Five tools for helping counter security threats: Threat Modelling Tool . This is a documentation tool to help explore threat models within a product. At present it is internal only - it was used for the SQL Server security push. It will be available...

The SQL Server security lead developer demonstrated a black hat tool circulating on the Internet that utilises a SQL injection vulnerability to expose access to the full underlying database server, allowing query of any other table on that system...

Managed code is safer code! The following function is a C# analogue of a previous fragment: private void CopyStuff(string data) { char[] buffer = new char[128]; data.CopyTo(0, buffer, 0, data.Length); // do other stuff } If the output buffer...

Error #1: Copying untrusted data Take a line of code such as the following: while (*c != '\\') *p++ = *c++; What's the problem here? The copy process is limited by the source data, not the destinatioin buffer size. Copying untrusted data...

The moment you plug a live Internet network connection into your computer, you become part of the seediest neighbourhood in the planet. Your neighbours include thieves, con-artists, vandals, criminals and hackers. No wonder our computers are exposed...

Most of the security vulnerabilities that have been found in Windows over the last couple of years have not related to security features. For that reason, it's important that every developer understands how to build secure code. Yet it's not something...

There were plenty more thought provoking sessions today at the PDC. I've uploaded slightly fewer session notes than on previous days; I attended one really poor session that wasn't worth taking notes for, and one session that was entirely spent in code...

Reader warning: this session was deep! I take no responsibility for any subtle inaccuracies I've introduced. I've missed out some of the most complex stuff to minimise the risk of error... Generics Generics are not a new concept; they have been...

WinFS is a marriage with NTFS! It's a file system that co-exists with and leverages the best of NTFS. There are areas where NTFS will not scale well in the future, not because as a file system it is inadequate but because the new requirements people...

Microsoft Research has over 700 employees located across five locations worldwide. Rick Rashid demonstrated some of the innovations covering presentation, storage and communication - three of the Longhorn pillars. Presentation Microsoft presented...

One of the most significant things I heard today was a throwaway comment made by Scott Guthrie in his excellent ASP.NET 2.0 session this afternoon. It had nothing much to do with the session itself and perhaps isn't even implemented yet as a feature...

Benjamin just caused me to laugh out loud in the middle of a PDC session, to the consternation of those around me. My wife has tried to work on my dress sense before without success. I finally succumbed and bought a new pair of shoes after I got...

Whidbey is a major release for the ASP.NET architecture. The goals include reducing the quantity of code you need to write by two-thirds. The aim is also to enable rich scenarios that are not easily possible today, such as role management. ASP.NET Whidbey...

Generics Generics are strongly-typed template mechanism. They enable you to create classes such as collections without requiring boxing. Generics offer type checking, no boxing and no downcasts, as well as reducing code bloat. Generics are instantiated...

We are filling our disks with digital data - photos, documents, slide decks. WinFS makes it easier to find information through rich searches, relate it to other information (e.g. a document to a contact), and act upon it. In Longhorn, all end-user data...

By default, when you install Indigo on a box, existing .NET Remoting / Enterprise Services / ASMX code runs unchanged. Depending on which technology, there is a small to medium quantity of work necessary to get this to use the Indigo stack. The...

Visual Studio "Whidbey" is a 2.0 release. Some of the new features include: generics, iterators, partial types, operator overloading, C++ templates, code refactoring and expansions, XML documentation in VB, edit and continue, data tips and data visualiser...

Wow! What a first day! Given the amount of hype prior to the PDC, it was almost inevitable that the conference itself would be something of a disappointment. Yet nobody I spoke to last night expressed anything but enthusiasm for the platform vision...

No software is an island. Every piece of code, dating right back to K&R's "Hello, world!" C program relies on another program (in the K&R case, the standard I/O library). Over the last thirty years we've moved through the genesis of the "object...

When you install the Longhorn Developer Preview SDK, it adds a number of new project templates to the VB and C# IDE: application custom control document project hosted application navigation application screen saver...

Avalon is a separate graphics stack that runs parallel to the existing subsystem all the way up from GDI+. It can be accessed at any level using .NET managed interfaces. Gone are the days of sealed WinForms classes that wrap Win32 controls - this is...

The Longhorn Pillars Four pillars of Longhorn from a developer perspective: Avalon : new display subsystem (composition) Indigo : communication and web services WinFS : structured, schema-based storage Fundamentals : getting...

The PDC has started! I don't know how other bloggers will be covering it, but for the next few days, my blog entries will pretty much be the raw notes I take in each session during the day, followed by an evening summary entry that contains brief thoughts...

It was a fairly uneventful flight over to LA last night - except for the wildfires which made it feel like we were flying into an active volcano as we came down to land. Bumped into Jon Honeyball whilst waiting for baggage and got chatting about...

I see that the C# Language Specification 2.0 is now available online in draft form. Full details of generics, anonymous types, partial types etc. are included. The nice thing about this document is that it only includes the changes; at 44...