Our patterns & practices WCF Security Guidance Project is in progress on CodePlex.  This is our first release of prescriptive guidance modules for WCF Security. 

How Tos
Our How Tos give you step by step instructions for performing key tasks:

• How To - Create and Install Temporary Certificates in WCF for Message Security During Development
• How To - Create and Install Temporary Certificates in WCF for Transport Security During Development
• How To - Impersonate the Original Caller in WCF calling from Web Application
• How To - Impersonate the Original Caller in WCF calling from Windows Forms
• How To - Use netTcpBinding with Windows Authentication and Transport Security in WCF from Windows Forms
• How To - Use SQL Role Provider with Username Authentication in WCF from Windows Forms
• How To - Use SQL Role Provider with Windows Authentication in WCF from Windows Forms
• How To - Use Username Authentication with the SQL Membership Provider and Message Security in WCF from Windows Forms
• How To - Use WsHttpBinding with Windows Authentication and Message Security in WCF from Windows Forms
• How To - Use wsHttpBinding with Windows Authentication and Transport Security in WCF calling from Windows Forms

Videos
Our videos step you visually through key guidance:

• Video: How To - Host WCF in a Windows Service
• Video: How To - Impersonate the Original Caller in WCF calling from a Windows Form
• Video: How To - Use basicHttpBinding with Client certificate in WCF from Windows Forms
• Video: How To - Use netTcpBinding with Windows Authentication and Message Security
• Video: How To - Use SQL Role Provider with Username Authentication in WCF calling from Windows Forms
• Video: How To - Use WsHttpBinding with Certificate Authentication with Message Security
• Video: How To - Use WsHttpBinding with Windows Authentication with Message Security

About WCF
Windows Communication Foundation (WCF) is a service-oriented platform for building and consuming secure, reliable, and transacted services.  It unifies the programming models for ASMX, Enterprise services and .NET Remoting.  It supports multiple protocols including named pipes, TCP, HTTP, and MSMQ.  WCF promotes loose coupling, supports interoperability, and encapsulates the latest web service standards.  With WCF, you get flexibility in choosing protocol, message encoding formats, and hosting.   For more information, see the MSDN WCF Developer Center.

About the Project
WCF provides a lot of options and flexibility.  The goal of our patterns & practices WCF Security Guidance Project is to find the key combinations of security practices for WCF that work for customers and share them more broadly.  At a high-level, you can think of the project in terms of these main buckets:

• Application Scenarios - These are whiteboard solutions for common end-to-end application scenarios.
• How Tos - These are step-by-step instructions for performing key end-to-end tasks.
• Building Codes - These are our sets of rules and practices.  This includes Guidelines, Checklists, and Practices at a Glance.
• Reference - This includes Explained, Cheat Sheets, and Q&A guidance.

The plan is to incrementally share our guidance modules on CodePlex as we go, then build a guide, then port the guidance to MSDN once it's baked.

How do you identify the bull's-eye among your stakeholders?  Nothing's worse than finishing a project and missing the mark you didn't know was there. At patterns & practices, one of our effective project practices is to use "tests for success" to help avoid this scenario.

What are Tests for Success
"Tests for success" are the prioritized success criteria that the stakeholder's agree to.  It's basically a set of test cases, that if the project passes, the project is perceived as a success.  They help clarify outcomes and priorities.

Example Tests for Success
Here's an example of "tests for success" from one of my projects:

• Single multi-dimensional information model?
• Single unified perspective of the product model?
• Single unified perspective of the content model?
• Backlog is mapped to the information model?
• Capability to do comparative analysis and produce “Consumer reports” view of the catalog and the proposed work? (e.g. What’s customer demand? ... What’s our coverage?)

Stakeholders for the project created and prioritized this list, with prompts from the project team.  This exercise helped clarify a lot of ambiguity as well as do a level set for the team.

How Can You Use This
Whether it's a personal project or a project at work, you can create your own tests for success.   I think a small list of the vital few works better than a laundry list.  Phrasing the tests as one-liner questions makes them easy to create and use.  Here's some prompts to trigger your own tests for success:

• How will the world be a different place when the project is done?
• How will we know we did a good job?
• What's the most valuable outcomes for the project?
• In order for the project to be successful, we need to .... ?

When you're in the thick of things, you'll appreciate having a small set of criteria to go back to and help keep you and everyone involved on track.

Have you ever been on a project where key stakeholders don't have skin in the game, but they have a controlling vote?  This is a bad situation.  It's like multiple backseat drivers, except they won't be there if the car crashes.  What's the solution?  You turn chickens into pigs!

The Chicken and the Pig
You may have heard the story about the chicken and the pig.  The chicken says to the pig, "We should should start a restaurant."  The pig asks, "What would we serve?"  The chicken responds, "Bacon and eggs!"  The pig says, "No thanks!"

The point in the story is the pig's "committed" while the chicken's "involved."

The Solution
Recognizing the situation is more than half the battle.  When you've identified that chickens have controlling votes over pigs, your options include:

• Avoid the situation where chickens are controlling the votes for pigs.
• Make sure the chickens don't have controlling votes and make it explicit.
• Turn the chickens into pigs.  You need to move them from involved to committed.  Have them take commitments or dependencies (skin in the game and committed to your success.)

How can you differentiate what you do?  This can be particularly difficult in problem spaces that seem over-crowded.  It helps if you have a frame.  One of my mentors gave me a useful lens for differentiating that helps solve this problem.

Problem, Approach, or Implementation
You can differentiate based on problem, approach or implementation:

• Problem - What problem do you address?
• Approach - What strategy do you use to solve the problem?
• Implementation - How do you implement your solution?

If you differentiate at the problem you solve, it's good to be able to call that out.   If you solve the same problem, but use a different approach, unless it produces a big difference in results, it's probably not worth it.  If you differ only by implementation and the experience or results aren't valued by the customer, again, it's probably not worth it.

Using the Frame for Differentiation
First identify whether you differentiate at the problem, approach, or implementation.   Next, determine whether the level at which you're differentiating is worth it.  For example, consider safety among automobile makers.  Volvo's approach to safety stands out.  They work the same problem but differentiate by approach.

By having clarity around where you differentiate, it's easier to communicate your deltas in a meaningful way to others.

Example
At Microsoft, when I tackle a problem that's been "solved" before, I use the frame as a lens to quickly find the useful differentiation.  For example, doing security reviews wasn't a new problem.  However, changing the approach by using inspections and building a set of reusable criteria from a team of experts changed the game.  By using criteria based on principles and patterns, and then organizing the criteria within a frame of actionable categories produced exponential results for all of our customers that adopted the approach.  Old problem, new approach, great results.

What is your life frame?  What are the key buckets in your life that you need to balance across?  If you have a frame, you can balance your life through thick and through thin.  If you have a life frame, you can more thoughtfully allocate your time and energy for maximum results.  More importantly, when things aren't going well, you have a tool to help you spot where you are not investing enough.

Life Frame
This is a baseline of your personal portfolio of your most important assets:

• Mind
• Body
• Emotions
• Career
• Financial
• Relationships
• Adventure

Note - if those buckets don't work for you, change them.  It's a starter set.

I've been sharing this life frame with those I coach, and some colleagues and they've found it helpful, so now I'm sharing it more broadly.  It's a great starting point when you're not getting what you want out of life.

Spread Your Energy and Time Across Your Buckets
Spread your energy and time across them.  If your current investment's not working, turn up the dial on some.  If your stuck in one area, then try turning up another.  For example, if you're not getting the results you want at work, then crank up your relationships dial.  Remember that with this portfolio, the sum is more than the parts.   It's the net effect.

What Can Happen When You Don't Use the Frame
When I first got to Microsoft years ago, I didn't have this frame.  Sure I knew about these areas of my life, but I didn't have the mental model of a portfolio.  Instead, all I knew was that I would throw all my energy and hours at my career bucket.  To put that in perspective, 80, 90, 100+ hours a week.  The problem is I consistently got rated highly and produced results.  But at what cost?  Well, if you spend 100+ hours in one bucket, guess how much energy you're spending in others?   Granted some buckets overlap, but I'm talking about when you really shine the spotlight on them.

Improve Your Approach Over Spend More Time
Time is a limited resources.  So is your energy.  Interestingly, while working on performance modeling, the light bulb went off.  If I carve out a minimum for some buckets and a maximum for others, it would be a forcing function.  What's the maximum I would throw at my career bucket?  60? 50? 40?   Timeboxing my career bucket forced me to identify the real value of all my work and to heavily prioritize.  It also forced me to find the most effective principles, patterns and practices for project management, personal productivity, running high-performance teams, ... etc.   Which is better ... more time at the problem? ... or better techniques, more value, and a sustainable pace?  

Set Boundaries (Minimums and Maximums)
The real lesson is that if you don't first set your boundaries, then you never really have a way to prioritize.  For example, if you allocate fifty hours to your career bucket weekly, now you know how much to bite off at a time.  Otherwise, you'll just work until everything's done, but there's always something more to do.  Priorities, focus, and value are your friends.

As another example, I now continuously invest in my relationships bucket.  For example, each week I have lunch with an old friend, and lunch with someone new.  At Microsoft, and in life, it's what you know and who you know.

How To Use This
To get started, just put these categories on your whiteboard or a pad of paper.  Take a look across your portfolio and figure out your current investments in time and energy.  Look at your results.  How well are you balancing?  If you're on track, great.  If not, try increasing your investment is some areas and lowering another.   The goal is to improve the quality of your life.  If you want to really put some focus in an area, try a 30 Day Improvement Sprint.

My Related Posts

• Change Frame
• Improvement Frame

I know success means a lot of things to a lot of people.  My favorite definition is "success is when the response meets the challenge."

How do you make the most of any situation?  Figure out whether you need to adapt, adjust or avoid.

Adapting to the Situation
Adapting to the situation, means changing yourself for the situation.  While flexibility is good, you need to be careful.  You can trade your less effective behaviors, but don't adapt to the situation in a way that takes away your strengths.  You'd be better off finding a situation where you can play to your strengths.  

Adjusting the Situation
Adjusting the situation, means changing the situation to suit you.  Sometimes this is the best option, particularly if you can set it up to play to your strength.  For example, when you take on a project, can you get the right people on board that compliment your ability?

Avoiding the Situation
Sometimes this is the best path.  Learn to spot the situations where you don't do well.   This is my caution.  Because I turn any situation into a learning opportunity or challenge, I need to know when it's low ROI.  Life's too short to spend energy in low ROI situations.

Self-Awareness is the Key
If you know your personal strengths and passions, this is your key to success.  You avoid adapting to situations that take away your strengths.  You learn to setup situations in a way that you succeed.  You learn the situations that you should avoid.

Additional Resources

• When It's Cold Shiver, When It's Hot Sweat
• Finding Your Strengths
• Yerkes-Dodson Human Performance Curve

How do you get the people on your side or inspire a vision or change the world?  First win the heart.  I'm blogging on this because it's a lesson I've learned that shows up in so many ways, time and again.  I see it in thought leaders.  I see it in people leaders.  I see it in everyday, conversational exchange.  This is one of those ah-ha's that when it sinks in, you find opportunities to apply it every day to improve your effectiveness.

Connecting at the Heart vs. Connecting at the Intellect
If you connect at the heart, the mind follows. Interestingly,if you connect at the intellect, you may not necessarily get the heart to follow. 

Go For the Heart
If you have great ideas, but people aren't on board, chances are you've been ignoring the heart.  Change your approach.  One way to invoke the heart is to address core values: loyalty, commitment and contribution, individual worth and dignity, and integrity.

Example
One of my former leaders is known for inspiring people.  For example, whenever I would tell him about a project, he would first ask me how I was going to change the world and who the dream team would be to make it happen? 

While he couldn't always get me the dream team, he first focused on a compelling vision and that was inspirational.  Where the heart goes, the mind follows.  In fact, in many cases I was able to get the dream team, because of the emotional commitment to make it happen.  Inspired visions trump purely intellectual ones.

Posts with Pictures
While studying effective blogging practices, I noticed a success pattern.  The pattern is to start your post with a picture.  Ironically, I fought this pattern because the engineer in me wants efficient, effective value in text.  So do a lot of engineers.  However, many don't. 

Choosing the right picture can cause your readers to have an emotional reaction to your information, and draw them into your post.  If you don't believe me, take a look at Alik's post Glue Audience To Your Presentation With ZoomIt.  Tell me that picture doesn't get you curious?  While your picture should be relevant, it should also cause your readers to feel something, and have a reaction.  An extreme anti-pattern is to use pictures to trick readers into your posts.

It Works On You
If you know this, you can inspire yourself.  Rather than smart talk yourself into something, try winning over your heart first.  How can you get leverage on yourself?  What inspires you?  Win your heart and your mind will follow. 

Additional Resources

• Framing Compelling Arguments

How do you pick the right theme for your blog?  The challenge is that it's not a linear decision and it requires satisficing to balance content,  function, and design ("look and feel").  As part of my research on effective blogging, I've been analyzing themes.  I’ve literally evaluated more than 2,000 themes and heavily modified more than 20.  I see a lot of patterns now.  I've decided to share my lessons learned, since they might save you considerable time.

Summary of Lessons Learned
Here's a summary of my key lessons learned:

• Know your purpose.  You need to know what your optimizing for.  This shapes all the rest of your decisions, so if you know this, it helps.  For me, my portfolio of blogs will be online personal knowledge bases to share my learnings.  For me, that means putting a premium on organizing, browsing, searching, and sharing posts.
• Start with a two column theme.  If you don't know where to start, start with a two-column template for your blog.  Three column templates have more moving parts and are trickier to create a clean reading experience.
• Your content drives your theme choice.  Will you use images?  How long is your content going to be?  What types of posts will you have?  Will they vary?  Test the variations because this can have a big impact in the look and feel in your theme.  Your posts are the wood behind the arrow.  While your theme is the initial impact, your posts should be very readable and scannable.  Test the readability of your posts for different scenarios (skimming, in depth, long, short ... etc.)
• Test how you'll use images.  Some of the themes I tested completely changed simply by adding images in the banner or in the posts.  The two main patterns are whether to use pictures in your banner or pictures in your posts.  The benefit of the picture per post approach is that your feed readers will get them.  If you use pictures in both your banner and your posts, it's tougher to help your users know where to focus.  Using a good picture at the front of your post, helps draw your reader in, particularly if they are scanning and sick of text.
• Test key scenarios.  This includes users reading your feed, commenting, scanning your posts, reading your posts in detail, searching your blog, and browsing your blog (using your tags and categories.)
• Choose simplicity over complexity.  You can evaluate the complexity by walking your key scenarios.  Do your eyes know where to focus when you first pull up your blog?  How tough is it to find a particular post? ... etc.
• Trust your gut.  If something doesn't feel right, it probably isn't.  You just might not be able to put your finger on it, so ask others who might know.  Sometimes intuitively recognizing a problem is more effective than trying to logic your way through it.
• If it's not working, change it.  As tough as it is to let things go, it's important to cut the deadwood or change things that don't work.  Experimenting opens new doors.  Some days after a long customization session it was really tough to drop the theme entirely, but I stayed focused on making my focus group happy.  That helped me keep going and continuously throw out what didn't work and carry forward lessons learned.
• Ask your users.   While I had built up my own internal references of what good looks like, using a personal sounding board was invaluable.  I really enjoyed the surprises the most.  They forced me to challenge my thinking and test new ideas.
• Know you can't make everybody happy.   This was really tough in the beginning.  I couldn't believe how I couldn't get any critical mass down any particular path.   What changed was I found the common denominators and patterns.  Once I chose themes that shared these patterns, then it was easier to spiral down on agreement.
• Beware if you have to modify a template too much.  If you have to modify a template too much, something might be off.   While you can dramatically reshape a template to your liking, I think the base theme is a reflection of the designer's style and expertise.  If you find that your changing a lot of the theme, at some point you might be adjusting the theme too much and working against the theme.  In some themes, it starts to become obvious whether the designer knows SEO very well or knows how to bullet-proof their layouts or is good with overall look and feel, including typography.  That's why I paid a lot of attention to live examples and user comments to see what sorts of changes people were making, and whether they were just personal style or represented real structural or significant changes.  Spotting the patterns saved me lots of time, once I knew what I was looking for.
• Leverage the Internet Explorer Development Toolbar.  The Internet Explorer Development Toolbar is your friend.  I couldn't have analyzed as many themes as I did without it.   The ability to quickly point at themes and reverse engineer them was invaluable.  For Firefox users, you can try FireBug, but I haven't tried it myself.  The key is to find a tool that helps you analyze the CSS HTMl, and JavasScript.

Vital Factors in Your Blog Theme
It's the sum of the parts that creates your overall blog theme impact.  Part of the problem that cost me so much time is I didn't know what to look for at first.  I had to go through hundreds of themes before I started to see patterns that made some themes more effective than others.  The other thing that cost me so much time is that it's a combination of factors over any one thing.  The overall look and feel is the sum of the parts.  Here's what I found to be key factors in overall look and feel:

• 2 Column vs. 3 Column Templates.  This is a good macro-level decision because it helps divide your theme choices.  While there's exceptions, my readers told me that in general they prefer two columns over three.  They said it's a cleaner reading area, easier to know where to focus and it's simple to scroll the full page and see posts/pages on the left and the navigation/ads on the right.  If you go with a three column theme then there's a few issues.  Overall, try to find a theme where the column for posts is around two-thirds of the page and the two sidebars add up to around one-third.  In general, for three columns, my users preferred a column on the left and a column on the right with posts in the middle, versus two columns on the right.      
• Color Patterns.  Colors and color combinations have a big impact on your blog's look and feel.  This includes your background, banner, text and links.  Your best judge is how you and your user's feel when they see the color combinations.  They may not to explain the reaction, but they'll feel something.  One of the guys on my team knows some science behind colors so he helped me better understand different reactions.  You can check Crayola's America's 50 Favorite Colors and Kuler helps you explore, create and share color themes. 
• Font combinations for titles, body, and sidebar.  According to my users fonts and typography matters a lot.  This includes font size, family and colors.  This ones tough and can vary a great deal.  You need to evaluate both Initial impact and readability over time.  Again, unless you're a designer, you'll need to compare your gut reaction to different examples and test with your users.  For the main post text, What I did find was that, in general, my users preferred a white or off-white background, with dark gray font (versus black) and Verdana font.  They also prefer the post titles to clearly stand out, at least in size and style (for example Trebuchet or Ariel.)
• Post readability.  Width is a big factor.  My users told me that when the post column is too wide, scanning is more difficult, and that when it's too narrow, they have to scroll too much.  Overall, they expect the post column to be two-thirds of the template width.  Once the width is right, then the next issue is the          
• Effective sidebar design.   It seems like the features my user's cared about the most on the sidebars were: subscribe to RSS, search, categories, tags, recent posts and recent comments.   There was a definite preference for search and subscribe to RSS to be at the top.   
• User experience patterns for searching/browsing.    If you have a large collection of posts this is particularly important, and pretty easy to test.  If you know your posts, you should first test how quickly you can browse and search for specific posts.  Then test the theme with your users.  They won't have the same inside information you do, so this could be very revealing how well the patterns are working.   I think the biggest factor here is using a "Read More" feature and showing just the first part of your posts when browsing categories or in search results.  The longer your posts are, the more important this becomes.
• Effective use of images.  Choosing images for banners and posts made a dramatic difference in how my focus group responded to some themes.       
• Effective banner design.  This can make or break the initial impact of your theme. 
• Comment support.  Some themes host user comments better than others.  It really helps when you find a live example with many comments.  That way you can see how well it scales while maintaining readability. 
• Effective use of whitespace.   My users pretty consistently commented on how effective whitespace really made some themes seem cleaner than others.  I think the biggest factor here was spacing between blog sections and elements.
• Links.  My users told me they prefer links that are easy to spot versus get lost in the text, but that don't steal the show.  They also told me they prefer underlined links in posts, but don't underline in the sidebar (for example, categories, tag cloud, recent posts, ... etc.)
• Search Engine Optimization (SEO).   I did notice that some themes seem optimized for SEO more than others.  While my user's didn't notice this, search engines will.  I think the main thing to pay attention across templates is how they use the title, description and header tags.  You can tailor how your results will show up in search results.  For categories, you should use permanent links.  This improves your URLs for the search engine using more meaningful words.  You should put your posts in only one category to avoid duplicate content from the search engine view.  You should also only show parts of each post when browsing categories, to also avoid duplicate content (as well as make it easier for a human to quickly scan all your posts in a category.)  See The Blogger's Guide to Search Engine Optimization - by Aaron & Giovanna Wall and Search Engine Optimization for Blogs - SEO.

Key Blog Features
Here's a quick list of the features that my focus group seemed to care about the most:

• Title  and purpose.   The test is - do your user's quickly know which category in their RSS reader to put your blog in?
• About page.  Your about page can quickly help clarify the promise of your blog and setting expectations.  See Skellie on How to Write the Perfect ‘About’ Page (by Numbers).
• Categories.   Categories help your user's browse your catalog of posts in terms of key themes, as well as help clarify what your blog is really about.  It's another visual cue.
• Search your blog.  Even if you don't have a bunch of posts, users tend to rely on search.  Once you have a bunch of posts, your search is vital.  It's like a chicken and egg scenario though.  If your search is tough to find, user's wont use it much.  If it's easy to find and convenient, they'll use it more.  Because there's so many ways to customize your search feature, the most important thing is to make it obvious that it is a search feature (and not a subscription form) and that it is scoped to your blog.
• Tag Cloud.  Tag clouds are  nice way to provide a topical browsing experience for your blog.  There's two types -- internal and external.  Internal tags (Wordpress 2.3 has built in support) help you slice up your body of posts in a more fine-grained way.  External tags, such as Technorati tags, help showcase your posts in those social circles.  For more information, see my post, Tags vs. Categories.
• Recent Comments and Recent Posts.  Using Recent Posts and Recent Comments is an effective way to improve your user's experience and help user's discover your other posts, as well as show signs of life.
• Browse your posts.  Your user's will browse your posts either by categories, tag clouds, searches, or related posts.  Another entry point is Recent Comments and Recent Posts.  Another approach is to create pages that organize your posts in alternate ways.
• Subscribe by RSS.  If a user likes your blog, it should be easy for them to subscribe.  Most blog themes I experimented with either exposed RSS in the right place, or it was easy to add.
• Subscribe by email.   None of the templates that I experimented with exposed this by default, so it can be easy to forget about.  Some of my users pointed this out, so I tested adding subscribe by email.  
• Comments.  One thing that my user's pointed out to me was how they like when they can scan posts and quickly see the comment information beneath the post titles, rather than at the end of the posts.  A few users pointed this out so this seems to be a common preference.  I noticed some themes did a better job than others of showcasing the comments for each post.  The key decisions are whether to show links above the post or at the end of the post, along with what font and color.  Once you're actually looking at the comments, the quick scan test will tell you how readable the comments are.  Actually add some comments yourself so you can find any surprises.

How I Did My Research
My research was pretty basic, but time consuming and challenging, particularly because there's a lot of variables and not much prescriptive guidance that I found actionable.   Here's what I did:

• Searched for patterns.   I could recognize when a template looked and felt good, but I couldn't reliably figure out why.  To fix this, I filled my head with as many patterns as I could by evaluating hundreds of blogs, then evaluating thousands of templates and then by spiraling down around the vital few variables (once I figured out what they were.)
• Set up multiple test beds.  I setup multiple test sites for testing with users.  Each test bed was a full blown blog with theme, so that I could do fast comparisons between theme A and theme B. 
• Tested with Wordpress.  I've done testing before with Community Server and Blogger, so this time I focused on Wordpress.
• Evaluated free templates.  I explored multiple, free template galleries to build a foundation for recognizing effective blog theme patterns.  I tried to find templates that were actively used, so I could see live implementations.
• Evaluated templates you buy.   I ended up buying various blog theme packages so I could explore them too, to see if I could find any clear quality differentiations.
• Modeled from effective blogs and bloggers.  I evaluated the top 100 bogs in Technorati.  I also explored lots of blog examples that my friends sent during my research.
• Created a focus group.   I selected a subset of my users that were able to provide multiple rounds of in-depth feedback.  This helped tons and I can't thank them enough!
• Used the Internet Explorer Development Toolbar.   The toolbar helped me quickly analyze various blog themes on live sites and then tweak my own. See Alik on using the IE Development Toolbar.

Key Galleries I Explored
I explored several galleries, but here's a few of the key ones:

• Free Wordpress Themes
• Wordpress Theme Viewer
• Daily Blog Tips - Wordpress Themes

Key Themes I Tested
While I tested a lot of themes, her's a few key ones that stood out:

• Deep Blue.  Here's a live demo of Deep Blue.  I found it very clean and functional.  Some of my users liked it too for the same reasons, but I didn't get critical mass with it.
• Easy Wordpress.   Who is Jon Ray is a good live example.  I like the theme and I like what Jon's done.  I think the theme really optimizes both browsing and reading content, and pictures work really well.  Even though it's a three column template, it's well organized.  The majority of my focus group preferred this theme.  One user thought the post column is too wide, but they read using a feed reader, so it's not a show stopper.  The majority of my focus group really liked the width and balance of the theme across the columns, and it would scale over time.
• Grid Focus.  Write To Done, Skelliewag.org, Anywired, and Six Revisions are really good live examples.  I was very partial to this theme, particularly because it has a similar look and feel to my Guidance Share Wiki (particularly after I added baby blue bullets instead of the default dark bullets.)  However, my users told me to choose otherwise. This surprised me.  I imagined I was going to be using Grid Focus.  I still think it's a great theme, but my user feedback says it's not the right one at this time for me.   
• Neoclassical.  Open Education and Schaefer's Blog. This theme had universal appeal across my users particularly at first glance.  In fact, for a while, I thought this would be my theme of choice.  However, after more analysis, user's eventually told me the post column was too narrow, the typography was tough for extended use, and that browsability across a large body of posts might not be as effective as they would like.  The key thing I learned from Neoclassical was that images are important.
• MistyLook with Two Sidebars. Cheap DJ Systems and Gluten Free Cooking School are live examples of the two sidebar version, and here's a live demo of MistyLook with one sidebar.   This theme is very clean and very easy to customize.  I really like the pattern of a prominent image in the banner with clean, readable posts.  The sidebars are compact too which really helps for navigation.  While most of my focus group liked the theme, they didn't like it enough to make it the final choice.   One of my focus group members really liked this particular theme, enough that it made it tough during final eliminations.
• My April Reloaded.  Me, Myself, and I and Market Associates.com are good live examples.  This theme really is spectacular.  Posts are incredibly readable and scannable.  Depending on how you structure the layout, you can make it very, very clean.  There's plenty of room in the third column to fit full post titles without scrunching.  My focus group really liked this theme, but ultimately prioritized Easy Wordpress.
• StudioPress and GreenTech.  I found these themes very clean and functional.  However, I didn't get enough critical mass to spend a lot of time investing in them.

How I'll Use This 
This has definitely shaped my perspective on blog themes.   It's night and day from when I first evaluated themes.  Knowing what to look for helps me test and experiment faster.  I now have a more systematic way of figuring out why some blog themes work and why some don't.  I'll be helping some colleagues with their blog themes and I'll be using what I learned as I launch new blogs.

Additional Resources

• Two Column or Three Column WordPress Theme? Which One is Best for You?
• Crayola - America's 50 Favorite Color Themes
• Kuler - Explore, Create, and Share Color Themes
• Wikipedia - Form follows function
• 48 Unique Ways to Use Wordpress
• The Blogger's Guide to Search Engine Optimization - by Aaron & Giovanna Wall
• Search Engine Optimization for Blogs - SEO

My Related Posts

• Tags vs. Categories
• Top 100 Posts in Technorati

What's the difference between tags vs. categories in your blog?  A lot.  Knowing the difference between tags and categories can help you better structure your blog for browsing and SEO.  Personally, I hadn't noticed the issue before because I only have tags on my MSDN blog.  As part of my research on effective blogging practices, I hit the issue.  Now that I've experimented with a few blogging platforms, the difference between tags and categories is more obvious.  For example, WordPress 2.3 supports tags in addition to categories.

Categories, Internal Tags and External Tags

• Categories. Categories are your high-level buckets.  You should be able to chunk up your blog by a small, mutually exclusive set of categories.  Imagine a user trying to browse the broad themes of your blog.  Categories can also become part of your URL.
• Internal tags.  Internal tags are for finer-grained slicing and dicing and hopping across your categories.
• External tags.  External tags, such as Technorati and del.icio.us are for showing your conent in the relevant topics and niches at Technorati and del.icio.us.

Tag Clouds
I think the big benefit of tags is creating browsable tag clouds where you can discover related content.  Whereas categories are just one topic, you can use tags to find related content.  For example, you might browse a "security" tag and then browse a "performance" tag to find the intersection of content tagged both "security" and "performance".

Notes from Lorell
In Categories versus Tags - What’s the Difference and Which One?, Lorelle makes the following points:

• "Categories help visitors find related information on your site. Tags help visitors find related information on your site and on other sites."
• "Categories generate a page of posts on your site. Tags can, too, but often generate a page of off-site posts on an off-site website".
• "Tagging gives you topical search capabilities for your site that are a middle ground between categories and all-out search, but it shouldn’t replace categories entirely."
• "Should tags replace categories? Absolutely not."
• "I use categories as broad groups of posts and tags as micro-groups of posts, helping narrow down the interest."
• "Tags shouldn’t replace categories, but they can help the user and search engines and directories find and catalog related information on your site."

Notes from Problogger
In Using Categories and Tags Effectively on Your Blog, Michael Martin makes the following points:

• "The number of categories should be small."
• "Each post goes into one category."
• "Use the same tags over and over again."
• "The tag cloud is easy to scan."

The End in Mind
In the ideal scenario, to use tags and categories more effectively (assuming your blogging platform supports it), you would have the following in place:

• A small set of categories for browsing the key themes of your site and for helping SEO (by having relevant category names in the full URL.)
• A nice tag cloud that helps users browser your site more like a topical search -- using words that your users would know and be looking for.
• Posts tagged with Technorati and del.icio.us tags that match the most relevant niches.

Turning It Into Action

• Use categories to divide your blog into a small set of mutually exclusive buckets.
• Use internal tags for slicing your content in more granular ways and to create tag clouds for your users.
• Tag your posts with external tags for Technorati and del.icio.us to reach the relevant social circles.

Additional Resources

• How Tags are Implemented in Wordpress 2.3
• Lorelle: Categories versus Tags - What’s the Difference and Which One?
• Organizing Information: Using Tags versus Categories
• Problogger: Using Categories and Tags Effectively on Your Blog
• Problogger: Tagging vs. Categories

My Related Posts

• Top 100 Blogs in Technorati

What's the full patterns & practices catalog?  I created a quick index of the patterns & practices catalog since I've needed to hunt down a few things.  I figured this might be useful to share.

Views

• Browse the Complete Catalog
• Browse by Guidance Type
• Security Engineering Index
• Security Guidance for Applications Index
• Security Guidance for .NET Framework 2.0

Blocks

• Caching Application Block
• Cryptography Application Block
• Data Access Application Block
• Exception Handling Application Block
• Logging Application Block
• Policy Injection Application Block
• Security Application Block
• Smart Client - Composite Application UI Block
• Validation Application Block

Enterprise Library

• Enterprise Library

Factories

• Mobile Client Software Factory
• Smart Client Software Factory
• Web Client Software Factory
• Web Service Software Factory: Modeling Edition

Guides

• Application Architecture for .NET: Designing Applications and Services
• Application Interoperability: Microsoft .NET and J2EE
• Authentication in ASP.NET: .NET Security Guidance
• Building Secure ASP.NET Applications: Authentication, Authorization, and Secure Communication
• Caching Architecture Guide for .NET Framework Applications
• Data Access Architecture Guide
• Deploying .NET Framework-based Applications
• Describing the Enterprise Architectural Space
• Design and Implementation Guidelines for Web Clients
• Designing Application-Managed Authorization
• Designing Data Tier Components and Passing Data Through Tiers
• Exception Management Architecture Guide
• Guidelines for Application Integration
• Improving .NET Application Performance and Scalability
• Improving Web Application Security: Threats and Countermeasures
• Microsoft ESB Guidance for BizTalk Server 2006 R2
• Performance Testing Guidance for Web Applications
• Security Engineering Explained
• Smart Client Architecture and Design Guide
• Team Development with Visual Studio .NET and Visual SourceSafe
• Team Development with Visual Studio Team Foundation Server
• Testing .NET Application Blocks - Version 1.0
• Threat Modeling Web Applications

Patterns

• Data Patterns
• Enterprise Solution Patterns Using Microsoft .NET
• Integration Patterns
• Web Service Security Guidance

Tools

• Guidance Automation Toolkit (GAT) and Guidance Automation Extensions (GAX)
• Guidance Explorer