Desultory of an Architect - Christian Thilmany's Blog : Developers

Updated Team System Futures Content on codeplex.com -- Team System 2008 and Beyond

Christian J. Thilmany — Sun, 20 Jul 2008 20:16:00 GMT

Team System 2008 and Beyond (90 Minutes)

Team System 2008 provides allot quality feature improvements over 2005 and with the release of VS 2008 SP1 many more options are now available. Although Rosario is months away we also take a good look at what lies ahead and how Team System will target new roles such as the pure tester as well as the business analyst.

Through slides and demonstrations, this session will provide some of the highlights of those new features in VSTS 2008, SP1, and Rosario using SP1 Beta and CTP12 of Rosario. We will demonstrate the new Test Runner as well as the new Test Case Manager Interface. We will demonstrate historical debugging and even take a look at the facelift that Team Architect has been given.

Go to www.codeplex.com/almspecialisttoolkit for details.

Expression Studio Content to come .......

Third Party Security Code Analysis Options That Compliment VSTS 2008

Christian J. Thilmany — Sat, 12 Jul 2008 05:32:00 GMT

These would be a good compliment to the general security code analysis in Team Developer won't detect denial of service attacks and other more advanced security vunerabilities from the any GUI buffer so I've complied a list of tools that will...

http://www.coverity.com/html/prevent-for-c-c++.html
http://www.fortify.com/products/
http://www.ouncelabs.com/resources/code-analysis-faq.asp
http://www.spydynamics.com/

These tools protect applications (also discussed in Michael Howard’s book) from things like the following:

Unvalidated sources of input
Use of unvalidated input
Unvalidated output streams

Design flaws consist of insecure implementation of security mechanisms, and they include:

Flawed authorization and access control
Flawed authorization and session management
Native code and buffer overflows
Dynamic code
Weak encryption
Application configuration
Denial of service
Network communications
Unsupported application interfaces
Improper administrative and exception handling

Custom Code Analysis Rule (Updated for VS2008 Team Developer)

Christian J. Thilmany — Sat, 12 Jul 2008 04:32:00 GMT

Ok I took upon myself to update an old sample I had for VSTS 2005 so it would run in the new VSTS 2008 since some things have changed such as the required assemblies and classes that are needed to build a custom code analsys rule for Team Developer. Writing a custom code analysss rule is actually quite simple. What makes it difficult is it is undocumented. This will hopefully change in the Rosario time frame but until then hopefully this sample will get your going.

You can download the source code here: http://www.codeplex.com/almspecialisttoolkit/Release/ProjectReleases.aspx?ReleaseId=14315

This sample is a very basic rule that checks for the word "pass" as a data member of a class (ignoring) case -- if it isn't obvious already it is simply trying to see you have a data member that could be construed as a password thus it will ask that you do something about it such as encrypt it. Like I said simple!

Your job is create new class for every rule and add it to the sample project I gave you. I've already given you one called CustomSecurityRule.cs. Once you have that you need to add the rule to a self describing xml file that will be an embedded resource in the assembly that will eventually be deployed to good ole VSTS 2008.

To add a new rule you add a rule element to the Rules.xml file as so.... This should be self explanatory once you open up the rules.xml file included in the project

<?xml version="1.0" encoding="utf-8" ?>

<Rule TypeName="PossiblePasswordDisclosure" Category="Custom" CheckId="JS0001">

<Name>Possible Password Disclosure</Name>

<Description>The field '{0}' in your application may be a password field and could be vulnerable to password disclosure if the value is visible and unencrypted.</Description>

<Url></Url>

<Resolution>If the field "'{0}'" is a password field, it should be protected through encryption and obfuscation.</Resolution>

<Resolution Name="Prefix">If the field "'{0}'" is a password field, it should be protected through encryption and obfuscation.</Resolution>

<MessageLevel Certainty="95">Error</MessageLevel>

<FixCategories>NonBreaking</FixCategories>

<Email></Email>

<Owner></Owner>

</Rule>

</Rules>

Figure 1.1 Rules.xml file

Now you can create your rule in code. See the example rule classes in the project for reference. I've created a class called BaseRule that inherits from BaseIntrospectionRule that allows you to pass in a rule name either statically or through a constant. You simply have to inherit your rule class from BaseRule such as the following:

public class PossiblePasswordDisclosure : BaseRule {

public PossiblePasswordDisclosure() : base("PossiblePasswordDisclosure") { }

public override ProblemCollection Check(Member m) {

Field field = m as Field;

if (field != null) {

string name = field.Name.Name;

string uppername = name.ToUpper();

if (uppername.IndexOf("PASS") != -1 ) {

Problems.Add(new Problem(GetResolution(name)));

return Problems;

}

else {

return null;

}

return null;

}

}

Figure 1.2 Rule Class

Next, figure out what scope the new rule applies to since it can apply to several different levels (e.g. Field, Property, Parameter, Method, etc.)

For whatever levels your rule applies, override the appropriate Visit methods from the BaseIntrospectionRule class. The BaseRule class extends the BaseIntrospectionRule class, which in turn extends another class in the FxCop framework. There are over 140 Visit methods (we use the Check(Member m) method) that the base class calls during a rule check operation. What this means is that any Visit methods that are implemented in the new Rule class will be called by the rule framework. This allows you to focus on the part of the code you care about e.g. methods, or fields (such as our case), etc.

Finally, in order to trigger an error or warning to appear from a rule that has been broken, a call must be made to the BaseRule.AddProblem method.

In order to deploy the this rule, the CustomSecurityRule.dll file must be copied to the C:\Program Files\Microsoft Visual Studio 9\Team Tools\Static Analysis Tools\FxCop\Rules directory on each machine where the rules are to be run. You can even have VStudio open when you deploy the rule - you simply need to re-open the project properties to see the rule in the rules list in the code analysis section.

Happy rule writing.....

New Team System Content --> From Performance Tuning to Testing to General ALM. Announcing the ALM Specialist Toolkit!!!!!!!!!

Christian J. Thilmany — Sat, 12 Jul 2008 04:15:00 GMT

Ok way too long for my own good but I need to pick up allot of slack when it comes to sharing these days. My half year resolution (read: beginning of FY09 for us at Microsoft) begins today and blogging is the included endeavor. I've been busy with a few things I'd like to share mostly work related in the areas of ALM, Team Suite, and UX experiences (does experience get cancelled out here? :-)). Let me first begin by sharing out a content project I've been working on to help partners and customers get more familiar with Visual Studio Team Suite and Team Foundation Server. This content has been put together over the last year and varies from focusing on Team System Overviews to Profiling to Web Testing, to Code Analysis to Customizing Team Foundation Server so on and so forth. If you are interested in any of these sessions feel free to download them at your leisure.

You can download the abstract plus the sessions at: www.codeplex.com/almspecialisttoolkit

Here are just a few the abstracts for that content:

Session Title

Description

Customizing Team Foundation Server 2008 (2 Hours)

Team System provides allot of out of the box features and templates such as MSF for Agile. However, in many cases you may need to customize elements of Team Foundation Server to fit your organization and your requirements.

Through slides and demonstrations, this session will provide an introduction into the “What, How, Why, and Who” of customizing Team Foundation Server. You will learn what can be customized from Process Templates to Reports to simple configurations. You will also learn when you customize and who can help you with that work. Demos are open ended and depend on what areas of customization are important to the customer e.g. process template editor.

Session Title

Description

Improving Application Performance using Team Suite (60 Minutes)

What is Team Suite and how can it be used to improve application quality? Specifically what components in the Team Developer and Test Edition of Team System 2008 can be used to improve application performance from web applications to smart client applications?

Through slides and demonstrations, this one hour session will introduce Team Edition for Developers and Team Edition for Testers from a performance tuning perspective. We will discuss and demonstrate how to use code metrics, web testing (including web services), load testing, targeted code analysis, and profiling dashboards. We will discuss how you can use Team Suite to tune the performance of any application and how to eliminate the complexity and noise of these tools by focusing on what is important.

Session Title

Description

What’s New in Team System 2008 (90 Minutes)

With the next major version of Team System code-named “Rosario” still months away Team System 2008 provided an incremental yet significant step forward to improving Team Development. Many of the features of Team System 2005 were significantly improved and a few new features have been added.

Through slides and demonstrations, this session will introduce these new capabilities comparing what was in Team System 2005 with what is now included with 2008. We will demonstrate both new Team Foundation Server and Team Client features such as Annotations, Folder Compares, Code Metrics, Profile Hot Pathing, Improved Web Testing, Improved Load Testing, and more.

Session Title

Description

ALM Executive Value (90 Minutes)

Despite years of effort to improve, building software solutions to address business challenges continues to be exceptionally difficult and, more often than not, less than entirely successful.

This session will introduce Microsoft’s approach to helping teams overcome common development challenges, more effectively manage the application lifecycle, improve project success rates and focus on the delivery of high quality solutions that correctly address business needs.

Session Title

Description

Value-Up Software Development (60 Minutes)

What is Value-Up software development? What’s the big deal about Agile methods? How can Team System help development teams take a value-up approach to building solutions?

This one hour session will briefly introduce the concepts behind value-up software development, a way of building software that incrementally delivers business value. We will also discuss the Agile methodologies that support this concept and how this approach delivers business value to end users sooner while enabling the constant refinement of requirements necessary to building the proper solution to effectively address business needs.

Session Title

Description

Team System 2008 for Developers (60 Minutes)

What is Team Suite? What components make up the Developer Edition of Team System and how can it be used to improve development quality?

Through slides and demonstrations, this one hour session will introduce Team Edition for Developers. We will discuss and demonstrate how to use code metrics, unit testing, code analysis, and profiling. We will also demonstrate TDD with unit testing and how Team Foundation Server can be added to play a big role in improving test result reporting and build management.

Session Title

Description

Team System 2008 for Testers (60 Minutes)

What is Team System? What components make up the Team System Ecosystem? How can Team System help improve the quality of my applications through testing? What testing features are currently in this version of Team System? How can Team Foundation Server be used to manage Test Cases?

Through slides and demonstrations, this one hour session will briefly introduce Team Foundation Server (TFS) as well as focus on the Team Edition for Testers product. We will discuss and demonstrate how to create tests ranging from web tests, manual tests, generic tests, load tests, and ordered tests. We will also demonstrate unit testing and how TFS can play a big role in improving test result reporting and collaboration.

Session Title

Description

Team System 2008 for Database Professionals (60 Minutes)

What is Team System? What components make up the Team System Ecosystem? How can Team System help improve the quality of my database-based applications? What schema design, testing, comparison, and data deployment features are currently in this version of Team System? How do I include database deployment in my automated build?

Through slides and demonstrations, this one hour session will briefly introduce Team Foundation Server (TFS) as well as focus on the Team Edition for Database Professionals product. We will discuss and demonstrate how to import database schemas, work in an ALM world, learn how to leverage source control with database artifacts, create database unit tests, leverage data generation features, and much more.

Session Title

Description

Team Development With SharePoint (90 Minutes)

Are you new to Lifecycle Management (ALM) yet part of the SharePoint Development Team within your organization? Want to leverage SharePoint development best practices such as testing for performance across all SharePoint projects?

Through slides and demonstrations, this session will introduce these team best practices that can be utilized by SharePoint development teams by using Team Foundation Server and the Visual Studio Team Editions. We will explore how to leverage Team Suite to test portals, web parts and integrated applications and take a quick look at how SharePoint developers can leverage Team System as a whole.

Session Title

Description

Team System 2008 for Java Developers (60 Minutes)

Similar to the Session above “Team System – Not Just for .NET Developers” however this session dives a little deeper into the aspects of using the Teamprise Plug-in and only focuses on Java.

Through slides and demonstrations, this session will introduce these capabilities and explore what can be done with Team Foundation Server for Java Developers using Eclipse and the Teamprise 3.0 Plug-in, the Teamprise 3.0 Command Line Tools, and Teamprise 3.0 Explorer. We will specifically look at how the new version has added build support for managing Ant builds using Team Build and how customizations can be made to support most third party java tools e.g. Unit Testing and Code Coverage.

PDC Dates and Location Announced!!!

Christian J. Thilmany — Fri, 07 Dec 2007 20:10:00 GMT

Save the Date!

Announcing PDC08

October 27–30, 2008
Pre-conference October 26, 2008
Los Angeles, California

OK, OK. We are delighted to announce the date and location of the next Microsoft Professional Developers Conference (PDC): October 27–30, 2008 at the Los Angeles Convention Center. PDC is the definitive Microsoft event for software developers and architects focused on the future of the Microsoft platform. Mark your calendars and save the date. More information coming soon.

http://msdn.microsoft.com/pdc2008