Derek Hatchard blogs on
Church Radius Blog


Feed Yourself:


Subscribe in Bloglines

Add to Google

Subscribe by Email:


.NET Experts on Tap
About ArdentDev.com
Ardent Sites
Ask the Experts
Careers
Consulting and Mentoring
Contact Ardent
News & Noteworthy
Portfolio
Writing


On this page....
Another Bad Error Message
Bad Error Message == Bad Usability
Paste Special and Macros in Word 2007
Using ADSI to Authenticate Against Active Directory
Good news for smart client developers: SQL Server Everywhere
WPF Might Actually Induce a Paradigm Shift
Obtuse Error Messages Are Evil
Windows Workflow Articles
Go to VSLive Toronto - I'll pay 10% (sort of)
Sure, pop a random CD in your computer - what's the harm?
ASP.NET Membership and passwordStrengthRegularExpression
Visual Studio 2005 Express Editions free until November 2006

Send mail to the authors Email Us

Archives

Navigation

Categories
 Code
 Tools

Disclaimer
The opinions expressed in this site are those of the individual authors and do not necessarily represent the official view of Ardent Development nor its employees, subsidiaries, partners, or customers.

© Copyright 2008, Ardent Development

Powered by: newtelligence dasBlog 1.8.5223.1



 Friday, April 28, 2006

   
     

Well, I'm a roll with bad error messages this month. This week we finally received a merchant number and API token from Moneris to accept Mastercard and Visa for Church Radius. So I plugged the numbers into our configuration file and went to process a live credit card transaction. It failed with an error message saying "API Token Mismatch". What might this error message make you think is wrong? That you had an invalid API token? Good guess... But, nope. We got that error message because the sales team at Moneris had screwed up and not enabled recurring billing (subscriptions) to our merchant account. Even the tech guy at Moneris was confused. We figured it out by guessing at things that could be wrong.

The good news is that Church Radius is now completely and officially LIVE! Wahoo.

Technorati : , ,

Posted by Derek Hatchard 4/28/2006 6:22:36 PM (Atlantic Standard Time, UTC-04:00)
#   Disclaimer  |  Comments [1]  | 
 Wednesday, April 26, 2006

   
     

Error messages should be helpful. Bad error messages disrespect the user by saying, "something is wrong but I'm not going to tell you". I've made that point before.

Today I was treated to a paragraph-long error message explaining password complexity rules. The password that failed was this:

3"[cU8jlBe4vG}Zx{3^6@3

Look at this password with me. It's plenty long (22 char). It has numbers, uppercase characters, lowercase characters, and non-alphanumeric characters. It's a good random password. It was, in fact, randomly generated by Keith Browns's PasswordMinder.

I dissected the paragraph of error message to find buried in the middle this rule: must not have been changed within the last 1 day. Oh. The problem was not complexity but that my password had been reset yesterday. Here I was trying to be responsible by immediately changing my password after having it reset...

What really irks me is that the error condition is known specifically but the error message is generic. If the regular expression for password validation fails, tell me that the password is not complex enough. If I used the same password in the past, tell me that. If I cannot change my password today because it was changed yesterday, tell me THAT.

When the specific error condition is known, tell the user exactly what is wrong and whether or not it is his/her fault. That way he/she can act appropriately without resorting to detective work.

Posted by Derek Hatchard 4/26/2006 1:40:01 PM (Atlantic Standard Time, UTC-04:00)
#   Disclaimer  |  Comments [1]  | 
 Tuesday, April 25, 2006

   
     

I've been trying out Office 2007 for a few weeks to give the ribbon UI a chance. I'm a shortcut key fanatic and frig, frig, FRIG!!! I frequently use Paste Special to paste unformatted text. In shipping versions of Word I press Alt+E, S, Ctrl+End, Enter (I'm pretty fast at that combo). Eventually I get around to recording a macro and assigning it Ctrl+Alt+Shift+V. With the new ribbon interface I have to press Alt+E, C, V, S, Ctrl+End, Enter. Not too short for a "shortcut".

"Oh, Derek," you say. "Stop whining and go create a macro." Sure, OK. Wait a minute... How do I create a macro? There is no longer a Tools menu. No mention of macros on any of the tabs. Grrrr...

The solution? Go to File | Word Options. Select Views. Check Developer Tools. A new Developer tab now shows up providing access to macros and some other stuff (like XML schemas). Yeah, I know - exceedingly intuitive compared to Tools | Macro | Record New Macro.

Now, I'm not exactly a Word power user but I can hold my own, and I suspect I am not the only person who is not going to appreciate feeling like a novice in my word processor. I am convinced that ribbon-enabled Office 2007 products will ultimately ship with a compatibility mode (standard menus, toolbars, etc.). I personally won't use it, I'll fumble my way through figuring out the new UI. But lack of a compat mode will hinder adoption. Or maybe everyone has forgotten how essential it was to have a WordPerfect compatibility mode.

Update: Turns out the Developer tab is also how you edit document properties like Author and Title. I was wondering where that functionality went since it's not accessible under the File menu. Personally I think this feature should have been made more accessible, not less. Document properties can really matter when you start putting things into SharePoint or some other document management system.

Technorati : , ,

Posted by Derek Hatchard 4/25/2006 9:37:03 PM (Atlantic Standard Time, UTC-04:00)
#   Disclaimer  |  Comments [1]  | 

   
     

I dusted off my modest ADSI skills yesterday to help some folks figure out how to authenticate against Active Directory by binding to it using LDAP. Here's a VBScript version using ADSI (run at command line using cscript.exe).

Const ADS_SECURE_AUTHENTICATION = 1

Dim uid, pwd

WScript.StdOut.Write "User name (with domain prefix): "
uid = WScript.StdIn.ReadLine

WScript.StdOut.Write "Please enter your password:"
Set objPassword = CreateObject("ScriptPW.Password")
pwd = objPassword.GetPassword()
WScript.Echo

' Get just the username (samAccountName)
Dim username
tmp = Split(uid, "\")
username = tmp(1)

Dim LDAP 'As IADsOpenDSObject
Dim LDAPString
LDAPString = "LDAP://cn=Users,dc=yourdomain,dc=local"

'''
''' Important Lines Right Here
'''
Set LDAP = GetObject("LDAP:")
Set obj = LDAP.OpenDSObject(LDAPString, uid, pwd, ADS_SECURE_AUTHENTICATION)
'''
'''
'''

For Each o in obj
If o.Class = "user" Then
If o.Get("samAccountName") = username Then
WScript.Echo "Found " & o.Get("cn")
End If
End If
Next

Posted by Derek Hatchard 4/25/2006 7:10:06 PM (Atlantic Standard Time, UTC-04:00)
#   Disclaimer  |  Comments [0]  | 
 Monday, April 10, 2006

   
     

Microsoft has announced SQL Server Everywhere (SQL Everywhere, or the fun but unofficial SQL/e). It is basically SQL Mobile but will run on mobile and desktop versions of Windows. That's really good news if you want a lightweight, in-process database engine for smart client apps.

Here's the nitty-gritty from Steve Lasker: http://blogs.msdn.com/stevelasker/archive/2006/04/10/SqlEverywhereInfo.aspx

Posted by Derek Hatchard 4/10/2006 3:34:58 PM (Atlantic Standard Time, UTC-04:00)
#   Disclaimer  |  Comments [0]  | 
 Tuesday, April 04, 2006

   
     

You know, I don't think enough people recognize the real potential for WPF (Windows Presentation Foundation, formerly "Avalon") to change the software experience.  WPF could mean that Windows and Web applications look and feel the same.  Given the reach of Internet Explorer, there will be a wide implicit adoption of WPF in the browser.  And WPF "Everywhere" (WPF/E) opens up a subset of WPF for other browsers and platforms.  Think about that for a second...  Define the user interface once and have it work in both desktop and browser deployment scenarios.

The implications are actually pretty cool.  You could define one user interface and one backend logic layer.  All you need is a connector that can feed either a desktop or browser launched version of an app.  The implications are huge if someone can make all the pieces work right.

I suspect the reason Atlas is taking so long is that Microsoft wants to make sure the client-side browser model will work for both HTML and WPF.

Posted by Derek Hatchard 4/4/2006 8:26:30 PM (Atlantic Standard Time, UTC-04:00)
#   Disclaimer  |  Comments [3]  | 
 Thursday, March 30, 2006

   
     

I was getting this error message when I tried to open a document in Word 2003: "This document could not be registered. It will not be possible to create links from other documents to this document."

Word still worked but I was unable to drag-and-drop content. And Outlook would not let me use Word as the editor for my email (which is perhaps an evil thing to do anyway).

Turns out the problem was that a service was not starting automatically (DCOM Server Process Launcher). I don't recall making that change but that's beside the point.  The point is that the error message is terrible. It is disrespectful to the user because it hints at an underlying problem but does not give you any guidance on how to fix it. Sadly, disrespectful error messages are much too common.

Posted by Derek Hatchard 3/30/2006 9:00:04 AM (Atlantic Standard Time, UTC-04:00)
#   Disclaimer  |  Comments [1]  | 
 Tuesday, March 28, 2006

   
     

A couple articles on Windows Workflow from Scott Allen:

http://www.odetocode.com/Articles/447.aspx

http://www.odetocode.com/Articles/448.aspx

Posted by Derek Hatchard 3/28/2006 11:18:16 AM (Atlantic Standard Time, UTC-04:00)
#   Disclaimer  |  Comments [0]  | 

   
     

Here's what you need to do:

  1. Go to https://ftponline.com/conferences/register/vslive/2006/toronto/
  2. Enter TDERE as your priority code for a 10% discount
  3. Complete your registration
  4. Go to VSLive Toronto and learn some stuff

There is some good content this year including a bunch of promising stuff on Day 1 (.NET Focus Day) and lots of interesting sessions from some well-known speakers.  Looks like some really solid technical content this year - I don't see any dud time slots.  Here's the agenda:

http://www.ftponline.com/conferences/vslive/2006/toronto/agenda.aspx

Posted by Derek Hatchard 3/28/2006 10:59:36 AM (Atlantic Standard Time, UTC-04:00)
#   Disclaimer  |  Comments [0]  | 

   
     

From http://mcpmag.com/columns/article.asp?editorialsid=1275:

An IT training firm in the U.K. conducted a stunt (or promotion, depending on your feelings about it) to demonstrate that users in London's Golden Mile, its financial district, need more security training. They stood alongside the road and handed out CDs claiming to contain a special Valentine's Day promotion. While no numbers have been provided, a spokesperson for the firm indicated that the CD, when inserted, would "call home" to the firm indicating the user had run it.

The CDs had written on the outside that you ought not to do this because it might be a violation of policy. Despite this, some employees ran the CDs anyway.

As a security conscious guy, this makes me scream, "Aaaaaaaaaaaarrrrrrrrrrrggggggggggghhhhhhhhhhhh."  <heaving sigh>

This column also has some interesting thoughts on the Search Across Computers feature of the Google Desktop that you might want to read.  Personally I loathe the Google Desktop.  I love the Google Deskbar which has been discontinued as a standalone product.  Too bad (thankfully I have a copy of the installer backed up for the future).

Posted by Derek Hatchard 3/28/2006 10:51:19 AM (Atlantic Standard Time, UTC-04:00)
#   Disclaimer  |  Comments [0]  | 
 Tuesday, March 21, 2006

   
     
Membership in the .NET framework 2.0 allows you to add security to your application with little to no code.

When trying to enforce strong password rules in our church software I encountered an interesting problem.

At first I modified the web.config by adding the following line to our membership provider section.

passwordStrengthRegularExpression="(?=.{8,})[a-z]+[^a-z]+|[^a-z]+[a-z]+"

RegEx explained: 8 characters or more in length, at least 1 lowercase letter, at least 1 character that is not a lower letter.

I removed:

minRequiredPasswordLength="0"
minRequiredNonalphanumericCharacters="1"

After some testing I found that even when following the password rules, a password change would fail.

The ChangePassword control, which is part of the Login suite of controls, doesn’t give you any information as to why the password changed failed.

After a few reviews of my RegEx and confirming that the syntax is correct in code and with some useful online regular expression testers (see links below), I tried changing the password using the following code:

MembershipUser mUser = Membership.GetUser(); // gets the current logged in user
//change the password
mUser.ChangePassword(mUser.GetPassword(), “invalidpassword”);

That caused the following exception: System.ArgumentException: Non alpha numeric characters in 'newPassword' needs to be greater than or equal to '1'.

So I added this line:

minRequiredNonalphanumericCharacters="0"

And our password complexity rule started working properly.

I won’t start a debate on the merit of setting the minimum required non alphanumeric characters (say that ten times) to 1, but hopefully this will help someone somewhere some time.

Links:

JavaScript Regular Expression Tester
http://www.roblocher.com/technotes/regexp.aspx

.NET Regular Expression Tester
http://www.dotnetcoders.com/web/Learning/Regex/RegexTester.aspx
Posted by Sebastien Aube 3/21/2006 4:28:48 PM (Atlantic Standard Time, UTC-04:00)
#   Disclaimer  |  Comments [8]  | 
 Monday, February 20, 2006

   
     

I didn't realize that the Express Editions of Visual Studio 2005 are only free until November 2006.

http://msdn.microsoft.com/vstudio/express/support/faq/default.aspx#pricing:

We originally announced pricing of Visual Studio Express at US$49. We are now offering Visual Studio Express for free, as a limited-in-time promotional offer, until November 6, 2006. Note that we are also offering SQL Server 2005 Express Edition as a free download, and that this offer is not limited to the same promotional pricing period as Visual Studio Express.

 

Posted by Derek Hatchard 2/20/2006 8:50:46 PM (Atlantic Standard Time, UTC-04:00)
#   Disclaimer  |  Comments [0]  | 
 
© 2005 Ardent Development Solutions