Should the team upgrade to the latest version?

I manage a couple of teams of .NET developers. Like everyone else we are under pressure and deadlines to push out the next feature and keep our products moving forward, feature rich and profitable. Nothing new here.

The usual arguments put forward to justify an upgrade to the latest version of a framework or tool are one or more of the following:

• It has new features.
• It fixes bugs
• It runs faster

They are acceptable and reasonable reasons but in my opinion not the most important.
The most important reasons for me to keep us on the latest releases are for developer engagement, retention and recruitment.
As a developer I hate to hear about features that are available but I cannot use because I'm not on the latest release and I know that most other developers feel the same way. The latest feature or paradigm in the current RTM version of your framework might not be the best solution for your project but we don't want it to be excluded because we don't have access to it. We want to be able to actively exclude it because it's not right for us.
When recruiting new members onto your team it makes it easier to be able to say "we use .NET [latest version] with ASP.NET MVC [latest version] and jQuery [latest version]." There are obviously other factors involved but this (1) eliminates the fear that the tools might not be current and (2) keeps you open to almost all developers out there. i.e. those that don't want to regress to earlier versions of a framework. We might not be using any features that have been introduced in the latest versions (we are) but at least that option is open to us.
For engagement and retention it's important for the same reasons. Everyone's happy because we all have access to the latest.
I believe that early upgrade is important to reduce the pain and is ultimately more efficient. If the team is used to upgrading the frameworks and/or tools frequently then it will be familiar, less painful and easier to plan for. For example, we try and upgrade to the latest version of jQuery once a quarter. We do this because our QA team likes to do a full multi-browser regression once a quarter and an upgrade to a new version of jQuery requires this type of regression.
I rarely attempt an immediate upgrade when a new version is released. I like to let it bake for 4 to 12 weeks and read some of the upgrade comments and let the owners address any of the issues the early adopters have encountered. By then there are a few good instructional blogs out there on how to deal with unusual errors and edge case upgrades.
I usually isolate the upgrade to be done by one developer, have him or her extensively document the experience and put a hard time limit on the upgrade attempt. If possible we push the upgrade out as its own release and don't combine it with features and bug fixes.

SQL Injection Attack from 82.45.20.100

While perusing the application logs this morning I noticed a number of SQL Injection attempts. The site that was being attacked uses MVC with automatic Form values to object binding so the exceptions were being thrown early on in the controller when the framework was trying to bind the attack string to, for example, a boolean.

Here are some of the attack strings the system logged:

 

%20AND%201=1
%20AND%201=2
' AND '1'='1
' AND '1'='2
' AND 1=1/*
' AND 1=2/*
AND 1=1/*
AND 1=2/*

The source of the attack:

IP: 82.45.20.100
City: Bristol
State: England
Country: United Kingdom
ISP: Virgin Media Limited.

The attack bot wandered around the site and tried many different entry points as you'd expect. Some of the attack points on the site identified it as an attack through the pattern being requested and stopped processing .An initial inspection of the database shows no damage.

One of the tricky things about logging SQL Injection attacks is that if you're logging them to a database then your logging process might facilitate the attack when the initial attack failed. I have 2 suggestions for this this:

1. Ensure that any code you use to insert or update to the DB is appropriately parameterized and injection proof.

2. Become a SQL Injection expert and try and break your fortress with injection attempts.

I'm a little bit surprised that SQL Injection attempts are still going on. I would have thought that any site worth taking over would have dealt with this by now. It's been over a decade since this became a well known security problem.

 

 

The Servant Leadership Training Course

I've just finished The Servant Leadership Training Course on CD.

There isn't anything new in this book and if you've read and understood the other popular books in this area then this will just be a repeat.

However, having this information repeated to you on a regular basis is very useful. And having it repeated from a different point of view is even more useful. For that reason I enjoyed it. The first quarter of the book was a bit redundant but the rest was good.

I didn't care much for the author's condescending tone and attitude but if you look past that you'll see that the material he's presenting is of value.

 

 

 

Install an HttpModule in IIS 7.5 on Server 2008 R2

Mostly for my own notes for when I next need to do this again. Assumes that the HttpModule has already been compiled and that you have the DLL.

Copy the DLL to the server and put in any folder.

Install the module into the GAC

1. Right click on a command window and select "Run as administrator"
2. At the command prompt type "explorer c:\windows\assembly" without the quotes.
3. Find the folder that you copied the DLL to and while holding down the control key right click this folder and select "Open in a new window".
4. Drag the HttpModule DLL from the new window and drop it into the c:\windows\assembly window.
5. The HttpModule is now installed in the GAC.

Add the module to IIS 7.5

(This assumes a .NET 2.0 module (there's a good reason why it's .NET 2.0 and not 4))

1. Open IIS and navigate to root. This is usually the machine name and adding the module here will ensure that it operates on all websites.
2. In the Features View find the IIS section and double click on Modules.
3. Click "Add Managed Module"
4. In the Name field put any name you want.
5. In the Type dropdown you should find the module that you added to the GAC above. Select this.
6. Leave the "Invoke only for requests to ASP.NET applications or managed handlers" unchecked.
7. Click OK and you're done.

This HttpModule will now execute against every request on all web sites.

Kintiskton LLC IP Ranges

There's a company called Kintiskton LLC who either own or are owned by Mark Manager and they provide a trademark protection service. They have a spider that crawls the web attempting to identify their customers' copyright material posted on sites other than their customers'. In principal I don't have a problem with this because I agree that copyright should be respected.

There's a good write-up about them here: http://endellion.me.uk/info/Kintiskton.html

The problem is that their spider aggressively spiders sites without respecting the robots.txt file. It hits the site hard and fast and ignores the crawl-delay directive and exclude directives. Ignoring the excludes directive is understandable (but not tolerable) as rouge web sites that are violating copyright could "hide" their content from respectful spiders by adding an exclude directive in the robots.txt file for that part of the site. This spider, however, also ignores the crawl-delay and is also not very well written as it generates a fair number of errors in the log files making it easy to see.

If you want to exclude this spider from your site you can exclude these IP ranges: 

65.208.151.112 - 65.208.151.119
63.110.158.48 - 63.110.158.55
65.200.47.0 - 65.200.47.7
65.208.189.24 - 65.208.189.31
65.208.185.96 - 65.208.185.103
65.211.195.16 - 65.211.195.23
5.208.151.112 - 5.208.151.119 (probably a mistake - see Zap's comment below)

If you discover another range that they are using please post as a reply to this blog post and I'll add it to the above list.

 

Google Maps slows down on Saturday mornings

I use Google Maps a lot to investigate a place I'm going to or to get direction there. I've noticed that on Saturday mornings Google Maps often fails but when it doesn't it just runs real slow and I get this message:

Still loading... Slow? Use the troubleshooting guide or basic HTML.

My theory is that everyone is using Google Maps to find directions before or while going out on a Saturday and this is overloading their maps servers. When are you most likely going to need directions? When you go somewhere you haven't been to in a while or ever. That's not going to happen during the week when you're going to and from work, that's going to happen on the weekend when you have the time to adventure off the beaten path. So my guess is that the requests to the mapping service peaks over the weekend.

AdWords AdSense Arbitrage

 I've heard about people doing AdWords/AdSense Arbitrage but I question if it's even possible.

First of all, what is arbitrage? The classic definition of arbitrage has someone, usually a trader in the stock markets, buy and sell a financial instrument at exactly the same time such that there is zero risk and an instant profit. Essentially you are the middle-man who has a buyer and seller lined up and you pass the item being sold from one to the other and pull in the difference.

With AdWords/AdSense arbitrage it's a little different because it is by no means risk free and it does not take place at the same time. The idea is that you buy traffic using AdWords and then you sell it on to another site using AdSense and the rate that you buy it at is lower than the rate that you sell it at.

Let's look at the math involved.

Google keeps 32% of the revenue earned from a click on an advert on your site (assumes AdSense-for-Content). So if you pay $1 through AdWords to bring a visitor to your site you need to earn $1.47 from AdSense from that visitor in order to break-even. So far this is not impossible but there's a lot of competition out there and you have to assume that your visitors are looking for the same type of item so advertising rates should be similar. It also assumes that 100% of visitors arriving through your AdWords campaigns click on an AdSense advert.

Now let's imagine that only 10% of your visitors that arrive from your AdWords campaigns click on one of your AdSense adverts. At our example rate of $1/visitor you have spent $10 to get someone to click on your AdSense advert and you need to make sure that you earn $14.71 from that click to break-even. That's a huge jump from a $1 Adwords campaign to an AdSense advert.

This table shows you how much you have to earn per AdSense click in order to break-even based on the click-through-rate based on $1/AdWords click:

CTR	AdSense
1	147.06
5	29.41
10	14.71
20	7.35
50	2.94
75	1.96
100	1.47

This is why I think that AdWords/AdSense Arbitrage is almost impossible.