Windows Azure CTP January 2009 Released

At the 2008 Professional Developer Conference, Microsoft unveiled its cloud operating system, Windows Azure. Azure is the operating system that acts as the development, service hosting, and service management environment for the Azure Services Platform. This platform aids developers in publishing services and applications on the internet. Microsoft has released the latest CTP for Azure.

This latest Community Technology Preview updates the Windows Azure SDK and the Windows Azure tools for Visual Studio. The CTP brings several improvements:

The Windows Azure SDK offers improved support for the integration of development storage with Visual Studio, including enhanced performance.

For each Windows Azure SDK sample that accesses the development storage Table Storage service, a database name is now defined within the associated Visual Studio project. When the sample service is started from Visual Studio, the named database is created and the development storage Table Storage service is configured to use this database for the running service.

The StorageClient sample includes the following improvements.

The ASP.Net Providers sample now supports a search syntax similar to the ASP.Net SQL-based providers.

Read More...

ngine Yard takes Ruby and Rails to Amazon’s cloud bandwagon

Engine Yard, which makes application development software for Ruby and Rails deployments, said it will make its offerings available on Amazon Web Services.

The move is part of a mass migration to Amazon’s EC2 services. Engine Yard specializes in Ruby and Rails deployments. Ruby and Rails is an open source programming language used by a bevy of Web 2.0 sites. On Wednesday, the company launched Engine Yard Solo and Vertebra, two products designed to make deploying Ruby easier in a cloud computing setting.

Vertebra is an open platform for developing and managing cloud applications. Engine Yard used it for its own cloud but has open sourced the software. It features security policies, process automation, a federated design and distributed auditing.

Read More...

Ajax application Security

Ajax is not issue about application security but application programming model dose make application vulnerability more porous as per software engineering.JavaScript-powered client-server interactions do enlarge the attack surface.

Ajax application security issue can be address by take care in desiging of application architechture.Here I will going to introduce that thing which can resolve the Ajax application security problem.

SQL Injection : In these attacks, hackers first research common SQL error messages to find vulnerable pages and then modify Select statements to, for example, use a simple TextBox to gain access to a database. Ajax complicates matters because it makes it possible to write SQL expressions on the client side.

Tips to prevent this kind of attacke are:

1. Use CustomErrors pages in the WebConfig file to prevent attackers from identifying an application's particular vulnerability.
2. Use Stored procedures or parameterized SQL queries instead of dynamically created SQL queries.
3. Perform input validation on the server side, not through JavaScript.
4. Use the Least Privileges account for your database and do not allow access to system data. This builds on the notion that security should be implemented in single layers, Software Engineering stated: "You don't want them to be able to thwart one and then get to the data."

Information Leakage : If the JavaScript APIs that power an Ajax application are not properly secured, hackers can use application workflow data exposed on the client side to piece together server-side services. The best way to protect against this, not surprisingly, is to keep security validation on the server side. The only validation that should occur on the client side is that which defines the user experience

Cross site Scripting : In these attacks, hackers foist malicious JavaScript onto unsuspecting users. This tends to happen on Web sites featuring a simple TextBox and a button click that encapsulates text. Instead of, say, posting a comment in a forum, hackers will use this TextBox to put in a script tag to transfer large sums of money from your bank account to theirs. Ajax, as you might expect, leaves more APIs open than does a traditional Web application.

To Protect against Cross-site-scripting I would urge you to do your own validation to make sure you're not allowing this type of input." To best accomplish this, he recommended the use of a white list, which specifically states only the characters that a user is allowed to type in the TextBox. Make sure this list does not include script tags or HTML code.

Cross-Site Request Forging: These attacks use malicious image tags in emails and leverage browser cookies. The image acts as a placeholder for what is really a query string to make that aforementioned money transfer. Once that page loads, the image request triggers an HTTP GET action, and cookies are passed along with it. "The variables coming in from the query string look exactly the same as a post. It's using that cookie that's stored on your computer, and your information, to make that query work,"
Protecting against cross-site request forging involves three best practices, he continued. The first is to use HTTP POST data as opposed to HTTP GET data; the latter can be used for retrieving data, but it should not be used for performing any sort of action using that data. The second is to use one-time, per-token requests. The third is to stand up to nagging end users and stop using persistent cookies for authentication -- especially if sensitive data sits behind a log-in screen.

JavaScript Hijacking: This variation of cross-site request forging, which thanks to ASP.NET and IIS authentication does not occur in Internet Explorer, sets script tags to a particular URL that, when HTTP GET is passed, will return a JSON-formatted string. From there, the hacker modifies the object prototype to peer into JSON values when they are created. In addition to using the HTTP POST protocol, Lombardo said the best way to protect against JavaScript hijacking is to encode JSON strings on the server side, not the client side.

Lombardo offered two tidbits of advice that were not covered in his discussions of the five common Ajax security vulnerabilities.

First, he recommended removing the WSDL from Web services, as this only gives hackers information about an application that they otherwise would not be able to determine.

Read More..

Microsoft Releases First BizTalk 2009 Server Beta

Microsoft today released the public beta of BizTalk Server 2009 along with modules aimed at simplifying RFID deployments.

The BizTalk Server 2009 beta is the first public test version of Microsoft's latest services oriented architecture (SOA)-based integration platform. Microsoft indicated in September that the beta release was imminent. The live version is still on pace to ship in the first half of 2009, said Burley Kawasaki, a director with Microsoft's connected systems division.

"It's a feature complete release," Kawasaki said. "We're looking forward to gaining a lot more feedback on the release as part of finalizing it." The beta is available for download from Microsoft's Connect Web site to existing BizTalk customers subscribing to Microsoft's Software Assurance licensing program.

There are no major surprises in the release, commented Forrester analyst Ken Vollmer, but it is an important upgrade. "BizTalk has been widely used for low-end b-to-b connectivity, but it's gradually maturing and growing into a much more capable product in the enterprise integration space," Vollmer said.

BizTalk Server 2009 supports the latest versions of Microsoft's platform, notably the Windows Communications Foundation (WCF) component of the .NET Framework 3.5 SP1. With that comes support for Visual Studio 2008 SP1 and the latest releases of SQL Server and Windows Server. It also will support native Hyper-V, improved clustering, improved failover clustering, and added adaptors and host integration interfaces. It has a new registry based on the UDDI 3.0 specifications.

Read More...

Microsoft Releases Open-source Content Management App

Microsoft has released an early version of an open-source content management platform that developers can use to build sophisticated blogs or large Web sites.

Called Oxite, its creators describe it as a standards-compliant and highly extensible content management platform. They built it not because there is a need for another blog engine, but because they were building the MIX Online site for Web designers and wanted to offer an example of a use for ASP.NET MVC, according to the Oxite Web site.

ASP.NET MVC lets developers use ASP.NET to build Web applications using an architecture called model-view-controller. Microsoft released a preview of the ASP.NET MVC framework, designed to make it easier for developers to test applications, late last year.

Oxite includes a number of important blog functions that can be complex to implement, according to Microsoft. The framework offers many features common in blogs, including pingbacks, trackbacks, anonymous or authenticated comments with the option to moderate comments, RSS feeds for any page and a Web administration panel.

It's also designed for users to easily add new Web pages and sub-pages.

At first glance Oxite appears to compete with established blogging products including those from Six Apart. However, Microsoft says that Oxite is designed for developers, rather than less-technical Web users wanting to set up a blog.

Read More..

Google Chrome fixes Hotmail by being Safari

Google is continuing its rapid development of its Chrome browser with the dev-channel release of Chrome version 0.4.154.33. Again this is mostly a bug fix, though two of the bugs are really interesting.

Bug #6482 fixes an issue with composing mail and switching folders in Hotmail. The really interesting part is that Google admits that Hotmail does not yet properly recognize the Chrome browser so users need to trick Hotmail into thinking that Chrome is actually Apple Safari (which is supported by Hotmail).

Here's the workaround from Google to make Chrome appear to be Safari for Hotmail use:
Add the following to the shortcut you use to launch Google Chrome: --user-agent="Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Version/3.1 Safari/525.19" Right-click the Google Chrome shortcut, click Properties, and paste the line above to the end of the Target field.
Another interesting bug is #6418 which lets Google Desktop call Google Chrome as a default browser. Seems straight forward enough - though it sure does seem odd that Google Desktop wouldn't have fully supported Chrome from day one.

Read More..

Fixing the Enter Keypress Event in ASP.NET with jQuery

One of the most frustrating things about working with .NET from a front-end developer’s viewpoint is the Single Form Model. Enclosing an entire website or web-application in one single

element poses a number of accessibility and usability problems surrounding form input and usage. One of these is ensuring the correct default actions are assigned to sets of input fields when the enter key is used.

Traditionally, the default action for a is to fire the first submit button found within the current element. Every form has one default action.

Striking the enter key within a text input field should submit the current set of—logically grouped—fields; this is the expected behaviour. For pages with multiple forms and actions, this is easily separated by having multiple elements, each with their own submit buttons and actions. Each form operates independently, has its own default action, and doesn’t interfere with other forms.

In the Single Form Model, the presence of just one element, means that different default actions cannot be easily separated. Every input field on the page is automatically tied to just one default action – the first submit button on the page.

Take a blog site as an example – like this very page! It has a search form at the top, with associated submit button, a comment form further down the page and perhaps another form for signing up to a newsletter. Implemented with the Single Form Model, only the search form will produce the correct behaviour as it introduces the first submit button on the page. All subsequent fields will be tied to this same button as their default action – submitting a comment by pressing enter would cause the search form to submit, as would signing up to a newsletter. Not particularly useful.

Read More..

Using the .NET Assembly in PHP

Using the power of COM interop, you can write code in VB.Net or C# and use it in PHP, VB6, or any other language that can access COM. In this article Jayesh shows us how.The .NET Framework is a new computing platform that simplifies application development in the highly distributed environment of the Internet. The .NET Framework is designed to provide a consistent object-oriented programming environment, a code-execution environment that minimizes software deployment and versioning conflicts, which guarantees safe execution of code and to build all communication on industry standards to ensure that code based on the .NET Framework can integrate with any other code.

An assembly is the primary building block of a .NET Framework application. It is a collection of functionality that is built, versioned, and deployed as a single implementation unit containing one or more files. Each assembly contains an assembly manifest.

Read More..

Fundamentals of Asp.net Programming Vs. Php Programming

Hyper-text-pre-processor (PHP) and Active-server-pages (ASP) are the two standard programming languages for website application development and more significantly when it comes to produce database-driven websites to interrelating hugely with databases. PHP is an open-source programming language which is derived from lots of different languages. On the other hand ASP is such kind of programming languages which preferring Microsoft product mostly.

Both programming languages PHP and ASP are used to develop dynamic database oriented websites. Active Server Pages (ASP) is normally from Microsoft and is used only with Internet Information Server (IIS) that runs on Microsoft Servers also. But on the other hand you can say PHP is platform independent programming languages and can connect with several kinds of databases.

Read More..

How to Convert Your Site To A MasterPage Site in 3 Steps

Once you have your design converted into HTML/CSS, why should you have to worry about breaking it every time you create a new page? Abstract yourself from this with MasterPages, while still enabling yourself to easily make design changes. MasterPages are wonderful for standardizing your site and your design, in addition to making it easier to maintain and to build new pages. They are a very powerful and easily customizable way to template your site. This article is for those who don’t have much or any experience with MasterPages or are converting an old ASP.NET site to a MasterPage-driven site. If this is you, don’t be afraid—You can do it in just three easy steps!
1. Create a new MasterPage

Right click your project, go to “Add” and then “New Item…” and select MasterPage. Name it something useful, like “main.master” and hit ok. You should be presented with a barebones XHTML skeleton. Notice that your skeleton has this tag in it: . This is the location where your content will be loaded from your .aspx pages. Fill your new MasterPage with the XHTML that you wish to use on every page. If you want some things to change based on certain variables, you can do so in the codebehind. Treat the MasterPage like any other .aspx page. The only thing different about it (on a basic level) is that it does not contain your content, but rather what encompasses your content.
2. Link your old pages to your MasterPage in the Page Directive

In your <%@ Page directive, add the following attribute: MasterPageFile="~/YourMasterPage.Master"
3. Tell the MasterPage What Content Goes Where

If you only have one ContentPlaceHolder, you will add the following tag around all of your content in your .aspx pages: Hello, World!, where “ContentPlaceHolder1″ is the ID of the placeholder in your MasterPage that you linked to in step 2. If you have more than one ContentPlaceHolder in your MasterPage, simply wrap the tags around the correlating content.

And that’s it! That’s really all there is to it! Just apply steps 2 and 3 to each of your .aspx pages. There is an optional step for those who may have changed their pages’ codebehind inheritance:

Read More..

ASP.NET Compilation Models

ASP.NET Compilation

In the previous chapter, I covered the basics of ASP.NET code models. In this chapter, we'll discuss the details of how ASP.NET applications are compiled. This information is not vital to your success as an ASP.NET developer, but having an understanding of the architecture of your development environment always makes you a better developer.

ASP.NET is nothing like the legacy ASP with which many developers are familiar. You develop ASP pages by using VBScript or JScript, and they are interpreted, meaning that they are executed just as they are written, directly from the page. ASP.NET is entirely different in that ASP.NET pages are compiled before they are executed.

When you write ASP.NET code, you do so in human-readable text. Before ASP.NET can run your code, it has to convert it into something that the computer can understand and execute. The process of converting code from what a programmer types into what a computer can actually execute is called compilation.

Exactly how compilation takes place in ASP.NET depends on the compilation model that you use. Several different compilation models are available to you in ASP.NET 3.5.

The Web Application Compilation Model

The web application compilation model is the same model provided in ASP.NET 1.0 and 1.1. When you use this model, you use the Build menu in Visual Web Developer to compile your application into a single DLL file that is copied to a bin folder in the root of your application. When the first request comes into your application, the DLL from the bin folder is copied to the Temporary ASP.NET Files folder, where it is then recompiled into code that the operating system can execute in a process known as just-in-time (JIT) compilation. The JIT compilation causes a delay of several seconds on the first request of the application.

Read More...

PHP VS ASP.net

Ever since Microsoft has come up with ASP.net, there has been a widespread debate among programmers as to whether it is any better than the existing open source programming language of PHP.

If you were to make a search on the Internet on how loyalists of both PHP and ASP.net are doing almost everything by biting each other's heads off, you will realize how hot this debate actually is. The major contention is that Microsoft products are generally considered to be superior to other products, but then there are programmers that have been using PHP since ages and never once has it let them down. While there is acclaim for ASP.net being more robust and speedier, PHP fans maintain that PHP has much better support and a very easy to understand language.

As the debate between PHP and ASP.net rages on, it is important to make a frank comparison between the two languages, so that other developers who are not so strong in their opinions are not caught in the argument between the two. Here are some of the important points that distinguish the two programming languages from each other:-
PHP is a relatively simpler language to use than ASP.net. Initially, PHP was written in the C programming language to replace a set of scripts in Perl. That is the reason why coding in PHP remains simple even today. Many developers find themselves to be more at ease with the user-friendly nature of PHP when it comes to coding. However, critics also count this advantage of PHP as a disadvantage. Some of them maintain that the language of PHP has not been updated much, and hence it is still quite archaic and even, somewhat cumbersome for coding. ASP.net, which is a relatively new development, has a lot of options when it comes to languages. Here, you can use languages such as C#, J#, C++ and VB.net. Hence, when it comes to sheer choice, ASP.net has better to offer. But PHP is no less, since it can do its task quite well, even with its minimum language tools.

» PHP is has much better support for the database management system, MySQL. In fact, the very popular blogging platform, WordPress uses the formidable combination of PHP coding on MySQL for its content management system, which includes about hundreds of thousands of blog posts every single day. Another very popular and frequently updated service that uses the combination of PHP and MySQL is Wikipedia. ASP.net can also support MySQL, but PHP is unanimously hailed, by the masses and classes alike, for its great support for this database management system.

Read More...

ASP.NET Vs Others

When it comes to Web development these days, you have a lot of options. Many of these methods involve preprocessing—that is, embedding code into HTML pages with special tags that signal to a preprocessor that they contain code, and that it should do something with it. Much like a CGI, this code is then run on the server, and it returns some content, which then assumes part of the shape of the resulting HTML page sent back to the browser. Both the open source scripting language PHP and languages within Microsoft's ASP.NET framework fall into this category; JavaServer Pages (JSP) and Perl/Mason operate this way as well.

What is ASP.NET?
The latest incarnation of ASP, ASP.NET, is not completely backward-compatible with previous versions of ASP, as it is a complete rewrite of the software. Previous ASP technology actually has a lot more in common with PHP than with ASP.NET, which is a complete framework for building Web applications. One of the principal features of this model is the flexibility to choose your programming language. ASP.NET works with scripted languages such as VBScript, JScript, Perlscript, and Python, as well as compiled languages such as VB, C#, C, Cobol, Smalltalk, and Lisp. The new framework uses the common language runtime (CLR); your language source is compiled into Microsoft Intermediate Language code, which the CLR then executes.

The framework also provides for true object-oriented programming (OOP), and true inheritance, polymorphism, and encapsulation are supported. The .NET class library is organized into inheritable classes based around particular tasks, such as working with XML or image manipulation.

Besides the programming language and the methodology, database access is a significant concern. When you program in ASP.NET, integration with databases can be accomplished through ODBC, which provides a consistent set of calling functions to access your target database.

What is PHP?
PHP is a scripting language based on the model of preprocessing HTML pages. When the PHP preprocessor in your Web server notices a PHP language tag like the following, the PHP engine is invoked to execute that code:

some code here
?>

PHP will be familiar to any programmers who have worked with imperative programming languages; you'll notice syntactical similarities with Perl, C, and Java. Strictly speaking, Java is an imperative programming language, but it also makes use of object-oriented constructs and concepts. PHP borrows from this structure when it is convenient, but it is not a pure OOP language. Read More…