Go Figure (by Keith Nicholson) : FAQ

Is the SqlDependency Attribute in OutputCache Directives Required Like VaryByParam Attribute?

Keith Nicholson — Thu, 14 Apr 2005 08:19:00 GMT

This question came up during a presentation on ASP.NET v2.0, “Is the SqlDependency Attribute in OutputCache Directives Required Like VaryByParam Attribute?“

After doing some searching through the MSDN Library for Visual Studio 2005 (Beta 1), I discovered very little documentation about using the OutputCache directive. So, what is a boy to do? Go to code!

I added the <% OutputCache %>to a page and watched what happened when I tried to preview it in a browser. As expected, the parser stated that I had to have the Duration attribute.

So I then tried <% OutputCache Duration=”1” %>. Of course the parser had trouble with this as well-- Parser Error Message: The directive is missing a 'VaryByParam' attribute.

As we walk down the path <% OutputCache Duration=”1” VaryByParam=“None“ %>. The page made it pass the Parser and rendered.

Conclusion---SqlDependency is not a required attribute.

Does the Stereotype have to be a 'T'?

Keith Nicholson — Wed, 13 Apr 2005 04:13:00 GMT

Now that .NET developers have access to Generics in both VB.NET and C#, questions are being asked about an approach often used by C++ developers called Templates. When we define a Generic class we must follow the class definition with a Stereotype (also referred to as a Parameter Type).

Such as (VB.NET):

Public Class MyStackTvb(Of T)

Private frames As T()

Private pointer As Integer = 0

Public Sub New(ByVal size As Integer)

frames = New T(size) {}

End Sub

Public Sub Push( ByVal frame As T)

frames(pointer) = frame

pointer += 1

End Sub

Public Function Pop() As T

pointer -= 1

Return frames(pointer)

End Function

End Class

or in C#:

public class MyStackTcs< T >

{

private T[] frames;

private int pointer = 0;

public MyStackTcs( int size )

{frames = new T[ size ];}

public void Push( T frame )

{frames[ pointer++ ] = frame;}

public T Pop()

{return frames[--pointer];}

}

We are not required to use the name 'T' for the template parameter. You could use 'Z' for all anyone might care. But trust me, programmers will care to follow a standard that has been in use for over a decade. Think of 'T' as 'Type' if this helps.

Until next time........

No More Old Icons

Keith Nicholson — Mon, 11 Apr 2005 23:06:00 GMT

Back on March 11, 2005, I was asked at a session on Visual Studio 2005 overview whether we might finally get some new icons (tired of the old Office 95 icons?).

Well last week, MSDN provided the answer. Go to MSDN TV for more info.

What code works best for the Stack Overrun Demo?

Keith Nicholson — Wed, 02 Mar 2005 02:09:00 GMT

In some recent classes for security from Microsoft's 2805 and 2806 courses, I demonstrated the ability to make a buffer overrun hack. The information on page 11 of the 2805 courseware does not show the appropriate text to really demonstrate the power of the hack.

The demonstration itself originates in Michael Howard's and David LeBlanc's must read book, Writing Secure Code. In their second edition they begin a wonderful example on page 129 of a stack overrun. On page 135, in order to throw the the program flow into the bar function, they use a Perl script named HackOverrun.pl to exploit the issue.

Not being a Perl scripter, I was curious how to make it work in a straight command window environment as originally demonstrated up till this page.

It occurred to me after seeing a friend type their password in with special Unicode characters how to make this work. The secret to strong password security is to take advantage of the extreme number of characters available. Try this at home! Change your password to something like BobIsReallyCool, but before pressing 'Enter' or 'Tab', hold your 'Alt' key down and type on your number keypad 0064 then release your 'Alt' key. You will see the following string, 'BobIsReallyCool@'. By typing in 0064 you referenced the Unicode character '@'. Now try the same password with a 2251 at the end. This time you get 'BobIsReallyCool-'. Of course you have '*' or bullets covering all of the characters, but you get the idea.

So what do we type in to make the StackOverrun demo sound like Charlie Brown? Type the following at the command prompt after the executable file:

ABCDEFGHIJKLMNOPE(Alt+0016)(Alt+0064)

I actually find it rather humorus that the final four letters, before the 'Alt' characters spells 'NOPE'.

If you have not picked up the book that Bill Gates referres to as “Required reading at Microsoft”, the get out to your favorite book seller and pick up “Writing Secure Code.” It's ISBN is 07-7356-1722-8.