<< Latest Post

Saturday, August 22, 2015

HP Fortify Experiences



I recently had an opportunity to work with HP Fortify code analysis tool and I thought I would note down some of my thoughts on the tool.

What is HP Fortify?
  • HP Fortify is a static code analyzer that uses HP’s proprietary technology to scan the source code to identify any security vulnerabilities.
  •  As per HP documentation, HP Fortify Source Code Analyzer (SCA) version 4.21 consists of six distinct analyzers –
    • Data Flow - Flow of user input etc.
    • Control Flow - Potentially dangerous sequence of operation including variable initialization etc.
    • Semantic - Deprecated functions etc.
    • Structural - Dead code etc.
    • Configuration - Configuration issues etc.
    •  Buffer - Buffer overflow etc.
  • Analyzers are basically a set of Rule-Packs that are updated by HP.
  • Scanning tool (SourceAnalyzer.exe) can be launched in multiple ways –
    •  Scan Wizard GUI tool
    • Command line – SourceAnalyzer.exe with the parameters
    • HP Fortify Visual Studio Plug-in (various other plug-ins are available as well)
  • Scan generates .FPR (Fortify Project Format) files that can be viewed by couple of tools –
    • HP Audit Workbench (Desktop)
    • HP Fortify Software Security Center (Web)


General Observations
  • HP Fortify compiles the source code & converts them to a proprietary intermediate format (NST files) before launching the scan.
  • As part of the scan process, HP Fortify requires the ASP.NET pages to be pre-compiled before it runs the scan. Since Visual studio does not pre-compile by default, HP Fortify will not launch the scan if there are any ASP.NET Runtime errors.
  • HP Fortify does static analysis, so it does not take into account any web or app config setting that gets applied at runtime.
  • XML based services or code without proper schema will throw a lot of XML External Entity Injection issues. 
  • Single line of code that is accessed from multiple paths will be shown as multiple issues instead of just one. 
  • There is no clarity on prioritization of the issues – a line of code in one file could be tagged Critical while the same line in a different file could be a High priority.

Labels:





Monday, November 10, 2014

VisualSVN Upgrade to 3.0.0 - Authentication - Access Forbidden

I use VisualSVN Server Manager to manage all the repositories in our subversion server. It is a fairly simple tool to create & maintain the subversion repositories. I recently moved our subversion repositories to a different server and also upgraded the VisualSVN software from version 2.5.8 to 3.0.0. 

Even though the migration process is fairly simple & straight forward, the repository access permission/authentication mechanism has changed between these versions and that requires a small manual update. If the authentication mechanism is not fixed, subversion client will not connect to the server and it will fail with an error - "Access Forbidden" or "xxxx file not found under <repository>\conf folder".



Here are the steps for a simple migration -

  • Copy the subversion folder from old server to the new server.
  • Install VisualSVN Server software on the new server and make the copied folder location as the repository location.
  • Open the VisualSVN Server Manager
  • Right Click on each repository 
    • Repository -> Properties -> Security
    • On the security tab, click Add & add the required users and set their permissions.
    • The above step will create the necessary authentication files in the repository sub-folders.
  • Start the VisualSVN Server & connect to it using the subversion client.

Labels: , , , , , , , , , , , , , ,





Thursday, September 11, 2014

AppleWatch - Thoughts & some Unanswered Questions



After the Apple's announcement of the Apple Watch, the media as expected has been going gaga over the new device. In my first iWatch blog post on Feb 12, 2013, I gave a basic wish list of items that I would like to see in an iWatch and Apple has pretty much taken care of the entire list. In my second post on the same subject dated - June 19, 2014, I talked about the possible use of Bluetooth as the means of communication with the iPhone. It is not yet clear, what is the communication technology behind the Apple Watch, but Apple has stated that it has to be paired with an iPhone. So as I mentioned in my two previous posts, I still believe Apple Watch is an accessory to the existing apple device and not a completely new product category. 

Personally, after watching the launch event video, I feel Apple has a much grander plan for this device than a simple time clock. The name Watch might probably stand for watching your body along with the time. The sensors might play a much bigger role in the next iterations of the watch especially the haptic sensors (sense of touch). Also, I personally see this device as a universal remote controller that will be able to control every device owned by you. Of-course, everything depends on the 3rd party app developers and their eagerness to embrace it, which considering the past, should not be a problem.

Leaving that aside, here are some of the unanswered questions regarding the announced Apple Watch -
  • Will the Apple Watch only work with the iPhone or will it work with an iPad/iPod touch?
  • What is the battery life on the Apple Watch?
  • How does it communicate with the iPhone? Bluetooth or any other technology?
  • If using Bluetooth, 
    • Is the iPhone's Bluetooth permanently turned on?
    • How much battery drain is expected out of the iPhone if the Bluetooth is always on?
  • How does it work in an area without cellphone coverage or wireless coverage?
  • What is the maximum distance of separation between the iPhone & Apple Watch?
  • Do we need to switch to airplane mode on both the Apple Watch & iPhone or does the Apple Watch follow the iPhone?
  • Does it have storage?
  • It seems to play music, so does it store music or does it play from the phone? Also, is there an audio jack(of-course, it will be weird)?

Apple announced iPad in January 2010 and released it in April 2010. Considering the early 2015 release date of the watch, I am guessing, Apple probably had a similar timeline in mind for the watch. It is possible that Apple could have succumbed to media & public pressure to announce a new device that is not yet ready for prime time. 

There are many unanswered questions now, but I hope Apple will clarify it over time and as usual come out with a great final product. 


Labels: , , , , , , , , , , , , , , , , , , ,





Tuesday, September 09, 2014

ASP.NET - Web.Config - Compilation debug="true" - Bundling & Minification

I am using Bootstrap in one of my ASP.NET MVC project and during debugging I noticed that none of the Bootstrap styles were applied to the page. A quick check using the browser tools revealed that the bootstrap JavaScript file is not loaded as part of the project. The project has been setup to use ASP.NET bundling process to load the Bootstrap file and all the files were loaded except for the Bootstrap JavaScript file. The notable difference was that the Bootstrap JavaScript file was a minified file while the rest are not.

After a little research, I found that, if the debug attribute under compilation tag in web.config is set to true then ASP.NET project will not load the minified files while debugging the project. 

More information about this can be found in these following links - 


Labels: , , , , , , , , , , , , , , , ,





Friday, August 08, 2014

Bootstrap - Modal Dialog - TypeError



In one of my ASP.Net MVC project, I had a JavaScript function that launches a bootstrap modal dialog. Every time the function is called, it kept throwing an error -

Function Call - $("#Somediv").modal('show')

Error - Uncaught TypeError: undefined is not a function 

Of course, I checked, double checked & tried modifying the code, yet it kept failing. Taking the clue from the error ("not a function"), I started poking around the project looking for jQuery & Bootstrap files that are being loaded to explore the possibility that modal is not recognized as a function. 

Luckily, I was on the right track and it ended up being a file linking error as I was loading the jQuery & Bootstrap files twice - once part of the bundle & another using the script tag on the shared layout view. I have added the script tags for testing purposes & forgot to remove them. This was causing the files to load out of sync as jQuery has to be loaded before bootstrap for it to work!


Labels: , , , , , , , , , , , , ,





Friday, July 11, 2014

JavaScript or ASP.NET URL Encoding - Dot - Period

I was building an interface to a Google Search Appliance and one of its requirements is to double encode the URL. Interestingly, I noticed that none of the standard JavaScript URL encode functions like encodeURIComponent, encodeURI or escape actually encode the period or dot. Even the asp.net HttpUtility functions like UrlEncode, UrlPathEncode, UrlEncodeUnicode etc. does not encode the period or dot. If the query string data contains a period and if it is not encoded, the Google Search Appliance always returned the wrong data.

Naturally, I googled around and I could not find any reasonable solution to the problem. It seems that the widely accepted solution is to literally replace the period or dot with its ASCII value "%2E".

Even though it is a quick & dirty solution, it actually worked and the Google search appliance returned the valid data!! So, the quick JavaScript workaround is - anystring.replace (".","%2E")




Labels: , , , , , , , , , , , ,





Thursday, July 03, 2014

Windows Phone 8 - Global App Bar across all your pages


If you want to have a same App Bar across all the pages of your Windows Phone 8 app, it could be achieved by placing the code in the app level file App.xaml similar to Master Page or Global.asax.

Here are the steps to display the global app bar -

  • Add the app bar markup to the App.xaml file.

         App.xaml

          <shell:ApplicationBar x:Key="RootAppBar" IsVisible="True" IsMenuEnabled="True">
            <shell:ApplicationBar.MenuItems>
                <shell:ApplicationBarMenuItem Text="Your Text" Click="YourText_Click">
            </shell:ApplicationBarMenuItem>
           </shell:ApplicationBar.MenuItems>
          </shell:ApplicationBar>

  • If the menu item has a click event, then add the click event code to App.xaml.cs file. 
           void YourText_Click(object sender, EventArgs e)
           {
                // Write your click event code here.
           }

  • Finally, add reference to the app bar in the pages that needed an app bar. It can be done by adding ApplicationBar property and pointing it to a static resource in the global page markup. For e.g. if you would like to add a app bar on the main page, see the sample below,
        MainPage.xaml

          <phone:PhoneApplicationPage 
             xmlns:d="http://schemas.microsoft.com/expression/blend/2008"
             xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"
             mc:Ignorable="d"
             FontFamily="{StaticResource PhoneFontFamilyNormal}"
             FontSize="{StaticResource PhoneFontSizeNormal}"
             Foreground="{StaticResource PhoneForegroundBrush}"
            SupportedOrientations="Portrait" Orientation="Portrait"
            shell:SystemTray.IsVisible="True"
            ApplicationBar="{StaticResource RootAppBar}">


Labels: , , , , , , , , , , , , , , , , , ,





Thursday, June 26, 2014

Displaying Static HTML data in Windows Phone 8


If you want to display static HTML in Windows Phone 8 App, Web Browser control seems to be the only available default control. If Web Browser control is not acceptable, then another option is to use the FixedHTMLTextBlock from an external library called mytoolkit. The library is a free download through CodePlex, but the easier option is to download it from Visual Studio project using NuGet. 

Here are the steps to do it -

  • Search, download & reference mytoolkit & mytoolkit.extended from NuGet or CodePlex.

  • Add the following namespace to the XAML page
    xmlns:mytoolkit="clr-namespace:MyToolkit.Controls;assembly=MyToolkit.Extended"

  • Start using the FixedHtmlTextBlock in the XAML code as follows
    <mytoolkit:FixedHtmlTextBlock  Html="<Any Html Text>"/>


MyToolKit Library -

Labels: , , , , , , , , , , , , ,





Monday, June 09, 2014

iWatch - Standalone device or accessory?


It has not been a week since Apple announced a slew of software updates, but people are already speculating about iWatch. Most of the analysts are seeing this as a new device category from Apple. But I would like to point out that even though it might be a new device from Apple, it will most probably be a complementary accessory to their existing iPhone, iPod, iPad or Mac.

The data generated from people's ever growing list of wish list for iWatch has to be stored somewhere. Considering the size & battery needs, the data is probably stored in the cloud rather than the device. So, it either has to use cellular, wireless or Bluetooth to transmit the data. How will the watch transmit data in places with no cellular or wireless signal? Also, of-course, a phone like data plan from a carrier for a cellular signal makes no business sense.

Now, let us look at the continuity feature of iOS 8. Apple can now transfer an incoming call from your nearby iPhone to your MacBook. This is probably done using Bluetooth technology like our hands-free headphones for driving. They also showed that if you are using your Mac in a location with no nearby Wi-Fi signal, it could use your iPhone to create a personal hotspot & connect to Internet using the cellular network.

Based on the above features you can create an accessory to monitor your body along with a Bluetooth microphone, speaker & a time display - an iWatch. I think such a device would be an accessory to an existing Apple product rather than a standalone device.

As usual, if the Apple marketing team makes the above-speculated device as a must have cool device, then Apple might hit a jackpot by forcing people to buy an iPhone, iPod or iPad to go with the watch. But it also has some challenges, because the cost has to be very consumer friendly to make people buy a device to go with a must have accessory. Also, if Apple is targeting the healthcare industry with this device, will it be able to convince the industry to adopt a standard set by apple? Android ecosystem is not going to be obsolete and they would like to get their share of the pie.

If there is an above-speculated device, then it will be interesting to see if Apple could really come up with a product that could convince the people & the industry for a mass adoption.


Labels: , , , , , , , , , , ,





Sunday, June 08, 2014

Color Terminologies

How about some color lesson?

Here are some color terminologies –
  • Hue - Colors on the color wheel.
  • Tint - Adding a White to color.
  • Shade - Adding a black to color.
  • Tone   - Adding White + Back to color.
  • Saturation - Intensity of the color.
  • Luminance - Brightness of the color.




Labels: , , , , , , ,





Friday, March 28, 2014

Visual Studio Installation Error - Check that you have permissions & enough space in Visual Studio directory.

I was installing Visual Studio 2005 on a Windows 7 Enterprise machine and I got the following error during the installation process -

Visual Studio 2005 Installation Error


Reason -

Visual Studio 2005 setup was run from a ISO image mounted to a virtual drive on Windows 7. Apparently, Visual Studio installation has some permission issues when started from a virtual drive.


Resolution -

Easiest option is to burn the ISO image to a DVD & install from a DVD disc.


 

Labels: , , , , , , , ,





Thursday, March 27, 2014

Windows Activation - "Activation Failed. The product key is already being used on another pc."

I had previously installed & later uninstalled Windows 8 Pro on Parallels Desktop 8 on my MBP. Yesterday, I decided to re-install Windows 8 Pro on Parallel 8. After the installation and during the Windows activation process, I got an error something like -


Activation Failed. The product key is already being used on another pc.

After some googling I found that it is kind of a known issue and I followed some of the recommend steps to reactivate by resetting the windows key. Unfortunately, that did not work. After some trial & errors, I finally decided to do windows activation over the phone through Microsoft's automated process. Here are the steps I did to activate my Windows license through phone -
  • Opened RegEdit.exe on the Windows machine.
  • Browsed to HKEY_LOCAL_MACHINE/ Software/ Microsoft/ Windows/ CurrentVersion/ Setup/OOBE/
  • Changed MediaBootInstall from 1 to 0.
  • Opened a Command Prompt as an administrator (Right click & Run as Admin).
  • Typed & Executed - slmgr /rearm to reset activation key.
  • A message informed that activation key has been reset.
  • Restarted Windows.
  • After the reboot, again opened a command prompt as an administrator.
  • Typed & Executed - slui.exe 4
  • Now Windows Activation screen asked to select the user country and provided phone numbers & long verification numbers to activate by phone.
  • Called the phone number on the screen and followed the instructions.

NOTE - Even though it is a phone activation, it is fully automated and I did not speak to any human.


Labels: , , , , , , ,





Monday, November 11, 2013

Classic ASP - FileSystemObject - FileExits - Authentication Failure


FileSystemObject.FileExist method will fail while trying to access a remote folder from classic asp page (or VBScript). The FileExist method will return a False and not any error even though the file exist in the remote folder.This is because the IIS Anonymous Access User - IUSR_<MachineName> does not have permission to access the remote folder. 

In ASP.NET, this could be solved by impersonating a specific Identity (identity impersonate=true) in the web.config file. But in the classic ASP world, the default impersonating account is the IIS anonymous access account - IUSR_<MachineName> and there is no web.config file to point to a specific user. 

Obviously, the easiest option is to give IUSR_<MachineName> rights to access the remote folder, but practically not feasible in a real world scenario.

If it is a tiny project & if the project does not require integrated windows authentication then the alternate quick solution is to create a domain account and make that account as the anonymous access user for the whole web app or if you could isolate that specific code page to a separate folder under the web app, then that specific folder in IIS -

IIS -> Web App Folder -> Properties -> Directory Security -> Authentication & Access Control -> Anonymous Authentication

  • Replace the IUSR_<MachineName> account in the above location with the newly created domain account
  • Give the new domain account rights to access the remote folder.

In the case where the code actually throws an error like - 'Permission denied', 'Path not found' etc. then the Microsoft's solution of giving IUSR_<MachineName> access to remote folder can be found in this Knowledge Base article.


Labels: , , , , , , , , , , ,





Wednesday, June 26, 2013

Gun & Troopers - A Windows 8 Store App

I made my first foray into Windows 8 app store by building a simple computer shooter game called Gun & Troopers. It has passed Microsoft certification and it is now available for download for everybody from Windows 8 App store. It is a free app and anyone can download the game for Windows 8 or Windows RT here.



Labels: , , , , ,





Monday, April 08, 2013

Ms-DOS For Loop

After a long time, I used good old Ms-DOS to recursively delete large number of directories (~2500+) in Windows. A simple for loop like below is useful to do the same, 

To list the directories -
FOR /F "delims=" %i IN ('dir /s /b /ad <directory name>') DO @echo "%i"

To delete the directories -
FOR /F "delims=" %i IN ('dir /s /b /ad <directory name>') DO rmdir /S /Q "%i"


/F - Option to process the output of a command or file list. If it is not mentioned, then the whole section after "IN" with the "dir" command will be treated as a string.

delims= - Delimiter character. The default value is space & tab. Note - If not overridden as above or never mentioned in the command, the output gets chopped at the space if a directory name has any spaces. In the above scenario, the delimiter will be the end of line.

dir - Directory listing command with options,

  • /s - Display files in the specified directory & sub-directories
  • /b - Bare bones listing without time-stamp, volume or file size info.
  • /a - Display files with specified attributes. In this case,
    • d - to display directories only.

For more detailed Information on For loop can, check out this link





Tuesday, February 12, 2013

Why do I like the concept of Apple's iWatch?

The new speculation in the tech world is that Apple is working on some kind of a wrist watch like device. This morning on the radio, one of the CNET editors - Mollywood mentioned that she does not see much use for the product. I disagree.

Actually, I see some value in a product like that. Unlike many speculations, I do not see this as a standalone product, but more like an expensive accessory for an iOS device like iPhone or iPad. It will be cool if Apple could build a watch like device that runs iOS with Siri & bluetooth. Some of the uses on top of my head are -
  • Time automatically synced with NIST's atomic clock in Boulder, CO
  • Different clock styles with easily viewable display adjusting to time of the day.
  • Built in health monitor - blood pressure, pulse, heart rate etc.
  • Built in fitness apps - Pedometer, calorie burner etc.
  • Display incoming caller or phone number.
  • Siri - To perform actions on your iPhone or iPad.
  • Bluetooth - Imagine talking to your watch a la Secret Service style!
  • Reminders - vibrating watch is a much better than a vibrating cell phone on your desk or pocket.
  • Fashion accessory for women - They do not have to worry about carrying their phones with them all the time. 
I am sure there are lot more uses than the above list, but an important constraint will be the battery. Regular wrist watches run for years without changing the battery, but that might not be possible here. Also they have to think about heat dissipation as I do not want my wrist to feel hot after a long use.

Of course, most of the above could be achieved using the apps in my iPhone or iPad, but I need to execute those apps. In the watch, I would expect it to run automatically when you wear it.

Some of the above functionality already exists in watches or devices like Pebble, Nike FuelBand etc. But, Apple known for its innovation, could redefine a wrist watch into an fashionable and wearable device that could feed & store data in the cloud rather than a simple 6th generation iPod Nano with a strap.

Labels: , , , , ,





Wednesday, January 30, 2013

Will tablet running full blown OS replace a desktop or laptop?



Microsoft is going to release a version of Surface tablet with high end processor running a full version of Windows 8. The specification lists an Intel i5 ivy bridge processor with 4 GB memory. HP is planning to release Elite Pad  running Windows 8 with Intel atom processor & 2 GB memory. Similarly, Acer has Iconia W700 with Ivy bridge processor and ASUS has VivoTab with atom processor. All these tablets have a good sized memory to run pretty much all the common applications including Ms-Office. Are people going to spend a lot of money on a tablet which might not be a complete replacement for a computer?

Apple’s iPad runs on iOS which is a subset of Mac OS X operating system. Microsoft’s Surface tablet runs on a Windows RT which is a subset of Windows operating system. Google’s Android is built as a mobile operating system rather than a desktop operating system. All these operating systems runs apps or applications built specifically for them.

Microsoft and many hardware manufacturers are planning to merge a tablet, netbook and laptop into a single device - a tablet running Windows 8 rather than the subset Windows RT. In order to run a full blown operating system, the tablet needs to have better hardware specification than a mobile device. This naturally increases the price & weight of the device. Some of these tablets are priced equivalent to or above a decent desktop/laptop with much better hardware specifications. 

I consider the tablets & smart-phone as a mobile environment for on the go use and not a full time work device. It is definitely easier to reply to an email on a tablet rather than a smart phone. The tablets are great for personal use like general browsing, checking emails, reading books, games, videos etc. It is easier to use a tablet rather than booting a desktop or laptop. On a professional level, it is good for mobile business people using Word or Excel, doctors running medical applications or musicians to create music. It even replaces all the instruction manuals in a workplace. All the above examples require the tablet to be light weight and easily transportable with space to hold all the data. Weight is definitely a factor because it is tough to hold the tablet for a prolonged period (without resting on something) even to read a book. 

Even though the concept of running a Windows 8 on a tablet - that opens door to running every possible application - sounds appealing, will we really be doing it? How many of these applications will run without issues on a small screen optimized for touch rather than a click? Due to the small screen size & a virtual keyboard, will it be easy to use all the applications without connecting it to a bigger screen? How much space does this OS going to occupy in the small tablet hard drive? Windows built as a desktop operating system has grown in size in recent years. It easily occupies 10 to 20 GB or more of disk space. This will take away half the space in the tablet and increase the boot-up time. These factors and more will prevent me from using the full potential of Windows 8. If the manufacturers add better hardware & accessories to overcome these factors, the tablet will become heavy and will loose the mobility factor. 

From a consumer perspective, tablet will be a alternate gadget to a desktop or a laptop with specific usage in the current age. I would prefer such a gadget to be light in weight with more disk space and an operating system that is fast to boot. All these qualities have to be satisfied before I spend money to  add additional accessories to convert it to a desktop or laptop replacement.

Unless, Intel or AMD build a better low powered, less heat dissipating mobile processor that has a processing power equivalent to a desktop processor and the hardware thin enough to package a DVD drive & ports inside a tablet, it is tough to sell a tablet running Windows 8 as a replacement to a desktop or laptop.  Until then, it will only be used by some niche businesses and hobbyists. Consumers will be seeing this as a expensive fun gadget.

Now as a developer I should mention - building applications for Windows is much easier and will have less learning curve than building applications for Windows RT! 


Labels: , , , , , , , , , , , , , , , , ,