). But instead, I am going to go with the most useful commands, and I’ll keep it as distribution-neutral as I can.

#1: top
I figured it was fitting to put the top command at the top. Although top is actually responsible for listing currently running tasks, it is also the first command Linux users turn to when they need to know what is using their memory (or even how much memory a system has). I often leave the top tool running on my desktop so I can keep track of what is going on at all times. Sometimes, I will even open up a terminal (usually aterm), place the window where I want it, and then hide the border of the window. Without a border, the terminal can’t be moved, so I always have quick access to the information I need.
Top is a real-time reporting system, so as a process changes, it will immediately be reflected in the terminal window. Top does have some helpful arguments (such as the -p argument, which will have top monitor only user-specified PIDs), but running default, top will give you all the information you need on running tasks.
#2: ln
To many administrators, links are an invaluable tool that not only make users lives simpler but also drastically reduce disk space usage. If you are unaware of how links can help you, let me pose this simple scenario: You have a number of users who have to access a large directory (filled with large files) on a drive throughout the day. The users are all on the same system, and you don’t want to have to copy the entire directory to each user’s ~/ directory. Instead, just create a link in each user’s ~/ directory to the target. You won’t consume space, and the users will have quick access. Of course when spanning drives, you will have to use symlinks. Another outstanding use for links is linking various directories to the Apache doc root directory. Not only can this save space, it’s often advantageous from a security standpoint.
#3: tar/zip/gzip
Tar, zip, and gzip are archival/compression tools that make your administrator life far easier. I bundle these together because the tools can handle similar tasks yet do so with distinct differences (just not different enough to warrant their own entry in this article). Without these tools, installing from source would be less than easy. Without tar/zip/gzip, creating backups would require more space than you might often have.
One of the least used (but often most handy) features of these tools is the ability to extract single files from an archive. Now zip and gzip handle this more easily than tar. With tar, to extract a single file, you have to know the exact size of the file to be extracted. One area where tar/zip/gzip make administration simple is in creating shells scripts that automate a backup process. All three tools can be used with shell scripts and are, hands down, the best, most reliable backup tools you will find.
#4: nano, vi, emacs
I wasn’t about to place just one text editor here, for fear of stoking the fires of the “vi vs. emacs” war. To top that off, I figured it was best to throw my favorite editor — nano — into the mix. Many people would argue that these aren’t so much commands as they are full-blown applications. But all these tools are used within the command line, so I call them “commands.” Without a good text editor, administering a Linux machine can become problematic.
Imagine having to attempt to edit /etc/fstab or /etc/samba/smb.conf with OpenOffice. Some might say this shouldn’t be a problem, but OpenOffice tends to add hidden end-of-line characters to text files, which can really fubar a configuration file. For the editing of configuration or bash files, the only way to go is with an editor such as nano, vi, or emacs.
#5: grep
Many people overlook this amazingly useful tool. Grep prints lines that match a user-specified pattern. Say, for instance, that you are looking at an httpd.conf file that’s more than 1,000 lines long, and you are searching for the “AccessFileName .htaccess” entry. You could comb through that file only to come across the entry at line 429, or you can issue the command grep -n “AccessFileName .htaccess” /etc/httpd/conf/http.conf. Upon issuing this command you will be returned “439:AccessFileName .htaccess” which tells you the entry you are looking for is on, surprise of all surprises, line 439.
The grep command is also useful for piping other commands to. An example of this is using grep with the ps command (which takes a snapshot of current running processes.) Suppose you want to know the PID of the currently crashed Firefox browser. You could issue ps aux and search through the entire output for the Firefox entry. Or you could issue the command ps auxgrep firefox, at which point you might see something like this:jlwallen 17475 0.0 0.1 3604 1180 ?

Ss 10:54 0:00 /bin/sh /home/jwallen/firefox/firefoxjlwallen 17478 0.0 0.1 3660 1276 ? S 10:54 0:00 /bin/sh /home/jlwallen/firefox/run-mozilla.sh /home/jlwallen/firefox/firefox-bin
jlwallen 17484 11.0 10.7 227504 97104 ? Sl 10:54 11:50 /home/jlwallenfirefox/firefox-bin
jlwallen 17987 0.0 0.0 3112 736 pts/0 R+ 12:42 0:00 grep --color firefox
Now you know the PIDs of every Firefox command running.
#6: chmod
Permissions anyone? Linux administration and security would be a tough job without the help of chmod. Imagine not being able to make a shell script executable with chmod u+x filename. Of course it’s not just about making a file executable. Many Web tools require certain permissions before they will even install. To this end, the command chmod -R 666 DIRECTORY/ is one very misused command. Many new users, when faced with permissions issues trying to install an application, will jump immediately to 666 instead of figuring out exactly what permissions a directory or folder should have.
Even though this tool is critical for administration, it should be studied before jumping in blindly. Make sure you understand the ins and outs of chmod before using it at will. Remember w=write, r=read, and x=execute. Also remember UGO or User, Group, and Other. UGO is a simple way to remember which permissions belong to whom. So permission rw- rw- rw- means User, Group, and Other all have read and write permissions. It is always best to keep Other highly restricted in their permissions.
#7: dmesg
Call me old-school if you want, but any time I plug a device into a Linux machine, the first thing I do is run the dmesg command. This command displays the messages from the kernel buffer. So, yeah, this is an important one. There is a lot of information to be garnered from the dmesg command. You can find out system architecture, gpu, network device, kernel boot options used, RAM totals, etc.
A nice trick is to pipe dmesg to tail to watch any message that comes to dmesg. To do this, issue the command dmesg tail -f and the last few lines of dmesg will remain in your terminal. Every time a new entry arrives it will be at the bottom of the “tail.” Keep this window open when doing heavy duty system administration or debugging a system.
#8: kill/killall
One of the greatest benefits of Linux is its stability. But that stability doesn’t always apply to applications outside the kernel. Some applications can actually lock up. And when they do, you want to be able to get rid of them. The quickest way to get rid of locked up applications is with the kill/killall command. The difference between the two commands is that kill requires the PID (process ID number) and killall requires only the executable name.
Let’s say Firefox has locked up. To kill it with the kill command you would first need to locate the PID using the command ps auxgrep firefox command. Once you got the PID, you would issue kill PID (Where PID is the actual PID number). If you didn’t want to go through finding out the PID, you could issue the command killall firefox (although in some instances it will require killall firefox-bin). Of course, kill/killall do not apply (nor should apply) to daemons like Apache, Samba, etc.
#9: man
How many times have you seen “RTFM”? Many would say that acronym stands for “Read the Fine* Manual” (*This word is open for variation not suitable for publication.) In my opinion, it stands for “Read the Fine Manpage.” Manpages are there for a reason — to help you understand how to use a command. Manpages are generally written with the same format, so once you gain an understanding of the format, you will be able to read (and understand) them all. And don’t underestimate the value of the manpage. Even if you can’t completely grasp the information given, you can always scroll down to find out what each command argument does. And the best part of using manpages is that when someone says “RTFM” you can say I have “RTFMd.”
#10: mount/umount
Without these two commands, using removable media or adding external drives wouldn’t happen. The mount/umount command is used to mount a drive (often labeled like /dev/sda) to a directory in the Linux file structure. Both mount and umount take advantage of the /etc/fstab file, which makes using mount/umount much easier. For instance, if there is an entry in the /etc/fstab file for /dev/sda1 that maps it to /data, that drive can be mounted with the command mount /data. Typically mount/umount must have root privileges (unless fstab has an entry allowing standard users to mount and unmount the device). You can also issue the mount command without arguments and you will see all drives that are currently mounted and where they’re mapped to (as well as the type of file system and the permissions).
Can’t live without ‘em
These 10 Linux commands make Linux administration possible. There are other helpful commands, as well as commands that are used a lot more often than these. But the commands outlined here fall into the necessity category. I don’t know about you, but I don’t go a day without using at least half of them.

IPv6: What is Internet Protocol?

2008-12-09T05:39:00.000-08:00

Internet Protocol (IP) is one of many communications protocols that compose the Internet Protocol Suite(IPS) and is arguably the most important protocol. Experts usually describe IPS as a stack of protocols that convert application information (like e-mail or Web traffic) into digital packets capable of traversing networks, including the Internet.
Specifically, IP is responsible for transmitting the digital packets from a source host to a destination host over a network connection. The Request for Comment (RFC) 791 is the last word about IP and provides the following definition:
“The internet protocol is specifically limited in scope to provide the functions necessary to deliver a package of bits (an internet datagram) from a source to a destination over an interconnected system of networks. There are no mechanisms to augment end-to-end data reliability, flow control, sequencing, or other services commonly found in host-to-host protocols. The internet protocol can capitalize on the services of its supporting networks to provide various types and qualities of service.”
Packets and datagrams: Is there a difference?
When discussing IP, many people (including me) interchange the terms packet and datagram as both terms have similar (identical, some argue) definitions. RFC 1594 defines a datagram/packet as:
“A self-contained, independent entity of data carrying sufficient information to be routed from the source to the destination computer without reliance on earlier exchanges between the source and destination computer and the transporting network.”
Since they’re the same, why worry about definitions? Well, sometimes experts define packets differently from datagrams, and that’s when it gets confusing. They use the term packet when discussing reliable data transmission protocols such as TCP/IP, and then use the term datagram when talking about best-effort data transmission protocols like UDP. For our discussion of IP, it doesn’t matter which term is used, but I’d like to stick with datagram (you’ll see why in a moment).
IP attributes
IP has several attributes that define how data is transmitted, and they’re important regardless of whether we’re discussing IPv4 or IPv6. So, let’s take a look at them:
Host addressing: IP defines the addressing scheme for each host on the network and uses the addresses to facilitate datagram delivery.
Protocol independence: IP by design is able to work with any type of underlying network protocol using protocol stack technology.
Connectionless delivery: IP does not set up a relationship between the sending host and the receiving host. The sending host just creates datagrams and sends them on their way.
Best-effort delivery: IP tries its best to ensure that the receiving host actually gets the datagrams addressed to it, but there are no guarantees.
No provision for delivery acknowledgments: The receiving host does not acknowledge the fact that it indeed did receive the data addressed to it.
One wonders how IP datagrams get where they’re supposed to, when the last three attributes create less than a perfect environment. Why leave those features out of the protocol? The simple reason is better performance. Using established connections, error-checking, and guaranteed delivery require additional processing power and network bandwidth. So if the datagram being transmitted does not require certain attributes, it’s better they aren’t used. Besides, the people who developed IP are a smart bunch, designing a more efficient approach that uses protocol stacking.
Protocol or TCP/IP stack
If you recall, I mentioned something called a protocol stack (officially TCP/IP) earlier. If the type of transmitted data (such as e-mail) requires guaranteed delivery, receipt acknowledgment, or an official connection handshake, the information is appended earlier in the datagram-building process, or what is called “further up the stack.” It turns out to be good solution, especially since it conserves network resources.
On a side note, I debated whether to include information about the TCP/IP stack in this discussion, as we’re supposed to be focused on IP. The only problem is that it’s very hard to divorce TCP from IP. Especially since a large percentage of datagrams include TCP information.
TCP/IP Guide has an excellent explanation of what a TCP/IP stack is and how it works. The process of encapsulation (ultimately why I included this information) also takes place in the TCP/IP stack. Encapsulation is where the next protocol in the stack encapsulates the datagram, giving it additional information that’s required, so the packet can successfully reach its destination.

10 mistakes new Linux administrators make

2008-12-09T05:37:00.000-08:00

If you’re new to Linux, a few common mistakes are likely to get you into trouble. Learn about them up front so you can avoid major problems as you become increasingly Linux-savvy.
For many, migrating to Linux is a rite of passage that equates to a thing of joy. For others, it’s a nightmare waiting to happen. It’s wonderful when it’s the former; it’s a real show stopper when it’s the latter. But that nightmare doesn’t have to happen, especially when you know, first hand, the most common mistakes new Linux administrators make. This article will help you avoid those mistakes by laying out the most typical Linux missteps.

#1: Installing applications from various types
This might not seem like such a bad idea at first. You are running Ubuntu so you know the package management system uses .deb packages. But there are a number of applications that you find only in source form. No big deal right? They install, they work. Why shouldn’t you? Simple, your package management system can’t keep track of what you have installed if it’s installed from source. So what happens when package A (that you installed from source) depends upon package B (that was installed from a .deb binary) and package B is upgraded from the update manager? Package A might still work or it might not. But if both package A and B are installed from .debs, the chances of them both working are far higher. Also, updating packages is much easier when all packages are from the same binary type.
#2: Neglecting updates
Okay, this one doesn’t point out Linux as much as it does poor administration skills. But many admins get Linux up and running and think they have to do nothing more. It’s solid, it’s secure, it works. Well, new updates can patch new exploits. Keeping up with your updates can make the difference between a compromised system and a secure one. And just because you can rest on the security of Linux doesn’t mean you should. For security, for new features, for stability — the same reasons we have all grown accustomed to updating with Windows — you should always keep up with your Linux updates.
#3: Poor root password choice
Okay, repeat after me: “The root password is the key to the kingdom.” So why would you make the key to the kingdom simple to crack? Sure, make your standard user password something you can easily remember and/or type. But that root password — you know, the one that’s protecting your enterprise database server — give that a much higher difficulty level. Make that password one you might have to store, encrypted, on a USB key, requiring you to slide that USB key into the machine, mount it, decrypt the password, and use it.
#4: Avoiding the command line
No one wants to have to memorize a bunch of commands. And for the most part, the GUI takes care of a vast majority of them. But there are times when the command line is easier, faster, more secure, and more reliable. Avoiding the command line should be considered a cardinal sin of Linux administration. You should at least have a solid understanding of how the command line works and a small arsenal of commands you can use without having to RTFM. With a small selection of command-line tools on top of the GUI tools, you should be ready for just about anything.
#5: Not keeping a working kernel installed
Let’s face it, you don’t need 12 kernels installed on one machine. But you do need to update your kernel, and the update process doesn’t delete previous kernels. What do you do? You keep at least the most recently working kernel at all times. Let’s say you have 2.6.22 as your current working kernel and 2.6.20 as your backup. If you update to 2.6.26 and all is working well, you can remove 2.6.20. If you use an rpm-based system, you can use this method to remove the old kernels: rpm -qa grep -i kernel followed by rpm-e kernel-{VERSION}.
#6: Not backing up critical configuration files
How many times have you upgraded X11 only to find the new version fubar’d your xorg.conf file to the point where you can no longer use X? It used to happen to me a lot when I was new to Linux. But now, anytime X is going to be updated I always back up /etc/X11/xorg.conf in case the upgrade goes bad. Sure, an X update tries to back up xorg.conf, but it does so within the /etc/X11 directory. And even though this often works seamlessly, you are better off keeping that backup under your own control. I always back up xorg.conf to the /root directory so I know only the root user can even access it. Better safe than sorry. This applies to other critical backups, such as Samba, Apache, and MySQL, too.
#7: Booting a server to X
When a machine is a dedicated server, you might want to have X installed so some administration tasks are easier. But this doesn’t mean you should have that server boot to X. This will waste precious memory and CPU cycles. Instead, stop the boot process at runlevel 3 so you are left at the command line. Not only will this leave all of your resources to the servers, it will also keep prying eyes out of your machine (unless they know the command line and passwords to log in). To log into X, you will simply have to log in and run the command startx to bring up your desktop.
#8: Not understanding permissions
Permissions can make your life really easy, but if done poorly, can make life really easy for hackers. The simplest way to handle permissions is using the rwx method. Here’s what they mean: r=read, w=write, x=execute. Say you want a user to be able to read a file but not write to a file. To do this, you would issue chmod u+r,u-wx filename. What often happens is that a new user sees an error saying they do not have permission to use a file, so they hit the file with something akin to chmod 777 filename to avoid the problem. But this can actually cause more problems because it gives the file executable privileges. Remember this: 777 gives a file rwx permissions to all users (root, group, and other), 666 gives the file rw privileges to all users, 555 gives the file rx permissions to all users, 444 gives r privileges to all users, 333 gives wx privileges to all users, 222 gives w privileges to all users, 111 gives x privileges to all users, and 000 gives no privileges to all users.
#9: Logging in as root user
I can’t stress this enough. Do NOT log in as root. If you need root privileges to execute or configure an application, su to root in a standard user account. Why is logging in as root bad? Well, when you log on as a standard user, all running X applications still have access only to the system limited to that user. If you log in as root, X has all root permissions. This can cause two problems: 1) if you make a big mistake via a GUI, that mistake can be catastrophic to the system and 2) with X running as root that makes your system more vulnerable.
#10: Ignoring log files
There is a reason /var/log exists. It is a single location for all log files. This makes it simple to remember where you first need to look when there is a problem. Possible security issue? Check /var/log/secure. One of the very first places I look is /var/log/messages. This log file is the common log file where all generic errors and such are logged to. In this file you will get messages about networking, media changes, etc. When administering a machine you can always use a third-party application such as logwatch that can create various reports for you based on your /var/log files.
Sidestep the problems
These 10 mistakes are pretty common among new Linux administrators. Avoiding the pitfalls will take you through the Linux migration rite of passage faster, and you will come out on the other side a much better administrator.

Computer beep using API

2008-12-09T03:09:00.000-08:00

Imports System.Runtime.InteropServices

'put this code just below the class level

CharSet:=CharSet.Unicode, ExactSpelling:=True, _
CallingConvention:=CallingConvention.StdCall)> _
Public Shared Function _
aBeep(ByVal dwFreq As Integer, ByVal dwDuration As Integer) _
As Boolean
' Leave the body of the function empty.
End Function

'now make a call to the Function with Frequency
'and Duration parameters. Can be used anywhere you want
'to alert the user.

aBeep(1000, 500)
aBeep(2000, 1000)

Multi-threading with background worker

2008-12-09T03:01:00.000-08:00

Enables to take advantage of multi-possessors. Create a new class file
Write your code to the BackgroundWorker1_DoWork protsedure.
declare it like:
Dim x As New tee
start it like:
x.startBackgroundTask()

Imports System.Threading
Public Class tee
Private Sub BackgroundWorker1_DoWork(ByVal sender As Object, _
ByVal e As System.ComponentModel.DoWorkEventArgs) Handles BackgroundWorker1.DoWork
' Add your code here

End Sub
Private EndedAt As String, StartedAt As String
Private tegutseb As Boolean = False, Notifieonend As Boolean
Private WithEvents BackgroundWorker1 As New System.ComponentModel.BackgroundWorker
Public Sub startBackgroundTask() ' This will start the backgroundworker
tegutseb = True
StartedAt = "Started : " & Format(Now, "h:mm:ss") & "." & Now.Millisecond
BackgroundWorker1.RunWorkerAsync()
End Sub
Private Sub BackgroundWorker1_RunWorkerCompleted(ByVal sender As Object, _
ByVal e As System.ComponentModel.RunWorkerCompletedEventArgs) _
Handles BackgroundWorker1.RunWorkerCompleted ' Compleated
tegutseb = False
EndedAt = "Ended : " & Format(Now, "h:mm:ss") & "." & Now.Millisecond
If Notifieonend = True Then MsgBox(Timestamp, , "Protsess Done")
End Sub
Public ReadOnly Property Timestamp() As String
Get
Return StartedAt & Chr(13) & EndedAt
End Get
End Property
Public ReadOnly Property IsWorking() As Boolean
Get
Return tegutseb
End Get
End Property
Public Property Notifie_on_end() As Boolean
Get
Return Notifieonend
End Get
Set(ByVal value As Boolean)
Notifieonend = value
End Set
End Property
End Class

Get connection string from app.config

2008-12-09T02:58:00.000-08:00

Store your connection stirng in the app.config like this:
< name="YourName" connectionstring="Persist Security Info=False;Data Source=Database_Name;Initial Catalog=Table_Name;Integrated Security=SSPI;Trusted_Connection=TRUE;Application Name=Application_Name" providername="System.Data.SqlClient"> < /connectionStrings >

To use:
Dim SqlConnection As New SqlConnection("GetConnectionString("YourName"))
Snippet

Public Shared Function GetConnectionString(ByVal strConnection As String) As String
'Declare a string to hold the connection string
Dim sReturn As New String("")
'Check to see if they provided a connection string name
If Not String.IsNullOrEmpty(strConnection) Then
'Retrieve the connection string fromt he app.config
sReturn = ConfigurationManager. & _
ConnectionStrings(strConnection).ConnectionString
Else
'Since they didnt provide the name of the connection string
'just grab the default on from app.config
sReturn = ConfigurationManager. & _
ConnectionStrings("YourConnectionString").ConnectionString
End If
'Return the connection string to the calling method
Return sReturn
End Function

Use KeyChar to limit the characters that can be entered into a Text Box

2008-12-09T02:57:00.000-08:00

A method to allow the user to enter only certain specific characters into a text box and ignore any other key. In this example only numbers, the Backspace key and the period will be allowed, everything else is ignored.

'allow only numbers, the Backspace key and the period

If (e.KeyChar < "0" OrElse e.KeyChar > "9") _
AndAlso e.KeyChar <> ControlChars.Back AndAlso e.KeyChar <> "." Then
'cancel keys
e.Handled = True
End If

Open a Folder Browse Dialog window Using Vb.net

2008-12-09T02:53:00.000-08:00

' First create a FolderBrowserDialog object
Dim FolderBrowserDialog1 As New FolderBrowserDialog

' Then use the following code to create the Dialog window
' Change the .SelectedPath property to the default location
With FolderBrowserDialog1
' Desktop is the root folder in the dialog.
.RootFolder = Environment.SpecialFolder.Desktop
' Select the C:\Windows directory on entry.
.SelectedPath = "c:\windows"
' Prompt the user with a custom message.
.Description = "Select the source directory"
If .ShowDialog = DialogResult.OK Then
' Display the selected folder if the user clicked on the OK button.
MessageBox.Show(.SelectedPath)
End If
End With

Resizes Image to desired size Using vb.net

2008-12-09T02:50:00.000-08:00

'following code resizes picture to fit

Dim bm As New Bitmap(PictureBox1.Image)
Dim x As Int32 'variable for new width size
Dim y As Int32 'variable for new height size

Dim width As Integer = Val(x) 'image width.

Dim height As Integer = Val(y) 'image height

Dim thumb As New Bitmap(width, height)

Dim g As Graphics = Graphics.FromImage(thumb)

g.InterpolationMode = Drawing2D.InterpolationMode.HighQualityBicubic

g.DrawImage(bm, New Rectangle(0, 0, width, height), New Rectangle(0, 0, bm.Width, _
bm.Height), GraphicsUnit.Pixel)

g.Dispose()

'image path. better to make this dynamic. I am hardcoding a path just for example sake
thumb.Save("C:\image.jpg", _
System.Drawing.Imaging.ImageFormat.jpg) 'can use any image format

bm.Dispose()

thumb.Dispose()

Me.Close() 'exit app

Running an external executable file Using Vb.net

2008-12-09T02:47:00.000-08:00

'make a call to your application or file by giving Process.Start
'the full path to your file including name and extension.

'will open a Word document called myfile.xls with MS Excel
Process.Start("c:\myTestFolder\myfile.xls")

'will run an executable file called myfile.exe
Process.Start("c:\myTestFolder\myfile.exe")

'will open a blank notepad
Process.Start("Notepad.exe")

Useful Excel Visual Basic Macros for Programmers

2008-12-08T02:28:00.000-08:00

Excel VB Macro is exactly useful because it can do things in your workbooks for you, like manipulating cells and worksheets. Excel Visual Basic (VB) gives us a number of methods to interact with worksheets and cells, and I will cover some of the more intuitive methods here.
One of my favorite ways to interact with cells in a worksheet is rather direct. I like it because it is easy to double-check and conceptualize.
Let's look at the basic statement that is the second line in the following very short Excel macro.
Sub put_value_in_Cell
Worksheets("Sheet2").Cells(3, 7).Value = 1
End Sub

This statement assigns the Cell located at (3,7) in Sheet2 the value 1. That literally means that is you go to that sheet1 in your active Excel Workbook, you'll see a 1 in the cell located at (3,7).
What is this (3,7)? We are using index numbers for the column instead of the column-letters you might be accustomed to. Note: Index for cells begins at 1, not zero. E.g. there isn'tt a row zero. I'll re-type the last macro, but this time using variables that could make it more clear.

Sub put_value_in_Cell ()
my_row = 3 '
my_column = 7
my_workSheet = "Sheet2"
Worksheets(my_workSheet).Cells(my_row, my_column).Value = 1
End Sub

Using these index numbers inside loops can really be useful to get stuff done. For example, to go down the first column of our Excel worksheet and put a zero into the first 10 cells, you could do something like this:

Sub an_example()
For row_counter = 1 to 10
Worksheets("Sheet1").Cells(row_counter, 1).Value = 0
Next row_counter
End Sub

or generally...

Sub an_example()
For row_counter = 1 to 10
'Whatever you want your macro to do...Check or assign values, etc.
Next row_counter
End Sub

To compare the values of two cells, you can do this:

Sub an_example2()
For row_counter = 1 to 10
If Worksheets("Sheet1").Cells(1, 1).Value = _
Worksheets("Sheet1").Cells(1, 2).Value Then
'Whatever you want done if the cells are equal in value.
'Note the _ in the If statement is there because it allows
'a statement to span multiple lines so we can see it all once
without off the page like this line.
End if
Next row_counter
End Sub

To compare the values of two cells, you can do this:

It does not stop with the values of cells either. You may have noticed earlier that we used .Value after specifying a cell. However there are other properties and methods of cells that Excel VB provides that are really useful. For example the following statement that could be in a macro checks whether the cell contains a formula:

If Worksheets("Sheet1").Cells(theRow, theCol).HasFormula Then

There really are quite a number of things that may be accomplished with these techniques.

Write on excel sheets Using Visual basic 6.0

2008-12-08T02:16:00.000-08:00

if you want to export data to Excel you can do two things :
1. load Excel application
2. using Recordset to import the data (you must have an excel file to do this)first of all you must add 'Microsoft Excel [version] Object Library' reference to your program you can do this by choose menu Project >> References ..
1. Load Excel App (you must have Microsoft Excell installed)
a. declare variable as Excel.Application and Excel.Workbookex.
dim objExcel as Excel.Application,
objBook as Excel.WorkBookb. open Excel application
On Error Resume Next
Set objExcel = GetObject(, "Excel.Application") 'if excel already open you can use
GetObject
If Err.Number ThenErr.ClearSet objExcel = CreateObject("Excel.Application") 'or CreateObject to open new Excel Applicationc. create new workbook and new sheetSet
objWorkbook = objExcel.Workbooks.AddobjWorkbook.ActiveSheet.Cells(1, 1) = value ' cell(1,1) means cell A1 ;
value is the value you want to fillnote :
you can also use range to merge cell and fill the valueex.objWorkbook.ActiveSheet.Range("A4:A6").Merge
objWorkbook.ActiveSheet.Range("A4:A6").Value = value
2. Using Recordset (you musn't have Microsoft Excell installed but you must have an excel file with the first row filled with any value --> for a column header; otherwise this 'Insert Into' statement wont work)
a. create and open a connection (i'm using ADODim Conn As ADODB.ConnectionSet Conn = New ADODB.ConnectionConn.Open "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=FileName.xls;Extended Properties=Excel 4.0;"b. fill the value to excell sheetsConn.Execute "Insert Into [Sheet1$] (A1) VALUES ('value') " ' [Sheet1$] is an active sheet

Use ONLINE and SORT_IN_TEMPDB Effectively

2008-12-07T05:25:00.000-08:00

The ONLINE and SORT_IN_TEMPDB index options affect both the temporary space requirements and performance of the index create or rebuild operation. The advantages and disadvantages of each are covered in this section.
When considering the ONLINE option, you must weigh the need for a performant index operation versus the need for concurrent user access to the underlying data.
· To achieve the best performance, that is, the least time to create or rebuild an index, set ONLINE to OFF. However, this prevents all user access to the underlying table for the duration of the index create or rebuild operation.
· To achieve the best concurrency, that is, the least impact on other users accessing the table, set ONLINE to ON. However, the index operation will take more time.
You must also take into consideration the extra temporary space requirements of the online operation.
· To use the least amount temporary space while rebuilding a clustered index, set ONLINE to OFF.
· To use the least amount of temporary space while rebuilding a nonclustered index, set ONLINE to ON.
· If there are concurrent user transactions on the table during the online index operation, you must plan for additional space in tempdb for the version store.
For more information, see Determining the Amount of Temporary Space Used in this paper.
As we discussed earlier, when SORT_IN_TEMPDB is set to ON, sort runs and other intermediate tasks are stored in tempdb rather than the user database. Setting this option to ON can have two advantages:
· You can achieve the most contiguous space in the index. When the sort extents are held separately in tempdb, the sequence in which they are freed has no affect on the location of the index extents. Also, when the intermediate sort runs are stored in tempdb instead of the destination filegroup, there is more space available in the destination filegroup. This increases the chance that index extents will be contiguous.

When both SORT_IN_TEMPDB and ONLINE are set to ON, the index transactions are stored in the tempdb transaction log, and the concurrent user transactions are stored in the transaction log of the user database. This allows you to truncate the transaction log of the user database during the index operation if needed. Additionally, if the tempdb log is not on the same disk as the user database log, the two logs are not competing for the same disk space.

Measuring Temporary Disk Space Usage

2008-12-07T05:22:00.000-08:00

When the temporary space is used from the tempdb database, you can measure the amount of temporary space used by an index operation by using the dynamic management views provided in SQL Server 2005. There are three views that report the temporary disk space used by any operation in tempdb:
· sys.dm_db_task_space_usage
· sys.dm_db_session_space_usage
· sys.dm_db_file_space_usage
While these views only pertain to the tempdb database, you can set the SORT_IN_TEMPDB option to ON when testing for disk space usage requirements and then plan for the same space allocation in your user database.
The sys.dm_db_task_space_usage dynamic management view provides tempdb usage information for each task. As a task (such as an index rebuild) progresses, you can monitor how much temporary space the task is using. However, as soon as the task completes, the counters in the view are reset to zero. So, unless you happen to query this view just at the moment before the task completes, you can’t get the total amount of tempdb space used by a given task. However, when the task is completed these values are aggregated at the session level and stored in the sys.dm_db_session_space_usage view.
The sys.dm_db_session_space_usage provides tempdb usage information for each session. The easiest way to measure the tempdb space used by a given operation is to query sys.dm_db_session_space_usage for your session before and after the operation. However, there is a catch. The data in sys.dm_db_session_space_usage is not updated until the completion of the batch; therefore, you must execute these statements as three separate batches. Essentially, all you really need is three GO statements, as shown in the following example:
SELECT * FROM sys.dm_db_session_space_usage WHERE session_id = @@spid;
GO

GO
SELECT * FROM sys.dm_db_session_space_usage WHERE session_id = @@spid;

GO
When you query the sys.dm_db_session_space_usage view, pay attention to the following two columns in the result set:
· internal_objects_alloc_page_count: This column represents the space used by the sort runs while creating or rebuilding an index.
· user_objects_alloc_page_count: This column represents the tempdb space used by the temporary mapping index. The temporary mapping index is created only when an online index operation creates, drops, or rebuilds a clustered index.
To measure the size of the version store, you can query the version_store_reserved_page_count column in the sys.dm_db_file_space_usage view. The version store size can also be monitored by using the System Monitor (perfmon) counter Version Store Size (KB) in the Transactions performance object. The amount of space required for the version store depends on the size and duration of the transactions that change the data in the underlying table.

10 tips for sorting, grouping, and summarizing SQL data

2008-12-06T04:32:00.000-08:00

Arranging SQL data that you can effectively analyse requires an understanding of how to use certain SQL clauses and operators. These tips will help you figure out how to build statements that will give you the results you want.
Arranging data in a manner that's meaningful can be a challenge. Sometimes all you need is a simple sort. Often, you need more -- you need groups you can analyse and summarise. Fortunately, SQL offers a number of clauses and operators for sorting, grouping, and summarising. The following tips will help you discern when to sort, when to group, and when and how to summarize. For detailed information on each clause and operator, see Books Online.
#1: Bring order with a sort
More often than not, all your data really needs is a little order. SQL's ORDER BY clause organises data in alphabetic or numeric order. Consequently, similar values sort together in what appear to be groups. However, the apparent groups are a result of the sort; they aren't true groups. ORDER BY displays each record whereas a group may represent multiple records.

#2: Reduce similar values into a group
The biggest difference between sorting and grouping is this: Sorted data displays all the records (within the confines of any limiting criteria) and grouped data doesn't. The GROUP BY clause reduces similar values into one record. For instance, a GROUP BY clause can return a unique list of ZIP codes from a source that repeats those values: SELECT ZIP FROM Customers GROUP BY ZIP
Include only those columns that define the group in both the GROUP BY and SELECT column lists. In other words, the SELECT list must match the GROUP BY list, with one exception: The SELECT list can include aggregate functions. (GROUP BY doesn't allow aggregate functions.)
Keep in mind that GROUP BY won't sort the resulting groups. To arrange groups alphabetically or numerically, add an ORDER BY clause (# 1). In addition, you can't refer to an aliased field in the GROUP BY clause. Group columns must be in the underlying data, but they don't have to appear in the results.

#3: Limit data before it's grouped
You can limit the data that GROUP BY groups by adding a WHERE clause. For instance, the following statement returns a unique list of ZIP codes for just Kentucky customers: SELECT ZIP FROM Customers WHERE State = 'KY' GROUP BY ZIP
It's important to remember that WHERE filters data before the GROUP BY clause evaluates it.
Like GROUP BY, WHERE doesn't support aggregate functions.

#4: Return all groups
When you use WHERE to filter data, the resulting groups display only those records you specify. Data that fits the group's definition but does not meet the clause's conditions won't make it to a group. Include ALL when you want to include all data, regardless of the WHERE condition. For instance, adding ALL to the previous statement returns all of the ZIP groups, not just those in Kentucky: SELECT ZIP FROM Customers WHERE State = 'KY' GROUP BY ALL ZIP
As is, the two clauses are in conflict, and you probably wouldn't use ALL in this way. ALL comes in handy when you use an aggregate to evaluate a column. For example, the following statement counts the number of customers in each Kentucky ZIP, while also displaying other ZIP values: SELECT ZIP, Count(ZIP) AS KYCustomersByZIP FROM Customers WHERE State = 'KY' GROUP BY ALL ZIP
The resulting groups comprise all ZIP values in the underlying data. However, the aggregate column (KYCustomersByZIP) would display 0 for any group other than a Kentucky ZIP.
Remote queries don't support GROUP BY ALL.

#5: Limit data after it's grouped
The WHERE clause (# 3) evaluates data before the GROUP BY clause does. When you want to limit data after it's grouped, use HAVING. Often, the result will be the same whether you use WHERE or HAVING, but it's important to remember that the clauses are not interchangeable. Here's a good guideline to follow when you're in doubt: Use WHERE to filter records; use HAVING to filter groups.
Usually, you'll use HAVING to evaluate a group using an aggregate. For instance, the following statement returns a unique list of ZIP codes, but the list might not include every ZIP code in the underlying data source: SELECT ZIP, Count(ZIP) AS CustomersByZIP FROM Customers GROUP BY ZIP HAVING Count(ZIP) = 1
Only those groups with just one customer make it to the results.

#6: Get a closer look at WHERE and HAVING
If you're still confused about when to use WHERE and when to use HAVING, apply the following guidelines:
WHERE comes before GROUP BY; SQL evaluates the WHERE clause before it groups records.
HAVING comes after GROUP BY; SQL evaluates HAVING after it groups records.

#7: Summarize grouped values with aggregates
Grouping data can help you analyse your data, but sometimes you'll need a bit more information than just the groups themselves. You can add an aggregate function to summarise grouped data. For instance, the following statement displays a subtotal for each order: SELECT OrderID, Sum(Cost * Quantity) AS OrderTotal FROM Orders GROUP BY OrderID
As with any other group, the SELECT and GROUP BY lists must match. Including an aggregate in the SELECT clause is the only exception to this rule.

#8: Summarise the aggregate
You can further summarise data by displaying a subtotal for each group. SQL's ROLLUP operator displays an extra record, a subtotal, for each group. That record is the result of evaluating all the records within each group using an aggregate function. The following statement totals the OrderTotal column for each group: SELECT Customer, OrderNumber, Sum(Cost * Quantity) AS OrderTotal FROM Orders GROUP BY Customer, OrderNumber WITH ROLLUP
The ROLLUP row for a group with two OrderTotal values of 20 and 25 would display an OrderTotal of 45. The first record in a ROLLUP result is unique because it evaluates all of the group records. That value is a grand total for the entire recordset.
ROLLUP doesn't support DISTINCT in aggregate functions or the GROUP BY ALL clause.

#9: Summarise each column
The CUBE operator goes a step further than ROLLUP by returning totals for each value in each group. The results are similar to ROLLUP, but CUBE includes an additional record for each column in the group. The following statement displays a subtotal for each group and an additional total for each customer: SELECT Customer, OrderNumber, Sum(Cost * Quantity) AS OrderTotal FROM Orders GROUP BY Customer, OrderNumber WITH CUBE
CUBE gives the most comprehensive summarisation. It not only does the work of both the aggregate and ROLLUP, but also evaluates the other columns that define the group. In other words, CUBE summarises every possible column combination.
CUBE doesn't support GROUP BY ALL.

#10: Bring order to summaries
When the results of a CUBE are confusing (and they usually are), add the GROUPING function as follows: SELECT GROUPING(Customer), OrderNumber, Sum(Cost * Quantity) AS OrderTotal FROM Orders GROUP BY Customer, OrderNumber WITH CUBE
The results include two additional values for each row:
The value 1 indicates that the value to the left is a summary value--the result of the ROLLUP or CUBE operator.
The value 0 indicates that the value to the left is a detail record produced by the original GROUP BY clause.

ORACLE8 AND THE WINDOWS NT OPERATING SYSTEM

2008-12-06T04:29:00.000-08:00

ORACLE8 AND THE WINDOWS NT OPERATING SYSTEM
The Oracle8 RDBMS for NT is written using Microsoft’s 32-bit API. By using the Microsoft 32-bit API the Oracle8 RDBMS has been tightly integrated with the underlying hardware. Oracle8’s architecture for Microsoft Windows NT has been implemented as a single multithreaded process to conform with the Windows NT memory model.Under the Windows NT operating system a process represents a logical unit of work or job that the operating system is to perform. A thread is one of many subtasks that are required to accomplish the job. The components of a thread include:
A unique identifier called a client ID.
The content of a set of registers that represent the state of the processor.
A stack for when the thread is running in user mode and a stack for when the thread is running in kernel mode.
The thread resides within the process’s virtual address space. When more then one thread exists in the same process, the threads share the address space of all the process’s resources. The NT kernel schedules processes thread(s) for execution. All processes running under Windows NT must have at least one thread before the process can be executed.Unlike Oracle8 for UNIX, Oracle8 for NT uses a single process with multiple threads, thereby sharing memory in a single address space. The database uses the operating system facility for preemptive scheduling and load balancing across multiple CPUs.The Oracle instance on Windows NT consists of a memory segment and a number of background threads. By default, the Oracle8 server and its associated background threads run in the Normal Priority class. In this class, the scheduler can dynamically vary the priority between 1 and 15, but it cannot raise the dynamic priority to the real-time priority class. The real-time priority class ranges from 16 to 31 and cannot vary in priority based on behavior.The Windows NT GUI and its associated utilities can be used to observe various portions of the Oracle8 RDBMS. The Windows menu is used to access the Windows NT control panel.By accessing the Windows NT CONTROL PANEL the administrator can perform various tasks One such task may be to observe, start, or stop any of the various services that are running on the machine. The various services associated with the Oracle RDBMS. The remainder of this chapter is used to investigate the various components of the Oracle8 RDBMS architecture. Where possible the GUI utilities provided by the Windows NT operating system are used to observe the various components of the RDBMS. The same utilities will also help develop our understanding of how the Oracle8 RDBMS is integrated with the Windows NT operating system.ORACLE8 RDBMS ARCHITECTUREThe architecture of the Oracle RDBMS is divided into two distinct parts. One part is called the Oracle database the other part is called the Oracle The Oracle database is defined as:
A logical collection of data to be treated as a unit (tables).
Operating system files called data files, redo log files, initialization files and control files.
The Oracle instance is defined as:
The software mechanism used for accessing and controlling the database.
Having at least four background threads called PMON, SMON, DBWR and LGWR.
Including memory structures called the SGA and the PGA.
Each Oracle instance is identified by a System Identifier (SID).
Instances and databases are independent of each other, but neither is of any use without the other. For the end user to access the database the Oracle instance must be started (the four background threads must be running) and the database must be mounted (by the instance) and opened. In the simple model a database can be mounted by only one instance. The exception to this is the Oracle parallel server, where a database can be mounted by more then one Oracle instance.ORACLE DATABASE STRUCTUREOur discussion of the Oracle RDBMS architecture will first focus on that part that makes up the Oracle database. The Oracle database has both a physical and a logical structure. The physical structure consists of the operating system files that make up the database. The logical structure is determined by the number of tablespaces and the database’s schema objects.TablespacesAll Oracle databases must consist of at least one logical entity called a tablespace. The characteristics of a tablespace are:
One or more per database. The database must have at least one tablespace called “SYSTEM.” The SYSTEM tablespace holds the Oracle Data Dictionary. The Data Dictionary holds the various system tables and views such as the Oracle performance tables, information about the users of the database, and how much space is left in the various tablespaces that make up the database. There are usually more tablespaces other than the SYSTEM tablespace. Most Oracle databases also include additional tablespaces. These tablespaces are used to hold user data for sorting, and indexes that are used to speed up data access. Additional tablespaces should be created to hold data that is being sorted and another tablespace to hold data that is required for read consistency.
The physical representation of the tablespace is called a data file (a tablespace may consist of more then one data file).
Can be taken off line (due to media failure or maintenance purposes) leaving the database running. The exception to this rule is that the SYSTEM tablespace cannot be taken off line if the database is to remain running.
Unit of space for object storage. Objects are tables, indexes synonyms, and clusters.
Contains default storage parameters for database objects.
When an end-user’s Oracle user ID is created the user is given access to a default tablespace and a temporary tablespace (where the sorting of data is performed).
Can be dropped (removed from the database).
As stated previously tablespaces are logical entities. Tablespaces are physically represented by files that are called data files. Data files have the following attributes:
Are operating system files.
There is one or more per tablespace.
The finest granularity of the data file is called the data block.
A collection of data blocks is called an extent.
A segment (by definition) consists of one or more extents (therefore to make a segment larger, extents are added to the segment).
A data file consists of segments.
Contain transaction System Change Numbers (SCNs).
Data File Contents and Types of SegmentsA data file can consist of several types of segments and a segment can consist of one of more extents. The four different types of segments are rollback segments, temporary segments, index segments and data segments.Rollback segments have the following attributes:
Records old data.
Provides for rollback of uncommitted transactions.
Provides information for read consistency.
Used during database recovery from media or processor failure.
Wrap-around/reuseable.
Can be dynamically created or dropped.
Rollback segments contain the following information:
Transaction ID.
File ID.
Block number
Row number
Column number
Row/column data.
Temporary segments have the following attributes:
Used by the Oracle RDBMS as a work area for sorting data.
The DBA defines which tablespace will contain temporary segments and therefore the tablespace where sorting will occur.
Index segments have the following attributes:
Allows for faster data retrieval by providing an index for the data in a table, thus eliminating a full table scan during the execution of a query (similar to how a reader would use the index in a book rather then scanning through the entire book to find a particular topic).
Data segments have the following attributes:
One per table/snapshot.
Contains all table data.
Data segments contain the following information:
Transaction ID.
File ID.
Block number
Row number
Column number
Row/column data.
Besides data files there are also files called redo log files. Redo log files record changes made to the database by various transactions. All changes made to the database will first be written to the redo log file. These files can also be written to an off-line log file (archived). Redo logs are used during database recovery to recover the database to the last physical backup or to the point in time of failure (for this type of recovery the database must be running in ARCHIVELOG mode). Redo log files have the following attributes:
Records new data.
Ensures permanence of data transactions.
Provides for roll forward recovery during database startup and after a media failure.
Redo log files contain:
Transaction IDs
Contents of redo log buffers.
Transaction SCN.
The Control FileEach database has one or more control files. The control file is used to store information about the database. The information in the control file includes:
Transaction System Change Number (SCN)
Location of all datafiles.
Names and locations of the redo log files.
Time stamp when database was created.
Database name.
Database size.
For database recovery purposes it is best to have multiple copies of the control file. Without the control file the Oracle RDBMS cannot find the pointers to the rest of the files that make up the database (data files and redo log files).The INIT.ORA FileThe init.ora file is the database initialization parameter file. It is only read at database start-up time. Every Oracle instance that is running will have its own init.ora file (the user should substitute with the Oracle System IDentifier for their instance). This file contains various initialization and tuning parameters that are needed by the RDBMS. Some of the parameters in the init.ora file are:
The maximum number of processes that the Oracle instance will use (PROCESSES=).
The name of the database (DB_NAME=).
Various parameters for tuning memory management (DB_BLOCK_BUFFERS, SORT_AREA_SIZE...)
The location of the control file(s).
How these parameters affect the starting and running of the database are covered in the chapters on Oracle RDBMS installation and performance analysis and tuning.

Advanced Query Concepts - Sql or Pl-Sql

2008-12-06T04:11:00.000-08:00

Advanced Query Concepts
After you have mastered query fundamentals, you can explore these advanced query concepts for query solutions:
· Using aggregate functions in the select list
· Grouping rows with GROUP BY
· Combining results with UNION
· Subquery fundamentals
· Conditional data processing using CASE
· Parallel queries
· Summarizing data

Using COUNT(*)
COUNT(*) does not require an expression parameter because it does not use information about any particular column. It counts the total number of rows that meet the qualifications of the query. COUNT(*) returns the number of rows that match the search conditions specified in the query without eliminating duplicates. It counts each row separately, including rows that contain null values. This query finds the total number of books in titles:USE pubsSELECT COUNT(*)FROM titles
Here is the result set:
18
(1 row(s) affected)

COUNT(*) can be combined with other aggregate functions. This query shows COUNT(*) combined with an AVG function in which both aggregate functions aggregate data only from the rows that satisfy the WHERE clause search condition:

USE pubs
SELECT COUNT(*), AVG(price)
FROM titles
WHERE advance > $1000

Here is the result set:
----------- ------
15 14.42
(1 row(s) affected)

Using DISTINCT
The DISTINCT keyword is optional with SUM, AVG, and COUNT. When DISTINCT is used, duplicate values are eliminated before the sum, average, or count is calculated.
If you use DISTINCT, the expression must consist of a column name only. It cannot include an arithmetic expression.
This query returns the average prices of business books (without duplicate values):
USE pubs
SELECT AVG(DISTINCT price)FROM titlesWHERE type = ‘business’

Here is the result set:
14.64
(1 row(s) affected)

Without DISTINCT, the AVG function finds the average price of all business titles:
USE pubs
SELECT AVG(price)FROM titlesWHERE type = ‘business

Here is the result set:
13.73
(1 row(s) affected)

Null Values
Null values in a column are ignored while an aggregate function is operating. For example, the count of advances in the titles table is not the same as the count of title names because null values in the advance column are not counted.
USE pubs
SELECT COUNT(advance)
FROM titles
Here is the result set:
16
(1 row(s) affected)

USE pubs
SELECT COUNT(title)FROM titles
Here is the result set:
18
(1 row(s) affected)

If no rows meet the condition(s) specified in the WHERE clause, COUNT returns a value of zero. The other functions all return NULL. COUNT(*), counts each row, even if all column values are NULL. Here are examples:
USE pubs
SELECT COUNT(DISTINCT title)FROM titlesWHERE type = ‘poetry’
Here is the result set:
0
(1 row(s) affected)

USE pubs
SELECT AVG(advance)FROM titlesWHERE type = ‘poetry’
Here is the result set:
(null)
(1 row(s) affected)

Grouping Rows with GROUP BY
The GROUP BY clause is used to produce aggregate values for each row in the result set. When used without a GROUP BY clause, aggregate functions report only one aggregate value for a SELECT statement.
This example returns the number of units sold for each product in category 2:
USE Northwind
SELECT OrdD.ProductID AS ProdID,SUM(OrdD.Quantity) AS AmountSold
FROM [Order Details] AS OrdD
JOIN Products as PrdON OrdD.ProductID = Prd.ProductID AND Prd.CategoryID = 2
GROUP BY OrdD.ProductID

The GROUP BY keywords are followed by a list of columns, known as the grouping columns. The GROUP BY clause restricts the rows of the result set; there is only one row for each distinct
value in the grouping column or columns. Each result set row contains summary data related to the specific value in its grouping columns.
There are restrictions on the items that can be specified in the select list when a SELECT statement contains a GROUP BY. Items allowed in the select list are:
· The grouping columns.
· Expressions that return only one value for each value in the grouping columns, such as aggregate functions that have a column name as one of their parameters. These are known as vector aggregates.

You cannot use GROUP BY or HAVING on ntext,text,image, or bit columns unless they are in a function that returns a value having another data type.
Examples of such functions are SUBSTRING and CAST.

BlackBerry Storm has the stuff to leapfrog the iPhone in the enterprise

2008-12-05T07:15:00.000-08:00

Research in Motion’s BlackBerry Storm has been one of the most widely anticipated IT products of 2008, and for RIM it is a critical product for the future of the BlackBerry brand. This is RIM’s answer to Apple’s iPhone, which is increasingly chipping away at BlackBerry’s lead in the smartphone market.
Because there are so many executives, salespeople, road warriors, and information workers who love their smartphones, over the past month a lot of these folks have been asking me the same question, “What do you think about the BlackBerry Storm?”
Now that I’ve had the chance to kick the tires on a review unit of the Storm that I got from Verizon Wireless - the exclusive carrier of the device - I’m ready to say that there is a lot to like about the Storm.
Specs
Price: $199 with two-year agreement and mail-in rebate
U.S. Carrier: Verizon Wireless
Global connectivity via CDMA/EVDO, UMTS/HSPA, and EDGE
3.25″ glass display with 480×360 screen
SurePress touch screen
1 GB on-board memory plus microSD slot
3.2 megapixel camera
Integrated GPS
Integrated Bluetooth 2.0
3.5mm stereo headphone jack
Removable battery

Who’s it for?
The Storm is aimed at corporate users who are tempted by the iPhone’s flashy touch screen and multimedia features, but can still benefit from the BlackBerry platform for enterprise messaging, security, and manageability. This device is aimed at keeping them in the BlackBerry fold.
The other target audience is prosumers who are either focused on a rich multimedia experience in their smartphone or are buying their own smartphone to use for both work and personal use.
What problems does it solve?
The Storm marks RIM’s first foray into touch screens. Its innovative screen-click approach is an attempt to bring tactile feedback to on-screen keyboards in order to make them more usable.
Also, for those who don’t want to switch to AT&T to get the iPhone because they prefer the Verizon Wireless network, the Storm offers a multimedia touch screen device that’s in the same class as the iPhone.
Standout features
Good battery life: For a 3G phone, the Storm has pretty good battery life. In my tests, it lasted two days without needing a recharge. That’s about twice as long as the iPhone.
Excellent display and speakers: The first thing you notice on the Storm is that it has a very high quality 480×360 screen. It’s similar to the screen on the recently released BlackBerry Bold, which has a 480×320 LCD. The Bold and the Storm have the highest quality screens I’ve seen in a smartphone, with the iPhone just a half step behind them. The Storm also has the best speakers I’ve ever heard on a smartphone. It is a genuine multimedia device.
Effective on-screen keyboard: The Storm’s SurePress technology adds a new innovation to touch screens by making the screen clickable. Basically you hover over and highlight the thing you’re going to press and then click the screen. It takes some getting used to, but I quickly found its on-screen keyboard to be much faster and more accurate for me than the iPhone’s keyboard, although I still prefer a hardware keyboard like the one on the BlackBerry Bold.
Can be tethered as a broadband modem: Using the Verizon Wireless VZAccess software, the Storm works as a 3G modem that you can tether to your laptop in order to get broadband on the go. In my tests using the Storm as a tethered modem, it averaged about 1.5 Mbps for downloads and about 500 Kbps for uploads.
Business-ready: The biggest benefit of the Storm for IT leaders and their businesses is that if you already have a backend BlackBerry infrastructure in place, then the Storm will plug right in and immediately have the kind of security and manageability that enterprise IT departments demand.
What’s wrong
Interface and navigation problems: The Storm interface is not nearly as intuitive as the iPhone’s. The iPhone essentially needs no instructions. You can hand it to most people and tell them to start touching the screen and they’ll figure it out. Not so with the Storm. It requires instructions and it takes some getting used to. Even after using it for awhile, I still found myself inadvertently clicking the wrong things and ending up in places I didn’t mean to go.
No Wi-Fi: Unlike the BlackBerry Bold and the iPhone, the Storm does not have Wi-Fi. This is unexplainable and a real disappointment because Wi-Fi can help reduce phone charges and provide a better Web experience when you’re roaming around at home or at the office.
Non-standard power and USB adapters: The Storm also comes with a new set of USB and power adapters that do not match up with the standard BlackBerry connectors on current phones. This is a major pain in the neck, because if you already own a BlackBerry you probably have all of the adapters you need for the car, your laptop bag, the office, and maybe even a cradle at home. None of them will work with Storm so you’ll have to buy new accessories.
Web browsing could be better: Although Web pages look great on the Storm’s high quality display, the Web browsing experience on the Storm is much more clunky than the iPhone, which was the first device to make the Web usable on a smartphone. The iPhone still has the best Web viewing experience I’ve seen on a smartphone - by a long shot.
Competitive products
Apple iPhone
Google G1
HTC Touch Pro
BlackBerry Bold
Bottom line for business
With the BlackBerry Storm, RIM has succeeded in building a true next generation smartphone that takes its platform to another level. The advanced screen, usable on-screen keyboard, tethering capability, and enterprise readiness will make it attractive for a lot of businesses. The biggest caveats are that it’s not as user-friendly as the iPhone, it lacks Wi-Fi, and doesn’t offer the same powerful Web browsing experience that you get on the iPhone.
For those who want an iPhone-like touch screen experience in an enterprise-class smartphone - or those who like the iPhone but prefer Verizon over AT&T - the Storm will be a very attractive device. However, for hard core BlackBerry users who work well with the current trackball BlackBerries, as well as professionals who send a lot of e-mail messages from their phone and/or do a lot of data input, the Storm is probably not going to be a great choice.
Ultimately, I still think the hardware keyboard and mini trackball are much more efficient for getting work done than using a touch screen, so I consider the Bold to be the top-of-the-line smartphone for business users. However, a lot more users are gravitating toward touch screens and the Storm brings a powerful
RIM hasn’t caught Apple yet. The Storm isn’t as good of a consumer device as the iPhone, but it’s in the same ballpark and RIM could certainly translate the advantages of its smartphone platform - better messaging, monitoring, and security - plus having Verizon Wireless as the Storm’s network partner into wins in the enterprise market. In fact, a year from now I wouldn’t be surprised to see more Storms than iPhones in the enterprise–at least in terms of the official smartphones deployed by IT.

Microsoft finally catches the eight year bug

2008-12-05T07:13:00.000-08:00

Microsoft Windows systems use the Server Message Block application level network protocol to provide sharing capabilities for files, printers, and other resources. SMB is supported on many other operating systems, primarily by way of the open source Samba project, but most of the time non-Microsoft OSes use SMB only when they must be integrated into a network that also includes MS Windows systems.
In March 2008, Josh Buchbinder published proof of concept exploit code for an SMB relay attack vulnerability in Microsoft’s implementation of the Server Message Block protocol. Since that time, a number of security testing tools have become capable of exploiting this vulnerability. According to Microsoft, “Public tools, including a Metasploit module, are able to perform this attack.” The result is that for several years now it has been possible to exploit this vulnerability entirely via code written by other people and freely available on the Internet.
The vulnerability was discovered even before March 2007, though. Christien Rioux announced discovery of this flaw in the Microsoft implementation of SMB at DEFCON in 2000. That means this flaw was first discovered and announced at least 8.25 years ago.
Microsoft finally released a patch for the vulnerability two days ago.
I think this is a good time for some reminders about what constitutes good security practice for software vendors. First of all, you should probably refresh your memory with my article from last month, 5 characteristics of security policy I can trust. In it, I pointed out the following characteristics of good security policy:
Full Disclosure
Open Development
Open Formats
Privacy Friendly
(Good) Vulnerability Management
On that last subject — good vulnerability management — I have written a few other articles that are relevant:
There’s more to security than counting vulnerabilities: The number of discovered vulnerabilities alone provides no useful information about the security of the software. A far more useful metric, if you must select one in a vacuum, would be how the developer responds to vulnerability discovery. The SMB vulnerability that took Microsoft more than eight years to patch is a pretty good indicator that Microsoft is a pretty poor choice for a vendor to trust.
Why there’s no such thing as a trusted brand: Corporations are not people. They do not have anything approaching an intrinsic, individual character. The only characteristics that are essentially unchanging in a given corporation are the characteristics that are necessarily intrinsic to all corporations, by their very nature. Everything else can change — and that means no corporation is really “trustworthy”. Don’t place your trust in the vendor. Demand proof. Sometimes, “proof” means “source code”, and if you can’t compile the source yourself, but are only allowed to read source code that someone assures you is the same as what was used to produce a binary that is handed to you separately, you still haven’t really seen proof of anything meaningful.
The truth about viruses: Large, corporate software vendors tend to have policies that are optimized for the security of a revenue stream, and not for the security of the customer’s data. An entire class of vulnerabilities, in the form of those primarily of use to viruses, is ignored and left unpatched by vendors like Microsoft. It is simply assumed that the slack will be taken up by antivirus vendors. Take heed of this behavior in a corporation, and realize what it means; given the opportunity, that vendor will ignore a vulnerability rather than fix it.
Obscurity is not security: Pretending something doesn’t exist doesn’t make it safe from malicious security crackers. If security researchers can discover a vulnerability, so can unsavory individuals who actually want to use an exploit for personal gain or to wreak havoc, rather than just using it to demonstrate a vulnerability that should be fixed.
How should we handle security notifications?: When you get notification of a vulnerability in your software, thank the person who discovered it. Fix the bug. Whatever you do, don’t punish people for giving you information that can help, unless you actually want to be the absolute last person to find out about vulnerabilities in your software in the future. Let your users know about the vulnerability, especially if you won’t be able to fix it quickly, so they can take steps to protect themselves.
This vulnerability is no minor, inconsequential issue. It can be leveraged to take control of a machine without knowing the password. According to the Microsoft Security Bulletin for this issue:
The vulnerability could allow remote code execution on affected systems. An attacker who successfully exploited this vulnerability could install programs; view, change, or delete data; or create new accounts with full user rights.
If nothing else, at least take this piece of advice if you’re a software vendor:
Don’t wait more than eight years to fix a vulnerability that allows someone to remotely gain control of the entire system without even knowing or cracking the password. That’s just irresponsible. Note: Thanks to Sterling Camden, of TR’s own IT Consultant Weblog, for the inspiration to write this article.

The safest way to sanitize input: avoid having to do it at all

2008-12-05T07:10:00.000-08:00

Last weekend, I finished some work on a small development project for a new client. Thanks to that, I found myself in a frame of mind that gave me the urge to write more code. I turned that to good use by finally getting to work on the long neglected task of writing a new contact page back end for my professional Website. I had a contact page there, of course, but it was essentially an ugly hack of a contact page back end I had written in PHP for a completely different Website a few years ago. Worse, it bore no resemblance to the rest of the site, and I had not bothered to give it a navigation element (i.e., what users tend to call a “menu”).
The back end for this contact page would be written in Ruby, of course. I wrote out a rather pretty script, if I do say so myself, that made use of the TMail library, a tool that abstracts away a lot of the behind-the-scenes drudgery of specifying email headers and content and preparing it for transmission using SMTP. I wrote it such that it would work equally well from the browser and the command line. Then, I tested it.
It worked brilliantly on my laptop when I executed it from the shell. It worked brilliantly on the server when I executed it from the shell, too. It failed utterly when I tried entering the URL for it in the browser. I spent entirely too long beating my head against the intractable problem of getting it working from the browser. I also tried RubyMail, an alternative to TMail, and ran into the same problems. As it turns out, someone saw fit to change some configuration option on the Webserver so that installing and using gems — that’s the term for Ruby libraries and utilities packaged up for use through Ruby’s own software management system — no longer works. This is the sort of thing that makes me think I should get myself a virtual server account for my professional Website, but it’s difficult to justify spending more than required by a shared hosting account considering the rather minimal technical requirements I have for the site.
I won’t get into the sordid details of how exactly Ruby gems no longer install and work properly on my shared hosting account. After a day plus of finding out that no amount of finesse, dirty hackery, or pleading with the server on my hands and knees would do any good, I gave up. Ruby, like many high level dynamic languages that are either interpreted or JIT compiled, provides extremely easy to use functionality for accessing other programs through outside shell processes. For instance, if you want to access the mail command from within Ruby, you can just wrap the command in backticks or execute it by way of the Kernel#system or Kernel#exec method, each of which provides subtly (but importantly) different functionality.
It’s surprisingly easy to send a command to the shell via one of these methods. I chose backticks. I started out writing something like this for the actual mail sending code:`echo "#{body}" mail -s "#{subject}" #{recipient}`
In that one line of code, I had a way to cram the body of a message (stored in the body variable) into an email that would arrive in my inbox with a subject that had been stored in the subject variable. My email address (since this was for a contact page) was specified by the recipient variable, since the point was to create a way for people to send emails to me without having to make that email address available to the world at large (and to make contact page emails stand out in my inbox). It was all quick, easy, and neat. Now comes the messy part: because the body of the email contained user supplied input, I needed to sanitize it so malicious input wouldn’t result in a vulnerability in my code that, oh, deleted everything in my directory on the server, for instance.
I ran around in circles on that for a little while, soliciting some outside help with figuring out how to make sure all the holes were plugged in the output sanitization code (thanks Sterling and ruby-talk). It was a lot of work, but I was making progress. Then, of course, someone on ruby-talk (thanks, James Gray) pointed out the obvious — I shouldn’t send the content of the body variable to the shell at all. What I should do instead is open a pipe to the mail command as an IO stream and just write to it like any other file handle.
The new code, then, ended up looking something like this:open( %Q{ mail -s "#{subject}" #{recipient} }, 'w' ) do msg
msg << body
end
Perhaps even more important, in terms of handling user input, is the fact that the `subject` and `recipient` variables are set by me, and not by user input.
As a result of taking this approach with both the content and headers of emails handled by this contact page, the need for me to sanitize input before I sent it to the shell simply evaporated. I was no longer sending any user input to the shell with my own code, at all.
The Moral of the Story
I was reminded, in a forehead slapping moment, of one of the cardinal laws of input handling. The first thought that occurs to most people when they think about security and accepting arbitrary input from unknown users — such as on a Website contact form — is that all input must be sanitized. That’s really a secondary rule, though.
One might get a little closer, in concept, to the first law of sanitizing data by observing the rule that one should not reinvent wheels, when it comes to security especially, without very good reason. In other words, if you have to sanitize data, use someone else’s well tested code to do it if you can, because writing it from scratch will be initially prone to error. I would have done just that, if I found something in the core language or standard library for Ruby that would do the kind of input sanitizing I actually needed. Alas, what I need is not something like URL escape characters, which is in the standard library via the CGI module.
The actual first rule of thumb for input sanitizing is in some ways much more obvious than the preceding two guidelines, but simultaneously far less well observed. I, myself, forgot it until a helpful soul on the ruby-talk mailing list reminded me (in a roundabout way) that:
It’s safer to write code that doesn’t require input sanitizing than to try to sanitize it.
It’s not a lesson I’ll forget again, any time soon. I’m just glad I didn’t learn it the hard way — by writing broken input sanitizing code and suffering the consequences when I exposed it to the Internet.

Coming on Patch Tuesday: 8 bulletins, 6 critical

2008-12-05T07:08:00.000-08:00

The final Microsoft Patch Tuesday for 2008 will be a big one: 8 bulletins covering serious code execution flaws in a wide range of ubiquitous software.
According to the company’s advance notice mechanism, six of the eight bulletins will be rated “critical,” Microsoft’s highest severity rating. The “critical” updates will cover holes in the Windows operating system, Internet Explorer, Windows Media Player, Visual Basic and Visual Studio, Microsoft Word and Microsoft Excel.

Next up for layoffs: Real Networks

2008-12-05T07:06:00.000-08:00

Real Networks said today that it informed 130 employees, or 7.5 percent of its worldwide workforce, that their positions would be eliminated at the end of year. In a post on the company’s official blog, the company said the layoffs were part of a larger cost cutting plan that “is intended to bring expenses in line with current and prospective economic realities.”
The company said it still expects to report record revenue for the year but, to stay healthy, it needs to get costs in line with revenue expectations. Bill Hankes, vice president for Real Networks’ Corporate Communications, wrote:
The people who are losing their jobs will have time to transition their work through the end of the year. No one is being shown the door today. Departing employees can conduct job searches for other positions at Real or elsewhere from their offices here, or, if they prefer, from home. Everyone will remain on the payroll through the end of the year, plus each will be offered a cash severance package based on their length of service. Because of the unusual and difficult economic times, these severance packages include outplacement services and six months of COBRA healthcare coverage.

From Chapter Three: The Windows Culture

2008-12-05T07:04:00.000-08:00

What has changed most substantially since 1992 is the general approach to managing servers. Originally users managed their own Windows for Work Groups servers but, as server functions became more complex and started to affect more people, server operations became the responsibility of Windows professionals -generally meaning either experienced managers from other computer cultures or people who had grown into the job as Windows technicians but had little or no actual technical education.
The release of Windows NT led to immediate and dramatic server proliferation as people tried to use small machines to run complex applications code. A 1997 Pentium 2 running at 233Mhz with 192MB of RAM could barely handle both NT 4.0 Server and a simple application like the Windows email server - Microsoft Exchange- for perhaps 20 to 30 users. In a company with 5,000 employees, that usually meant 150 or so small servers just for email.
Outlook services, Web services, firewalls, file and print services, SQL-Server, and related functionality all required similar server investments and companies quickly developed enormous server rooms with hundreds, and often thousands, of these little machines.
At a ratio of about one support technician for every 20 NT servers, PC staffing exploded along with server populations.
As processors got faster and memory became cheaper, it turned out that NT 4.0 wouldn’t really let you run multiple concurrent applications on the same machine largely because of two problems:
It is virtually impossible to install two or more applications without creating a situation in which a failure in one can not reasonably be blamed on the other; and,
Since the most usual remedial action in response to a software failure is first a reboot and then a re-install, having two or more applications on the same machine either, or both, inconvenienced a larger number of users or caused the same users more annoyance than just shutting down one application.
In combination with scale issues these problems led to the evolution of a one application per box rule which exacerbated both server and staff proliferation.
The first solution to be widely adopted was the rackmount. These initially let a systems group put up to 8 PC servers in a single rack roughly as big as an oversize refrigerator. For obvious reasons rackmounts therefore quickly gained in popularity and consequently in density, achieving, by late 2002, a typical 42 machines per rack.
Since then the rackmount has evolved into the blade server in which a single rack is modified to resemble a single chassis and machines, now called blades and consisting of little more than CPUs, memory, boot ROMS, and network connections, are placed in the rack and centrally administered. Blade servers now routinely put 256 PC equivalents in a rack and higher densities are being advertised.
Rack and blade servers have limited room for disk drives, so another solution to disk problems associated with server proliferation is required to deal with this. That solution started out as the Storage Area Network or SAN.
Originally companies like EMC made stand-alone disk packs like this one that could be connected to mainframe, mid-range, or Unix systems via local cabling. These packs generally had their own CPU and memory and acted to emulate simple physical disk drives while internally combining the speed benefit of extensive local caching with the security benefits of RAID storage.
SANS were particularly attractive for PC server environments because of the interaction of three factors:
Most PC servers have cheap, and therefore slow, buses connecting disks drives and memory. As a result a SAN usually offered faster disk response than an internal disk;
One of the biggest problems facing PC server management is backup. Simply tracking internal disks in thousands of rack mounted machines is difficult; ensuring that all are backed up to tape or alternative run-time machines is nearly impossible; and,
Most PC staffers are not deeply technical and hiring people qualified to manage large server farms is correspondingly difficult. SANS offered the opportunity to reduce staffing levels and work complexity by aggregating backup and OS reloads.
In general SANS were widely accepted and effective but it turned out that the investment in skill and effort needed to run them was compounded by both PC clustering (using several PC servers to handle one load) and the 1:1 links between the SAN devices and servers.
That made the next step obvious: turn the disk pack into a disk server with its own CPU, Memory, OS, and use the network connection in lieu of a bus connection.
With the right software, other computers could then access this machine as if it were a real disk drive and managers could set them up to serve as many machines as there were network connections for - thereby nicely replicating Novell 1.0 from 1979 for the Windows 2000 and later server environments.
Originally all such connections were proprietary to the companies that sold them but eventually they morphed into a new form, called the Network Attached Storage, or NAS, architecture in which the proprietary software is loaded over a standard TCP/IP connection with an upgraded switch.
By late 2001 most larger companies had so many NT or Windows 2000 servers in rackmounts and wiring closets scattered across their offices and other working premises that simply keeping track of them became difficult. At that time, too, Microsoft introduced a new licensing model (Licensing 6.0) that combined harsher penalties for failure to upgrade to new system releases as they become available, with higher overall costs and considerably more emphasis on finding and punishing unlicensed users.
The initial result was a strong move to server consolidation that peaked in late 2004 before giving way to today’s (starting late 2006) fad: virtualization. Thus there now seem to be three working solutions:
Eliminate the problem by converting to Unix servers and applications in order to consolidate many applications to a small number of machines;
Convert to larger Intel based PC servers running Windows Advanced Server and consolidate some user loads or several applications to each remaining machine; or,
Adopt virtual machine technology with Windows 2003/XP and later releases to isolate loads from each other.
Of these the first is generally unacceptable to Windows people and the third is now popular but was originally essentially limited to people from the mainframe culture. Consider, for example this from an article by J. Vijayan:
Until recently, Conseco Finance Corp., like many other organizations, was struggling to find a way to control the rapid proliferation of small Intel-based servers across the company.
The systems, which were being purchased at the rate of about one per week, were being used to run a variety of very small Windows-based applications, such as domain controllers and encryption and antivirus services.
In many cases, the Intel servers that were being purchased were severely underutilized because the applications required only a fraction of the available resources, says Rod Lucero, chief IT architect at St. Paul, Minn.-based Conseco Finance.
But because of the technical challenges involved in running more than one application on a single instance of the Windows operating system, Conseco had to buy individual servers for each new application, says Lucero. “We really wanted to find a technology that would not require us to go out and buy little pizza boxes every week,” Lucero says. So nine months ago, Conseco started using virtualization technology from VMware Inc. in Palo Alto, Calif. VMware sells software-based partitioning products that allow users to take a single Intel box and carve it up into multiple smaller “virtual” servers, each of which can run a separate Windows or Linux application. (Computerworld, Nov. 25/2002)
In reality the licensing cost for VMware GSX edition, about $3,000 per instance at the time, easily exceeded the cost of buying a separate machine - but Conseco was an IBM reference site, the discussion took place in an IBM xSeries sales context, and Computerworld caters to the IBM community.

First in flight from the Wright Brothers' camera

2008-12-05T07:00:00.002-08:00

This gallery offers a fascinating look at the history of flight through the camera lens of the Wright Brothers. They did a great job of documenting their earliest failures and successes.
There are ample resources to study the Wright Brothers; here, I've usually provided only the spare captions attached to the individual pictures in the collection.
These images are in the public domain, from the Collection: Glass negatives from the Papers of Wilbur and Orville Wright, housed in the Library of Congress Prints and Photographs Division, Washington, D.C. 20540 USA.

What to do when you screw up

2008-12-05T07:00:00.001-08:00

Every leader, at some point, screws up. Things will be going along nicely but then something unexpected happens. Suddenly you’re looking up from the floor where you landed flat on your back.
What occurs at that point might range from simply being scolded to being fired.
How you respond to your mistake can make a big difference to your sense of confidence. As importantly, your response could impact whether your career continues to move forward, or if you’re into a career-derailing situation.
No one wants to be on the receiving end of criticism, but when you mess up it’s another one of those “opportunities” to make lemonade out of lemons. Showing the upper management that you handle their comment professionally allows them to see how you react in a difficult situation. Your style will be closely watched:
“Does she admit her problems or blame others?”“Is he acting like a person who learns from their mistakes and won’t repeat this again?”
Regardless of whether the criticism is constructive, it’s very important that you face the situation well. People will be watching. How effectively you respond will have an impact on your professional growth and ultimate success.
For when you hit that inevitable banana peel yourself, here are 6 tips for coping with a screw-up:
1. Listen to the criticism. Even though you may feel hurt, try to see past your emotions to the task at hand. Remember the old adage that “there’s no crying in baseball” - likewise at the workplace.
2. Don’t get defensive. Show that you are trying to understand the criticism and ask questions to ensure you get what’s being said. Make it clear that you want to do what’s needed to rectify the situation.
3. If you did something wrong - admit it. People respect others who show that they are mature enough to know that they made a mistake. It shows professionalism. I’ve had HR execs say to me that they won’t hire individuals who can’t tell them of a mistake or two they’d made earlier.
4. If you notice the problem before the boss - tell her/him first. If you have a solution to the problem, try to implement it first; but if that’s not possible - tell the boss what the hassle is and provide the solution at the same time.
5. Shrug off criticism - Dwelling on screw ups makes you less productive and impacts your own sense of self worth. It can make you negative and less valuable to the organization. People will be less welcoming as a result.
6. Review - Get together with colleagues to discuss what happened and get their assessments. Often, what it felt like to you will be very different from what they saw, or understand. They have a different perspective and can be more objective.

Mistakes can be the start of something good

2008-12-05T06:55:00.000-08:00

Back in the 1950s, a secretary and commercial artist named Bette Clair McMurray started using a tempera water-based paint to correct her typing mistakes. By 1956, she began marketing this typewriter correction fluid as Liquid Paper. She sold it to the Gillette Corporation in 1979 for $47.5 million. (On a side note, she was also the mother of Michael Nesmith, a member of the ‘60s pop group The Monkees. Feel free to throw that little bit of trivia out Cliff Claven-style at your next gathering and watch everyone’s eyes grow wider as they ask, “What in the world is a Monkee?” or, even worse, “What in the world is a typewriter?”)
The moral of this blog is not that you can make mistakes as long as you find an ingenious way to cover them up. The moral is that mistakes are often the genesis of bigger and better things.
Out of necessity, IT is populated by perfectionists. They operate in a scientific world where the line between correct and incorrect is a little more distinct. This can cause IT pros to fear mistakes more than others. But mistakes, if you learn from them, allow you to hone future actions — something that will help ensure even greater success eventually.
To see this statement in action, one has to look no further than Mr. Gates. Here’s an example, borrowed from Evan Carmichael’s blog:
A long-time project of Gates’, an APL interpreter that he had almost finished designing, never actually got its feet off the ground. Despite Gates’ hard work, it was decided that there was too small a market for the product. Gates eventually got busy on another project and the APL faded into the past without ever having been shipped. On another similar occasion, Microsoft was contracted to write a code for machines manufactured by Texas Instruments. While they completed the product on time, Multiplan was a failure in the home computer market and the line was discontinued.
Gates learned from this mistake of creating software for 8-bit machines instead of the up and coming IBM PC generation. From that point on, whenever the idea for a new product line came about, Gates would ask himself, “Are we aiming too low, in terms of system requirements…is this another case like Multiplan?” With full confidence in his product, it was his strategy that Gates knew was flawed. And, it was that mistake that allowed Gates to make “one of the best decisions” he ever did. Gates chose to leave the world of DOS and focus solely on Windows and the future of graphical user interfaces.
And the rest, as they say, is history.

ASP.NET Interview Questions – 6

2008-11-04T04:58:00.000-08:00

What is Ajax?
The term Ajax was coined by Jesse James Garrett and is a short form for "Asynchronous Javascript and XML". Ajax represents a set of commonly used techniques, like HTML/XHTML, CSS, Document Object Model(DOM), XML/XSLT, Javascript and the XMLHttpRequest object, to create RIA's (Rich Internet Applications).
Ajax gives the user, the ability to dynamically and asynchronously interact with a web server, without using a plug-in or without compromising on the user’s ability to interact with the page. This is possible due to an object found in browsers called the XMLHttpRequest object.

What is ASP.NET AJAX?
‘ASP.NET AJAX’ is a terminology coined by Microsoft for ‘their’ implementation of AJAX, which is a set of extensions to ASP.NET. These components allow you to build rich AJAX enabled web applications, which consists of both server side and client side libraries.
Which is the current version of ASP.NET AJAX Control Toolkit?
As of this writing, the toolkit version is Version 1.0.20229 (if you are targeting Framework 2.0, ASP.NET AJAX 1.0 and Visual Studio 2005) and Version 3.0.20229 (if targeting .NET Framework 3.5 and Visual Studio 2008).

Explain differences between the page execution lifecycle of an ASP.NET page and an ASP.NET AJAX page?

In an asynchronous model, all the server side events occur, as they do in a synchronous model. The Microsoft AJAX Library also raises client side events. However when the page is rendered, asynchronous postback renders only the contents of the update panel, where as in a synchronous postback, the entire page is recreated and sent back to the browser.

What role does the ScriptManager play?
The ScriptManager manages all ASP.NET AJAX resources on a page and renders the links for the ASP.NET AJAX client libraries, which lets you use AJAX functionality like PageMethods, UpdatePanels etc. It creates the PageRequestManager and Application objects, which are prominent in raising events during the client life cycle of an ASP.NET AJAX Web page. It also helps you create proxies to call web services asynchronously.

Can we use multiple ScriptManager on a page?
No. You can use only one ScriptManager on a page.

What is the role of a ScriptManagerProxy?
A page can contain only one ScriptManager control. If you have a Master-Content page scenario in your application and the MasterPage contains a ScriptManager control, then you can use the ScriptManagerProxy control to add scripts to content pages.
Also, if you come across a scenario where only a few pages in your application need to register to a script or a web service, then its best to remove them from the ScriptManager control and add them to individual pages, by using the ScriptManagerProxy control. That is because if you added the scripts using the ScriptManager on the Master Page, then these items will be downloaded on each page that derives from the MasterPage, even if they are not needed, which would lead to a waste of resources.

What are the requirements to run ASP.NET AJAX applications on a server?
You would need to install ‘ASP.NET AJAX Extensions’ on your server. If you are using the ASP.NET AJAX Control toolkit, then you would also need to add the AjaxControlToolkit.dll in the /Bin folder.
Note: ASP.NET AJAX 1.0 was available as a separate downloadable add-on for ASP.NET 2.0. With ASP.NET 3.5, the AJAX components have been integrated into ASP.NET.

Explain the UpdatePanel?
The UpdatePanel enables you to add AJAX functionality to existing ASP.NET applications. It can be used to update content in a page by using Partial-page rendering. By using Partial-page rendering, you can refresh only a selected part of the page instead of refreshing the whole page with a postback.

How can you cancel an Asynchronous postback?
Yes you can.

Difference between Server-Side AJAX framework and Client-side AJAX framework?
ASP.NET AJAX contains both a server-side Ajax framework and a client-side Ajax framework. The server-side framework provides developers with an easy way to implement Ajax functionality, without having to possess much knowledge of JavaScript. The framework includes server controls and components and the drag and drop functionality. This framework is usually preferred when you need to quickly ajaxify an asp.net application. The disadvantage is that you still need a round trip to the server to perform a client-side action.
The Client-Side Framework allows you to build web applications with rich user-interactivity as that of a desktop application. It contains a set of JavaScript libraries, which is independent from ASP.NET. The library is getting rich in functionality with every new build released.

How can you debug ASP.NET AJAX applications?
Explain about two tools useful for debugging: Fiddler for IE and Firebug for Mozilla.

Can we call Server-Side code (C# or VB.NET code) from javascript?
Yes. You can do so using PageMethods in ASP.NET AJAX or using webservices.
Can you nest UpdatePanel within each other?
Yes, you can do that. You would want to nest update panels to basically have more control over the Page Refresh.

How can you to add JavaScript to a page when performing an asynchronous postback?
Use the ScriptManager class. This class contains several methods like the RegisterStartupScript(), RegisterClientScriptBlock(), RegisterClientScriptInclude(), RegisterArrayDeclaration(),RegisterClientScriptResource(), RegisterExpandoAttribute(), RegisterOnSubmitStatement() which helps to add javascript while performing an asynchronous postback.

Explain the AJAX Client life-cycle events
Here’s a good article about the same.
Is the ASP.NET AJAX Control Toolkit(AjaxControlToolkit.dll) installed in the Global Assembly Cache?
No. You must copy the AjaxControlToolkit.dll assembly to the /Bin folder in your application.
Those were some frequently asked questions you should have knowledge about

Can I use ASP.NET AJAX with any other technology apart from ASP.NET?

To answer this question, check out this example of using ASP.NET AJAX with PHP, to demonstrate running ASP.NET AJAX outside of ASP.NET. Client-Side ASP.NET AJAX framework can be used with PHP and Coldfusion.

ASP.NET interview questions - 5

2008-11-03T06:08:00.000-08:00

1. What are Satellite Assemblies?
Satellite assemblies are often used to deploy language-specific resources for an application. These language-specific assemblies work in side-by-side execution because the application has a separate product ID for each language and installs satellite assemblies in a language-specific subdirectory for each language. When uninstalling, the application removes only the satellite assemblies associated with a given language and .NET Framework version. No core .NET Framework files are removed unless the last language for that .NET Framework version is being removed.

2. What is Global Assembly Cache (GAC) and what is the purpose of it?
Each computer where the common language runtime is installed has a machine-wide code cache called the global assembly cache. The global assembly cache stores assemblies specifically designated to be shared by several applications on the computer. You should share assemblies by installing them into the global assembly cache only when you need to.

3. What is Reflection in .NET?
All .NET compilers produce metadata about the types defined in the modules they produce. This metadata is packaged along with the module (modules in turn are packaged together in assemblies), and can be accessed by a mechanism called reflection. The System.Reflection namespace contains classes that can be used to interrogate the types for a module/assembly.

4. What is the managed and unmanaged code in .net?
The .NET Framework provides a run-time environment called the Common Language Runtime, which manages the execution of code and provides services that make the development process easier. Compilers and tools expose the runtime's functionality and enable you to write code that benefits from this managed execution environment. Code that you develop with a language compiler that targets the runtime is called managed code; it benefits from features such as cross-language integration, cross-language exception handling, enhanced security, versioning and deployment support, a simplified model for component interaction, and debugging and profiling services

5. What are Namespaces?
The namespace keyword is used to declare a scope. This namespace scope lets you organize code and gives you a way to create globally-unique types. Even if you do not explicitly declare one, a default namespace is created. This unnamed namespace, sometimes called the global namespace, is present in every file. Any identifier in the global namespace is available for use in a named namespace. Namespaces implicitly have public access and this is not modifiable.

6. What are the access-specifiers available in c#?
Private, Protected, Public, Internal, Protected Internal.

7. Advantage of ADO.Net?
ADO.NET Does Not Depend On Continuously Live Connections
Database Interactions Are Performed Using Data Commands
Data Can Be Cached in Datasets
Datasets Are Independent of Data Sources
Data Is Persisted as XML
Schemas Define Data Structures

8. Difference between OLEDB Provider and SqlClient ?
SQLClient .NET classes are highly optimized for the .net / sqlserver combination and achieve optimal results. The SqlClient data provider is fast. It's faster than the Oracle provider, and faster than accessing database via the OleDb layer. It's faster because it accesses the native library (which automatically gives you better performance), and it was written with lots of help from the SQL Server team.

9. Differences between dataset.clone and dataset.copy?
Clone - Copies the structure of the DataSet, including all DataTable schemas, relations, and constraints.Does not copy any data
Copy - Copies both the structure and data for this DataSet.

10. In a Webservice, need to display 10 rows from a table. So DataReader or DataSet is best choice?
WebService will support only DataSet.

11. What is Remoting?
The process of communication between different operating system processes, regardless of whether they are on the same computer. The .NET remoting system is an architecture designed to simplify communication between objects living in different application domains, whether on the same computer or not, and between different contexts, whether in the same application domain or not.

12. What’s the difference between System.String and System.StringBuilder classes?
System.String is immutable; System.StringBuilder was designed with the purpose of having a mutable string where a variety of operations can be performed.

13. What’s a delegate?
A delegate object encapsulates a reference to a method. In C++ they were referred to as function pointers.

14. What’s an interface class?
It’s an abstract class with public abstract methods all of which must be implemented in the inherited classes

15. What is the transport protocol you use to call a Web service
SOAP is the preferred protocol.

ASP.NET interview questions - 4

2008-11-03T06:07:00.000-08:00

1. Does C# support multiple inheritance?
No, use interfaces instead

2. What’s the implicit name of the parameter that gets passed into the class’ set method?
Value, and its datatype depends on whatever variable we’re changing

3. What’s the top .NET class that everything is derived from?
System.Object.

4. How’s method overriding different from overloading?
When overriding, you change the method behavior for a derived class. Overloading simply involves having a method with the same name within the class.

5. What is CLR?
The .NET Framework provides a runtime environment called the Common Language Runtime or CLR (similar to the Java Virtual Machine or JVM in Java), which handles the execution of code and provides useful services for the implementation of the program. CLR takes care of code management at program execution and provides various beneficial services such as memory management, thread management, security management, code verification, compilation, and other system services. The managed code that targets CLR benefits from useful features such as cross-language integration, cross-language exception handling, versioning, enhanced security, deployment support, and debugging.

6. What is CTS?
Common Type System (CTS) describes how types are declared, used and managed in the runtime and facilitates cross-language integration, type safety, and high performance code execution.

7. What is CLS?
The CLS is simply a specification that defines the rules to support language integration in such a way that programs written in any language, yet can interoperate with one another, taking full advantage of inheritance, polymorphism, exceptions, and other features. These rules and the specification are documented in the ECMA proposed standard document, "Partition I Architecture", http://msdn.microsoft.com/net/ecma

8. What is strong name?
A name that consists of an assembly's identity—its simple text name, version number, and culture information (if provided)—strengthened by a public key and a digital signature generated over the assembly.

9. What is Application Domain?
The primary purpose of the AppDomain is to isolate an application from other applications. Win32 processes provide isolation by having distinct memory address spaces. This is effective, but it is expensive and doesn't scale well. The .NET runtime enforces AppDomain isolation by keeping control over the use of memory - all memory in the AppDomain is managed by the .NET runtime, so the runtime can ensure that AppDomains do not access each other's memory. Objects in different application domains communicate either by transporting copies of objects across application domain boundaries, or by using a proxy to exchange messages.

10. What is serialization in .NET? What are the ways to control serialization?
Serialization is the process of converting an object into a stream of bytes. Deserialization is the opposite process of creating an object from a stream of bytes. Serialization/Deserialization is mostly used to transport objects (e.g. during remoting), or to persist objects (e.g. to a file or database).Serialization can be defined as the process of storing the state of an object to a storage medium. During this process, the public and private fields of the object and the name of the class, including the assembly containing the class, are converted to a stream of bytes, which is then written to a data stream. When the object is subsequently deserialized, an exact clone of the original object is created. Binary serialization preserves type fidelity, which is useful for preserving the state of an object between different invocations of an application. For example, you can share an object between different applications by serializing it to the clipboard. You can serialize an object to a stream, disk, memory, over the network, and so forth. Remoting uses serialization to pass objects "by value" from one computer or application domain to another. XML serialization serializes only public properties and fields and does not preserve type fidelity. This is useful when you want to provide or consume data without restricting the application that uses the data. Because XML is an open standard, it is an attractive choice for sharing data across the Web. SOAP is an open standard, which makes it an attractive choice. There are two separate mechanisms provided by the .NET class library - XmlSerializer and SoapFormatter/BinaryFormatter. Microsoft uses XmlSerializer for Web Services, and uses SoapFormatter/BinaryFormatter for remoting. Both are available for use in your own code.

MS SQL Interview Questions -1

2008-11-03T06:05:00.001-08:00

1. What’s the difference between a primary key and a unique key?
Both primary key and unique enforce uniqueness of the column on which they are defined. But by default primary key creates a clustered index on the column, where are unique creates a nonclustered index by default. Another major difference is that, primary key doesn’t allow NULLs, but unique key allows one NULL only.

2. Write a SQL Query to find first Week Day of month?
SELECT DATENAME(dw, DATEADD(dd, - DATEPART(dd, GETDATE()) + 1, GETDATE())) AS FirstDay

3. How to find 6th highest salary from Employee table
SELECT TOP 1 salary FROM (SELECT DISTINCT TOP 6 salary FROM employee
ORDER BY salary DESC) a ORDER BY salary

4. What is a join and List different types of joins.
Joins are used in queries to explain how different tables are related. Joins also let you select data from a table depending upon data from another table. Types of joins: INNER JOINs, OUTER JOINs, CROSS Joints. OUTER JOINs are further classified as LEFT OUTER JOINS, RIGHT OUTER JOINS and FULL OUTER JOINS.

5. How can I enforce to use particular index?
You can use index hint (index=index_name) after the table name. SELECT au_lname FROM authors (index=aunmind)

6. What is sorting and what is the difference between sorting and clustered indexes?
The ORDER BY clause sorts query results by one or more columns up to 8,060 bytes. This will happen by the time when we retrieve data from database. Clustered indexes physically sorting data, while inserting/updating the table.

7. What are the differences between UNION and JOINS?
A join selects columns from 2 or more tables. A union selects rows.

8. What is the Referential Integrity?
Referential integrity refers to the consistency that must be maintained between primary and foreign keys, i.e. every foreign key value must have a corresponding primary key value

9. What is the row size in SQL Server 2000?
8060 bytes.

10. How to determine the service pack currently installed on SQL Server?
The global variable @@Version stores the build number of the sqlservr.exe, which is used to determine the service pack installed. eg: Microsoft SQL Server 2000 - 8.00.760 (Intel X86) Dec 17 2002 14:22:05 Copyright (c) 1988-2003 Microsoft Corporation Enterprise Edition on Windows NT 5.0 (Build 2195: Service Pack 3)

11. What is the purpose of UPDATE STATISTICS?
Updates information about the distribution of key values for one or more statistics groups (collections) in the specified table or indexed view.

12. What is the use of SCOPE_IDENTITY() function?
Returns the most recently created identity value for the tables in the current execution scope.

13. What are the different ways of moving data/databases between servers and databases in SQL Server?
There are lots of options available, you have to choose your option depending upon your requirements. Some of the options you have are: BACKUP/RESTORE, detaching and attaching databases, replication, DTS, BCP, logshipping, INSERT...SELECT, SELECT...INTO, creating INSERT scripts to generate data.

14. How do you transfer data from text file to database (other than DTS)?
Using the BCP (Bulk Copy Program) utility.

15. What's the difference between DELETE TABLE and TRUNCATE TABLE commands?
DELETE TABLE is a logged operation, so the deletion of each row gets logged in the transaction log, which makes it slow. TRUNCATE TABLE also deletes all the rows in a table, but it won't log the deletion of each row, instead it logs the deallocation of the data pages of the table, which makes it faster. Of course, TRUNCATE TABLE can't be rolled back.

16. What is a deadlock?
Deadlock is a situation when two processes, each having a lock on one piece of data, attempt to acquire a lock on the other's piece. Each process would wait indefinitely for the other to release the lock, unless one of the user processes is terminated. SQL Server detects deadlocks and terminates one user's process.

17. What is a LiveLock?
A livelock is one, where a request for an exclusive lock is repeatedly denied because a series of overlapping shared locks keeps interfering. SQL Server detects the situation after four denials and refuses further shared locks. A livelock also occurs when read transactions monopolize a table or page, forcing a write transaction to wait indefinitely.

18. How to restart SQL Server in single user mode?
From Startup Options :- Go to SQL Server Properties by right-clicking on the Server name in the Enterprise manager. Under the 'General' tab, click on 'Startup Parameters'. Enter a value of -m in the Parameter.

19. Does SQL Server 2000 clustering support load balancing?
SQL Server 2000 clustering does not provide load balancing; it provides failover support. To achieve load balancing, you need software that balances the load between clusters, not between servers within a cluster.

20. What is DTC?
The Microsoft Distributed Transaction Coordinator (MS DTC) is a transaction manager that allows client applications to include several different sources of data in one transaction. MS DTC coordinates committing the distributed transaction across all the servers enlisted in the transaction.

21. What is DTS?
Microsoft® SQL Server™ 2000 Data Transformation Services (DTS) is a set of graphical tools and programmable objects that lets you extract, transform, and consolidate data from disparate sources into single or multiple destinations.

22. What are defaults? Is there a column to which a default can't be bound?
A default is a value that will be used by a column, if no value is supplied to that column while inserting data. IDENTITY columns and timestamp columns can't have defaults bound to them.

23. What are the constraints ?
Table Constraints define rules regarding the values allowed in columns and are the standard mechanism for enforcing integrity. SQL Server 2000 supports five classes of constraints. NOT NULL , CHECK, UNIQUE, PRIMARY KEY, FOREIGN KEY.

24. What is Transaction?
A transaction is a sequence of operations performed as a single logical unit of work. A logical unit of work must exhibit four properties, called the ACID (Atomicity, Consistency, Isolation, and Durability) properties, to qualify as a transaction.

25. What is Isolation Level?
An isolation level determines the degree of isolation of data between concurrent transactions. The default SQL Server isolation level is Read Committed. A lower isolation level increases concurrency, but at the expense of data correctness. Conversely, a higher isolation level ensures that data is correct, but can affect concurrency negatively. The isolation level required by an application determines the locking behavior SQL Server uses. SQL-92 defines the following isolation levels, all of which are supported by SQL Server:

Read uncommitted (the lowest level where transactions are isolated only enough to ensure that physically corrupt data is not read).
Read committed (SQL Server default level).
Repeatable read.
Serializable (the highest level, where transactions are completely isolated from one
another).

SQL Query Fundamentals

2008-11-03T06:02:00.000-08:00

The full syntax of the SELECT statement is complex, but the main clauses can be summarized as:
SELECT select_list[INTO new_table_name]FROM table_list[WHERE search_conditions][GROUP BY group_by_list][HAVING search_conditions][ORDER BY order_list [ASC DESC] ]
select_list
Describes the columns of the result set. It is a comma-separated list of expressions. Each expression defines both the format (data type and size) and the source of the data for the result set column. Each select list expression is usually a reference to a column in the source table or view the data is coming from, but can be any other expression, such as a constant or a Transact-SQL function. Using the * expression in a select list specifies that all columns in the source table are returned.
INTO new_table_name
Specifies that the result set is used to create a new table. new_table_name specifies the name of the new table.
FROM table_list
Contains a list of the tables from which the result set data is retrieved. These sources can be:
· Base tables in the local server running Microsoft® SQL Server™.
· Views in the local SQL Server. SQL Server internally resolves a view reference to references against the base tables that make up the view.
· Linked tables, which are tables in OLE DB data sources made accessible to SQL Server. This is called a distributed query. OLE DB data sources can be accessed from SQL Server by linking them as a linked server, or referencing the data source in an OPENROWSET or OPENQUERY function.
The FROM clause can also contain join specifications, which define the specific path SQL Server is to use in navigating from one table to another.
The FROM clause is also used on the DELETE and UPDATE statements to define the tables that are modified.
WHERE search_conditions
The WHERE clause is a filter that defines the conditions each row in the source tables must meet to qualify for the SELECT. Only rows that meet the conditions contribute data to the result set. Data from rows that do not meet the conditions are not used.
The WHERE clause is also used on the DELETE and UPDATE statements to define the rows in the target tables that are modified.

GROUP BY group_by_list
The GROUP BY clause partitions the result set into groups based on the values in the columns of the group_by_list. For example, the Northwind Orders table has three values in ShipVia. A GROUP BY ShipVia clause partitions the result set into three groups, one for each value of ShipVia.

HAVING search_conditions

The HAVING clause is an additional filter that is applied to the result set. Logically, the HAVING clause filters rows from the intermediate result set built from the application of any FROM, WHERE, or GROUP BY clauses in the SELECT statement. HAVING clauses are most commonly used with a GROUP BY clause, although a GROUP BY clause is not required before a HAVING clause.
ORDER BY order_list [ ASC DESC ]

The ORDER BY clause defines the order in which the rows in the result set are sorted. order_list specifies the result set columns that make up the sort list. The ASC and DESC keywords are used to specify if the rows are sorted in an ascending or descending sequence.

ORDER BY is important because relational theory specifies that the rows in a result set cannot be assumed to have any sequence unless ORDER BY is specified. ORDER BY must be used in any SELECT statement for which the order of the result set rows is important.
The clauses in a SELECT statement must be specified in the proper order.
Each reference to a database object must be unambiguous. Ambiguity can come from these sources:

· There may be multiple objects with the same name in a system. For example, both User1 and User2 may have defined a table named TableX. To resolve the ambiguity and specify the TableX owned by User1, qualify the table name with at least the user ID: ·

SELECT * FROM User1.TableX

· The database in which the object resides may not always be the current database when the SELECT statement is executed. To ensure that the proper object is always used, regardless of the current database setting, qualify the object name with the database and owner: ·

SELECT * FROM Northwind.dbo.Shippers

ASP.NET interview questions - 3

2008-11-02T03:45:00.000-08:00

What is different b/w webconfig.xml & Machineconfig.xml?
Web.config & machine.config both are configuration files.Web.config contains settings specific to an application where as machine.config contains settings to a computer. The Configuration system first searches settings in machine.config file & then looks in application configuration files.Web.config, can appear in multiple directories on an ASPNET Web application server. Each Web.config file applies configuration settings to its own directory and all child directories below it. There is only Machine.config file on a web server.
If I'm developing an application that must accomodate multiple security levels though secure login and my ASPNET web appplication is spanned across three web-servers (using round-robbin load balancing) what would be the best approach to maintain login-in state for the users?Use the state server or store the state in the database. This can be easily done through simple setting change in the web.config.

You can specify mode as ?stateserver? or ?sqlserver?.
Where would you use an iHTTPModule, and what are the limitations of any approach you might take in implementing one"One of ASPNET's most useful features is the extensibility of the HTTP pipeline, the path that data takes between client and server. You can use them to extend your ASPNET applications by adding pre- and post-processing to each HTTP request coming into your application. For example, if you wanted custom authentication facilities for your application, the best technique would be to intercept the request when it comes in and process the request in a custom HTTP module.

How do you turn off cookies for one page in your site?Since no Page Level directive is present, I am afraid that cant be done.

How do you create a permanent cookie?Permanent cookies are available until a specified expiration date, and are stored on the hard disk.So Set the 'Expires' property any value greater than DataTime.MinValue with respect to the current datetime. If u want the cookie which never expires set its Expires property equal to DateTime.maxValue.

Which method do you use to redirect the user to another page without performing a round trip to the client?Server.Transfer and Server.Execute

What property do you have to set to tell the grid which page to go to when using the Pager object?CurrentPageIndex

Should validation (did the user enter a real date) occur server-side or client-side? Why?It should occur both at client-side and Server side.By using expression validator control with the specified expression ie.. the regular expression provides the facility of only validatating the date specified is in the correct format or not. But for checking the date where it is the real data or not should be done at the server side, by getting the system date ranges and checking the date whether it is in between that range or not.

What does the "EnableViewState" property do? Why would I want it on or off?Enable ViewState turns on the automatic state management feature that enables server controls to re-populate their values on a round trip without requiring you to write any code. This feature is not free however, since the state of a control is passed to and from the server in a hidden form field. You should be aware of when ViewState is helping you and when it is not. For example, if you are binding a control to data on every round trip, then you do not need the control to maintain it's view state, since you will wipe out any re-populated data in any case. ViewState is enabled for all server controls by default. To disable it, set the EnableViewState property of the control to false.

What is the difference between Server.Transfer and Response.Redirect? Why would I choose one over the other?Server.Transfer() : client is shown as it is on the requesting page only, but the all the content is of the requested page. Data can be persist accros the pages using Context.Item collection, which is one of the best way to transfer data from one page to another keeping the page state alive.
Response.Dedirect() :client know the physical location (page name and query string as well). Context.Items loses the persisitance when nevigate to destination page. In earlier versions of IIS, if we wanted to send a user to a new Web page, the only option we had was Response.Redirect. While this method does accomplish our goal, it has several important drawbacks. The biggest problem is that this method causes each page to be treated as a separate transaction. Besides making it difficult to maintain your transactional integrity, Response.Redirect introduces some additional headaches. First, it prevents good encapsulation of code. Second, you lose access to all of the properties in the Request object. Sure, there are workarounds, but they're difficult. Finally, Response.Redirect necessitates a round trip to the client, which, on high-volume sites, causes scalability problems. As you might suspect, Server.Transfer fixes all of these problems. It does this by performing the transfer on the server without requiring a roundtrip to the client.

Can you give an example of when it would be appropriate to use a web service as opposed to a non-serviced .NET component?
* Communicating through a Firewall When building a distributed application with 100s/1000s of users spread over multiple locations, there is always the problem of communicating between client and server because of firewalls and proxy servers. Exposing your middle tier components as Web Services and invoking the directly from a Windows UI is a very valid option. * Application Integration When integrating applications written in various languages and running on disparate systems. Or even applications running on the same platform that have been written by separate vendors. * Business-to-Business Integration This is an enabler for B2B intergtation which allows one to expose vital business processes to authorized supplier and customers. An example would be exposing electronic ordering and invoicing, allowing customers to send you purchase orders and suppliers to send you invoices electronically. * Software Reuse This takes place at multiple levels. Code Reuse at the Source code level or binary componet-based resuse. The limiting factor here is that you can reuse the code but not the data behind it. Webservice overcome this limitation. A scenario could be when you are building an app that aggregates the functionality of serveral other Applicatons. Each of these functions could be performed by individual apps, but there is value in perhaps combining the the multiple apps to present a unifiend view in a Portal or Intranet. * When not to use Web Services: Single machine Applicatons When the apps are running on the same machine and need to communicate with each other use a native API. You also have the options of using component technologies such as COM or .NET Componets as there is very little overhead. * Homogeneous Applications on a LAN If you have Win32 or Winforms apps that want to communicate to their server counterpart. It is much more efficient to use DCOM in the case of Win32 apps and .NET Remoting in the case of .NET Apps

Can you give an example of what might be best suited to place in the Application_Start and Session_Start subroutines?The Application_Start event is guaranteed to occur only once throughout the lifetime of the application. It's a good place to initialize global variables. For example, you might want to retrieve a list of products from a database table and place the list in application state or the Cache object. SessionStateModule exposes both Session_Start and Session_End events.

What are the advantages and disadvantages of viewstate?The primary advantages of the ViewState feature in ASPNET are:
1. Simplicity. There is no need to write possibly complex code to store form data between page submissions.2. Flexibility. It is possible to enable, configure, and disable ViewState on a control-by-control basis, choosing to persist the values of some fields but not others.
There are, however a few disadvantages that are worth pointing out:
1. Does not track across pages. ViewState information does not automatically transfer from page to page. With the sessionapproach, values can be stored in the session and accessed from other pages. This is not possible with ViewState, so storingdata into the session must be done explicitly.
2. ViewState is not suitable for transferring data for back-end systems. That is, data still has to be transferred to the backend using some form of data object.

ASP.NET interview questions - 2

2008-11-02T03:26:00.000-08:00

What are the different types of caching?Caching is a technique widely used in computing to increase performance by keeping frequently accessed or expensive data in memory. In context of web application, caching is used to retain the pages or data across HTTP requests and reuse them without the expense of recreating them.ASPNET has 3 kinds of caching strategies Output Caching
Fragment Caching
Data Caching

Output Caching: Caches the dynamic output generated by a request. Some times it is useful to cache the output of a website even for a minute, which will result in a better performance. For caching the whole page the page should have OutputCache directive.<%@ OutputCache Duration="60" VaryByParam="state" %>
Fragment Caching: Caches the portion of the page generated by the request. Some times it is not practical to cache the entire page, in such cases we can cache a portion of page<%@ OutputCache Duration="120" VaryByParam="CategoryID;SelectedID"%>
Data Caching: Caches the objects programmatically. For data caching ASPNET provides a cache object for eg: cache["States"] = dsStates;

What do you mean by authentication and authorization?
Authentication is the process of validating a user on the credentials (username and password) and authorization performs after authentication. After Authentication a user will be verified for performing the various tasks, It access is limited it is known as authorization.

What are different types of directives in .NET?
@Page: Defines page-specific attributes used by the ASPNET page parser and compiler. Can be included only in .aspx files <%@ Page AspCompat="TRUE" language="C#" %> @Control:Defines control-specific attributes used by the ASPNET page parser and compiler. Can be included only in .ascx files.
<%@ Control Language="VB" EnableViewState="false" %>
@Import: Explicitly imports a namespace into a page or user control. The Import directive cannot have more than one namespace attribute. To import multiple namespaces, use multiple @Import directives. <% @ Import Namespace="System.web" %>@Implements: Indicates that the current page or user control implements the specified .NET framework interface.
<%@ Implements Interface="System.Web.UI.IPostBackEventHandler" %>@Register: Associates aliases with namespaces and class names for concise notation in custom server control syntax.
<%@ Register Tagprefix="Acme" Tagname="AdRotator" Src="AdRotator.ascx" %>
@Assembly: Links an assembly to the current page during compilation, making all the assembly's classes and interfaces available for use on the page. <%@ Assembly Name="MyAssembly" %>
<%@ Assembly Src="MySource.vb" %>@OutputCache: Declaratively controls the output caching policies of an ASPNET page or a user control contained in a page<%@ OutputCache Duration="#ofseconds" Location="Any Client Downstream Server None" Shared="True False" VaryByControl="controlname" VaryByCustom="browser customstring" VaryByHeader="headers" VaryByParam="parametername" %>
@Reference: Declaratively indicates that another user control or page source file should be dynamically compiled and linked against the page in which this directive is declared.

How do I debug an ASPNET application that wasn't written with Visual Studio.NET and that doesn't use code-behind?Start the DbgClr debugger that comes with the .NET Framework SDK, open the file containing the code you want to debug, and set your breakpoints. Start the ASPNET application. Go back to DbgClr, choose Debug Processes from the Tools menu, and select aspnet_wp.exe from the list of processes. (If aspnet_wp.exe doesn't appear in the list,check the "Show system processes" box.) Click the Attach button to attach to aspnet_wp.exe and begin debugging.Be sure to enable debugging in the ASPX file before debugging it with DbgClr. You can enable tell ASPNET to build debug executables by placing a<%@ Page Debug="true" %> statement at the top of an ASPX file or a statement in a Web.config file.

Can a user browsing my Web site read my Web.config or Global.asax files?No. The section of Machine.config, which holds the master configuration settings for ASPNET, contains entries that map ASAX files, CONFIG files, and selected other file types to an HTTP handler named HttpForbiddenHandler, which fails attempts to retrieve the associated file. You can modify it by editing Machine.config or including an section in a local Web.config file.

What's the difference between Page.RegisterClientScriptBlock and Page.RegisterStartupScript?RegisterClientScriptBlock is for returning blocks of client-side script containing functions. RegisterStartupScript is for returning blocks of client-script not packaged in functions-in other words, code that's to execute when the page is loaded. The latter positions script blocks near the end of the document so elements on the page that the script interacts are loaded before the script runs.<%@ Reference Control="MyControl.ascx" %>

Is it necessary to lock application state before accessing it?
Only if you're performing a multistep update and want the update to be treated as an atomic operation. Here's an example:Application.Lock ();Application["ItemsSold"] = (int) Application["ItemsSold"] + 1;Application["ItemsLeft"] = (int) Application["ItemsLeft"] - 1;Application.UnLock (); By locking application state before updating it and unlocking it afterwards, you ensure that another request being processed on another thread doesn't read application state at exactly the wrong time and see an inconsistent view of it. If I update session state, should I lock it, too? Are concurrent accesses by multiple requests executing on multiple threads a concern with session state?Concurrent accesses aren't an issue with session state, for two reasons. One, it's unlikely that two requests from the same user will overlap. Two, if they do overlap, ASPNET locks down session state during request processing so that two threads can't touch it at once. Session state is locked down when the HttpApplication instance that's processing the request fires an AcquireRequestState event and unlocked when it fires a ReleaseRequestState event.

Do ASPNET forms authentication cookies provide any protection against replay attacks? Do they, for example, include the client's IP address or anything else that would distinguish the real client from an attacker?
No. If an authentication cookie is stolen, it can be used by an attacker. It's up to you to prevent this from happening by using an encrypted communications channel (HTTPS). Authentication cookies issued as session cookies, do, however,include a time-out valid that limits their lifetime. So a stolen session cookie can only be used in replay attacks as long as the ticket inside the cookie is valid. The default time-out interval is 30 minutes.You can change that by modifying the timeout attribute accompanying the element in Machine.config or a local Web.config file. Persistent authentication cookies do not time-out and therefore are a more serious security threat if stolen.

How do I send e-mail from an ASPNET application?
MailMessage message = new MailMessage ();message.From = ;message.To = ;message.Subject = "Scheduled Power Outage";message.Body = "Our servers will be down tonight.";SmtpMail.SmtpServer = "localhost";SmtpMail.Send (message);
MailMessage and SmtpMail are classes defined in the .NET Framework Class Library's System.Web.Mail namespace. Due to a security change made to ASPNET just before it shipped, you need to set SmtpMail's SmtpServer property to "localhost" even though "localhost" is the default. In addition, you must use the IIS configuration applet to enable localhost (127.0.0.1) to relay messages through the local SMTP service.

What are VSDISCO files?
VSDISCO files are DISCO files that support dynamic discovery of Web services. If you place the following VSDISCO file in a directory on your Web server, for example, it returns references to all ASMX and DISCO files in the host directory and any subdirectories not noted in elements:

How does dynamic discovery work?
ASPNET maps the file name extension VSDISCO to an HTTP handler that scans the host directory and subdirectories for ASMX and DISCO files and returns a dynamically generated DISCO document. A client who requests a VSDISCO file gets back what appears to be a static DISCO document.Note that VSDISCO files are disabled in the release version of ASPNET. You can reenable them by uncommenting the line in the section of Machine.config that maps *.vsdisco to System.Web.Services.Discovery.DiscoveryRequestHandler and granting the ASPNET user account permission to read the IIS metabase. However, Microsoft is actively discouraging the use of VSDISCO files because they could represent a threat to Web server security.

Is it possible to prevent a browser from caching an ASPX page?
Just call SetNoStore on the HttpCachePolicy object exposed through the Response object's Cache property, as demonstrated here:
<%@ Page Language="C#" %>
<% Response.Cache.SetNoStore (); Response.Write (DateTime.Now.ToLongTimeString ()); %>SetNoStore works by returning a Cache-Control: private, no-store header in the HTTP response. In this example, it prevents caching of a Web page that shows the current time.

What does AspCompat="true" mean and when should I use it?
AspCompat is an aid in migrating ASP pages to ASPX pages. It defaults to false but should be set to true in any ASPX file that creates apartment-threaded COM objects--that is, COM objects registered ThreadingModel=Apartment. That includes all COM objects written with Visual Basic 6.0. AspCompat should also be set to true (regardless of threading model) if the page creates COM objects that access intrinsic ASP objects such as Request and Response. The following directive sets AspCompat to true:
<%@ Page AspCompat="true" %>
Setting AspCompat to true does two things. First, it makes intrinsic ASP objects available to the COM components by placing unmanaged wrappers around the equivalent ASPNET objects. Second, it improves the performance of calls that the page places to apartment- threaded COM objects by ensuring that the page (actually, the thread that processes the request for the page) and the COM objects it creates share an apartment. AspCompat="true" forces ASPNET request threads into single-threaded apartments (STAs). If those threads create COM objects marked ThreadingModel=Apartment, then the objects are created in the same STAs as the threads that created them. Without AspCompat="true," request threads run in a multithreaded apartment (MTA) and each call to an STA-based COM object incurs a performance hit when it's marshaled across apartment boundaries.Do not set AspCompat to true if your page uses no COM objects or if it uses COM objects that don't access ASP intrinsic objects and that are registered ThreadingModel=Free or ThreadingModel=Both.

Explain the differences between Server-side and Client-side code?
Server side scripting means that all the script will be executed by the server and interpreted as needed. ASP doesn't have some of the functionality like sockets, uploading, etc. For these you have to make a custom components usually in VB or VC++. Client side scripting means that the script will be executed immediately in the browser such as form field validation, clock, email validation, etc. Client side scripting is usually done in VBScript or JavaScript. Download time, browser compatibility, and visible code - since JavaScript and VBScript code is included in the HTML page, then anyone can see the code by viewing the page source. Also a possible security hazards for the client computer.

What type of code (server or client) is found in a Code-Behind class?
C#

Should validation (did the user enter a real date) occur server-side or client-side? Why?Client-side validation because there is no need to request a server side date when you could obtain a date from the client machine.

What are ASPNET Web Forms? How is this technology different than what is available though ASP?
Web Forms are the heart and soul of ASPNET. Web Forms are the User Interface (UI) elements that give your Web applications their look and feel. Web Forms are similar to Windows Forms in that they provide properties, methods, and events for the controls that are placed onto them. However, these UI elements render themselves in the appropriate markup language required by the request, e.g. HTML. If you use Microsoft Visual Studio .NET, you will also get the familiar drag-and-drop interface used to create your UI for your Web application.

What is the difference between Server.Transfer and Response.Redirect?
Why would I choose one over the other?In earlier versions of IIS, if we wanted to send a user to a new Web page, the only option we had was Response.Redirect. While this method does accomplish our goal, it has several important drawbacks. The biggest problem is that this method causes each page to be treated as a separate transaction. Besides making it difficult to maintain your transactional integrity, Response.Redirect introduces some additional headaches. First, it prevents good encapsulation of code. Second, you lose access to all of the properties in the Request object. Sure, there are workarounds, but they're difficult. Finally, Response.Redirect necessitates a round trip to the client, which, on high-volume sites, causes scalability problems.As you might suspect, Server.Transfer fixes all of these problems. It does this by performing the transfer on the server without requiring a roundtrip to the client.

How can you provide an alternating color scheme in a Repeater control?AlternatingItemTemplate Like the ItemTemplate element, but rendered for every other row (alternating items) in the Repeater control. You can specify a different appearance for the AlternatingItemTemplate element by setting its style properties.
Which template must you provide, in order to display data in a Repeater control?ItemTemplate

What event handlers can I include in Global.asax?
Application_Start,Application_End, Application_AcquireRequestState, Application_AuthenticateRequest, Application_AuthorizeRequest, Application_BeginRequest, Application_Disposed, Application_EndRequest, Application_Error, Application_PostRequestHandlerExecute, Application_PreRequestHandlerExecute,Application_PreSendRequestContent, Application_PreSendRequestHeaders, Application_ReleaseRequestState, Application_ResolveRequestCache, Application_UpdateRequestCache, Session_Start,Session_EndYou can optionally include "On" in any of method names. For example, you can name a BeginRequest event handler.Application_BeginRequest or Application_OnBeginRequest.You can also include event handlers in Global.asax for events fired by custom HTTP modules.Note that not all of the event handlers make sense for Web Services (they're designed for ASPNET applications in general, whereas .NET XML Web Services are specialized instances of an ASPNET app). For example, the Application_AuthenticateRequest and Application_AuthorizeRequest events are designed to be used with ASPNET Forms authentication.

ASP.NET interview questions - 1

2008-11-02T03:19:00.000-08:00

What is view state and use of it?The current property settings of an ASPNET page and those of any ASPNET server controls contained within the page. ASPNET can detect when a form is requested for the first time versus when the form is posted (sent to the server), which allows you to program accordingly.

What are user controls and custom controls?Custom controls:A control authored by a user or a third-party software vendor that does not belong to the .NET Framework class library. This is a generic term that includes user controls. A custom server control is used in Web Forms (ASPNET pages). A custom client control is used in Windows Forms applications.
User Controls:In ASPNET: A user-authored server control that enables an ASPNET page to be re-used as a server control. An ASPNET user control is authored declaratively and persisted as a text file with an .ascx extension. The ASPNET page framework compiles a user control on the fly to a class that derives from the System.Web.UI.UserControl class.

What are the validation controls?A set of server controls included with ASPNET that test user input in HTML and Web server controls for programmer-defined requirements. Validation controls perform input checking in server code. If the user is working with a browser that supports DHTML, the validation controls can also perform validation using client script.

What's the difference between Response.Write() andResponse.Output.Write()?The latter one allows you to write formattedoutput.

What methods are fired during the page load?

Init()When the page is instantiated, Load() - when the page is loaded into server memory,PreRender () - the brief moment before the page is displayed to the user as HTML, Unload() - when page finishes loading.

Where does the Web page belong in the .NET Framework class hierarchy?System.Web.UI.Page

Where do you store the information about the user's locale?System.Web.UI.Page.Culture

What's the difference between Codebehind="MyCode.aspx.cs" and Src="MyCode.aspx.cs"?CodeBehind is relevant to Visual Studio.NET only.

What's a bubbled event?

When you have a complex control, likeDataGrid, writing an event processing routine for each object (cell, button,row, etc.) is quite tedious. The controls can bubble up their eventhandlers, allowing the main DataGrid event handler to take care of its constituents.Suppose you want a certain ASPNET function executed on MouseOver over a certain button.

Where do you add an event handler?

It's the Attributesproperty, the Add function inside that property. e.g. btnSubmit.Attributes.Add("onMouseOver","someClientCode();")

What data type does the RangeValidator control support?

Integer,String and Date.