net developer's journal sneak peek - sys-con.com's archive of ...

.NET DEVELOPER’S JOURNAL SNEAK PEEKTMdotnetdevelopersjournal.comPreview Issue • October2002FROM THE EDITORWelcome to a Truly IndependentVoice in the World of .NETby Derek Ferguson pg. 5BOOK REVIEWSSams Teach Yourself ASP.NETin 21 Days, Second EditionVisual Basic .NET and the .NETPlatform: An Advanced Guidereviewed by Derek Ferguson pg. 26PREMIERINGIN JANUARY 2003SUBSCRIBENOWdotnetdevelopersjournal.com.NETDJ Interview: The Present and Future Derek Fergusonof .NET An interview with Microsoft’s David Treadwell 6.NET Security: Tamper-Proofing Your Assembly Kevin HoffmanUsing Code Access Security to foil unauthorized users 10Feature: All Data, All the Time...Bob BeaucheminAn introduction to .NET data access and SQLXML Web services 16COMING IN THE PREMIER ISSUE:VS.NET: Customizing the PictureBox ControlPreserving the aspect ratio of an imageMigration: Avoid Common Pitfalls That Foil.NET Migration The process is rarely without incidentSecurity First: Internet Information Server 6IIS 6 can help developers get a better night’s sleepMigration: Migrate Your COM Applicationsto .NET Harness .NET’s interoperability featuresErik BrownMatthew MacDonaldKent TegelsBrian Noyes

infragisticswww.infragistics.com2Preview Issue • dotnetdevelopersjournal.com

infragisticswww.infragistics.comdotnetdevelopersjournal.com • Preview Issue3

EditorialEDITORIALEditor-in-ChiefDerek Ferguson derek@sys-con.comEditorial BoardGary Cornell gary@thecornells.comPeter Drayton peter@razorsoft.comKeith Franklin ka_franklin@empowered.comDean Guida deang@infragistics.comEditorial DirectorJeremy Geelan jeremy@sys-con.comExecutive EditorGail Schultz gail@sys-con.comManaging EditorJean Cassidy jean@sys-con.comEditorsM’lou Pinkham mpinkham@sys-con.comNancy Valentine nancy@sys-con.comAssociate EditorsJamie Matusow jamie@sys-con.comCheryl Van Sise cheryl@sys-con.comAssistant EditorJennifer Stilley jennifer@sys-con.comOnline EditorLin Goetz lin@sys-con.comWRITERS IN THIS ISSUEBob Beauchemin, Derek Ferguson, Christian Forsberg,Kevin Hoffman, Andreas SjöströmSUBSCRIPTIONSFor Subscriptions And Requests For Bulk Orders,Please Send Your Letters To Subscription DepartmentSubscription Hotline: subscribe@sys-con.comCover Price: $6.99/issueDomestic: $69.99/yr. (12 Issues)Canada/Mexico: $99.99/yr. Overseas: $129.99/yr.(U.S. Banks Or Money Orders). Back Issues: $12/ea.,plus shipping and handling.EDITORIAL OFFICESSYS-CON Media 135 Chestnut Ridge Rd.,Montvale, NJ 07645Telephone: 201 802-3000 Fax: 201 782-9600.Net Developer’s Journal (ISSN#1541-2849) IsPublished Monthly(12 Times A Year) For $69.99 BySYS-CON Publications, Inc.,135 Chestnut Ridge Road, Montvale, NJ 07645.Periodicals Postage Rates Are Paid AtMontvale, NJ 07645 And Additional Mailing Offices.Postmaster: Send Address Changes To:.NET Developer’s Journal,SYS-CON Publications, Inc.,135 Chestnut Ridge RoadMontvale, NJ 07645.Copyright © 2002 By SYS-CON Publications, Inc.All Rights Reserved.No Part Of This Publication May Be Reproduced OrTransmitted In Any Form Or By Any Means, Electronic OrMechanical, Including Photocopy Or Any InformationStorage And Retrieval System, Without Written Permission.For Promotional Reprints, Contact Reprint CoordinatorCarrie Gebert, Carrieg@sys-con.com.All brand and product names used on these pages aretrade names, service marks, or trademarks of theirrespective companies. SYS-CON Publications, Inc., is notaffiliated with the companies or products covered in .NETDeveloper’s Journal.SYS-CON Publications, Inc., Reserves The Right To Revise,Republish And Authorize Its Readers ToUse The Articles Submitted ForPublication.dotnetdevelopersjournal.com • Preview IssueWelcome to a Truly IndependentVoice in the World of .NETwelcome to the first issue ofSYS-CON Media’s new.NET Developers Journal.We’ve started this magazinebecause we’re excited about .NET.We’re excited about Visual Studio.NET’s ability to bring the power ofdrag-and-drop, GUI-based developmentto even the most complicatedkinds of development. We’re excitedabout the .NET Framework’s potentialfor radically decreasing theamount of custom code developersmust write. Finally, perhaps most ofall, we’re excited about .NET’s potentialto become the industry’s platformof choice for XML Web servicesdevelopment – not just on Windows,but on all manner of devices andoperating systems.As editor-in-chief, I want to maketwo promises to you regarding ourcontent.The first is that we’ll always be atruly independent voice on .NET technologies.We’ll give you the whole story:the good, the bad, and the ugly…regardlessof the players involved. Mysecond promise is that we’ll alwaysserve up technically in-depth content.Developers don’t need another publicationthat’s long on opinions and shorton code. We aim to bring you the indepthinformation you need to succeedas a .NET developer.Meet the TeamTo help us deliver on thesepromises, we’ve rounded up some ofthe best people in the industry forour editorial advisory board and to beour regular columnists. Industry leaderssuch as Gary Cornell from Apress,Peter Drayton from DevelopMentor,Dean Guida from Infragistics, andKeith Franklin from EmpoweredSoftware Solutions have alreadyjoined our editorial board.Meanwhile, for columnists, we’vealready gathered together suchrespected names as ChristianForsberg and Bob Beauchemin – withmore of similar caliber soon to follow!Love at First SightAs for myself, I had the honor to beone of the first to see a sneak previewof .NET nearly three years ago atMicrosoft’s corporate headquarters –before they’d even decided to call it.NET. But even then, with flaky technicalpreview code, it was love at firstsight! Even then it was easy to see howthe tools that now make up the .NETplatform were going to vastly improvedevelopers’ lives – particularly those ofus who were wrestling with the difficultiesof COM programming on aday-to-day basis.When I’m not editing this journal,I work as CTE for Expand BeyondCorporation, makers of wirelessenterprise management softwareproducts such as PocketDBA andPocketAdmin. For this reason, I havea particularly keen interest in themobile aspects of .NET technology.Last year, I even wrote a book forApress called Mobile .NET.Getting AroundWhether you’re doing mobilecomputing or more traditional desktopand Web-based development,you’re sure to find plenty of interestin every new issue of .NETDeveloper’s Journal. To this end,we’ve divided it into four main sections:“Home” is where you’ll find bookreviews, news items, and editorials. In“Desktop,” GDI+, Visual Studio .NETtips and tricks, and general languagediscussions are just some of the manytopics. In our “Server” section, technologiessuch as ASP.NET, ServicedComponents, and other enterprisecomputingtopics will be given thespotlight. Last, but not least, “Everywhere”covers such cutting-edge topicsas mobile computing, .NET on otherplatforms, and Web services.Finally, as you read this or futureissues, please feel free to send whatevercomments, complaints, or suggestionsdirectly to me at derek@syscon.com.Happy coding!BY DEREK FERGUSONDerek Ferguson is editor-in-chief of.NET Developer’s Journal and arenowned author, speaker, anddeveloper. His list of booksauthored includes Mobile.NET,Debugging ASP, MCSD SolutionArchitectures, and BroadbandInternet Access for Dummies.Derek serves as chief technologyevangelist for Expand BeyondCorp., a leading provider of wirelessenterprise management software.derek@sys-con.comDESKTOPSERVEREVERYWHERE5HOME

.NETDJ InterviewThe Present and Future of .NETAn interview withMicrosoft’s David TreadwellHOMEINTERVIEWED BYDEREK FERGUSON,EDITOR-IN-CHIEFOF .NETDJDESKTOPSERVEREVERYWHERE.NETDJ: What can you share withus about the current state of developingand licensing the .NETCompact Framework?DT: It’s currently in beta, and peoplewho are interested can downloadit from our device developersite: http://msdn.microsoft.com/vstudio/device/default.asp. Thereare currently more than 10,000developers in our beta program givingus feedback and building coolapplications..NETDJ: What do you think will bethe “killer app” for mobile .NETcomputing?DT: We’ve seen lots of creativedevelopment going on using locationservices and integration withservice providers using XML Webservices. I’ve also seen solutionsthat have provided immediate solutionsto some of today’s problems.For example, one early adopterupgraded a manual paper-orderingprocess using Pocket PCs, the .NETCompact Framework, and XML Webservices. Now they punch in orderselectronically, and the orders getprocessed in minutes rather thanhours. This has resulted in big savingsin operational costs. But really,that’s just scratching the surface ofwhat’s possible. Ultimately, it’sdevelopers who will come up withthe next big killer app, not us. Myteam’s job is to give developers thetools to write the killer app..NETDJ: What will be the biggestchallenge in making .NET succeed,and how will Microsoft overcome it?DT: So far, I’d actually say thatwe’ve been incredibly successful –we have hundreds of case studiesreaching into the Fortune 100, millionsof developers using the .NETFramework and Visual Studio .NET,hundreds of books, and an incrediblyactive developer community.Getting that kind of momentum wasour first challenge. Our next challengeis getting people other thandevelopers to understand what.NET is and why it’s important.Developers know what it means tothem – an elegant framework andtoolset for writing applications andXML Web services – but we’ve beenvague in our use of .NET for enterprisecustomers and end users.Going forward, you’ll see us introducingclear guidelines – focusedon end users and enterprises –about what .NET is and why it’sgood..NETDJ: What can you tell us aboutnew features in the next release ofthe .NET Framework?DT: You can find out a lot athttp://msdn.microsoft.com/vstudio/productinfo/roadmap.asp. As you’llsee there, this next release isfocused on dependability. For us,the higher order bit is making theAPIs as stable, secure, and reliableas they can be. If I had to call outone especially cool feature, it’s theintegration between IIS 6 andASP.NET in Windows .NET Server,most notably between IIS 6 andASP.NET. Of course, the rollout ofthe .NET Compact Framework willalso be a major “feature” as well..NETDJ: Do you think Microsoftdeserves any of the media hypeabout alleged poor security – or is itall just a question of averages? Or isit something else altogether?DT: Security is a shared responsibility– Microsoft, our customers, ourbroader community, and even thepress need to participate actively. Atthe core of it, Microsoft must delivera secure stack and a great securitymodel that make it easy for developersto design and write rock-solidapplications. When we set out tobuild the .NET Framework over fouryears ago, that was our top priority.We were able to deliver on this commitmentwith features like evidencebasedsecurity, role-based security,and new concepts in authenticationand authorization, and isolated storage.Delivering a great implementationis just a small part, however.Microsoft is making a huge investmentto ensure that we’re evangelizingbest practices for security codingto developers. We’ve introducedTrustworthy Computing sessions toall our developer conferences, we’rerolling out books and prescriptivearchitectural guidance documents,updating our Web sites, and generallymaking a huge investment ineducation and evangelism aroundsecurity..NETDJ: How tightly integrated will.NET be with future versions ofWindows? Is this at all a concern, incase anyone would ever want itunbundled for some reason?DT: Microsoft’s strategic directionfor developers is toward managed6Preview Issue • dotnetdevelopersjournal.com

code – the kind of code developerswrite on the .NET Framework. Bydefault, every product we ship goingforward will have a managed-codecomponent. At the heart of this isWindows: we are the Windows company.We believe in an integratedplatform that provides programmabilityand application services as acore part of the OS, and our customerslove that the plumbing isthere and just works for them – noassembly required. Including the.NET Framework as a core feature ofWindows .NET Server and all otherfuture versions of Windows is agreat example of how we’re producingthis integrated platform..NETDJ: What is your favorite .NETlanguage and why?DT: Ah, that’s always a hard one toanswer, since the answer dependsso much on what you want to develop!Five or so years ago, when I wasdoing lots of hard-core development,I probably would have picked.NETDJ: Given the ease and powerof ASP.NET, why isn’t everyoneusing it to build their Web sitestoday?DT: They are! Our research showsthat developers are incredibly excitedabout ASP.NET and are buildingASP.NET applications at an amazingrate. There have been over 100,000downloads of our ASP.NET WebMatrix Project development tool(www.asp.net), and our ASP.NET discussiongroups get posts from thousandsof unique developers each day.I haven’t met a developer yet thathasn’t raved about the improvementsover traditional ASP when they’veused ASP.NET. When Web developersgive it a shot, they fall in love with it..NETDJ: As Microsoft allows .NETto be integrated with an increasinglydiverse set of technologies, how willyou avoid lending additional supportto competing products (for example,Apache versus IIS)?DT: For us, it’s not an issue ofavoiding; it’s about partnering withother vendors to ensure that thecustomer gets the best possibleexperience. Microsoft has alwaysworked closely with our competitors– companies like Oracle and IBMare some of our best customers andwe help them build great productson Windows. We will talk with anyonewho wants to make investmentsin .NET, and the reality of the timesis that that means having to workenabling them to be more efficient.This gives .NET developers over100,000 components at their fingertipsto seamlessly plug into theirapplications. That’s a clear indicationthat we won’t be stepping ontheir toes – we actually work closelywith them to broaden and extendthe capabilities of .NET development.Ultimately, it enables developersto have a broader and more universaldevelopment experience..NETDJ: Which is more important toMicrosoft: winning the OS market orthe Web services market?DT: XML Web services is a set oftechnologies to integrate applications.Without an implementation ofXML Web services – that is, somesoftware that speaks these commonprotocols – there’s nothing to talkabout. Our implementation – the.NET Framework – is a feature ofWindows. So, by definition, implementingyour XML Web service with.NET is a Windows win.“We said we’d agree on standards andcompete on implementation. We’vepoured lots of blood, sweat, and tearsinto making our implementation rock”C# or C++ for their power and flexibility.However, these days I’m notdoing as much development myself,so I usually fire up VB.NET when Ineed to do some coding, as it’s theeasiest way to get off the groundand write cool applications quickly.dotnetdevelopersjournal.com • Preview Issuewith companies who also supportcompeting products..NETDJ: As Microsoft continues toadd functionality to .NET, how willyou avoid stepping on the toes ofyour third-party component vendors?DT: We have partners integratingtools, languages, and controlsdirectly within the Visual Studio .NETIDE. We have enterprise customersintegrating their in-house tools andonline communities within the IDEusing the Visual Studio .NETIntegration SDK. And we also havecomponent vendors building theircomponents on the .NETFramework, which extends theirofferings to .NET developers,.NETDJ: Are you at all surprised bySun’s slowness and resistance toWeb services – given their obviousbenefits, even to Sun?DT: Not really. I don’t think Sun recognizedthe power of applicationlayer integration, and they definitelyviewed XML Web services as a threatto Java, but we’re happy they finallycame around. More industry heavyweightssupporting XML Web servicesequals more ubiquitous technology,which ultimately equals adrastically improved developmentexperience..NETDJ: Given that VS.NET lets youcreate Web services in minutes, whyisn’t everyone building Web servicestoday?7

.NETDJ InterviewDT: You might be surprised. IBMhas said that 80% of their new consultingwork is around XML Webservices. We’re seeing similar patternsin our own work with customers.So our customers are buildingWeb services today, and wehave lots of case studies to demonstratethat. Today, our customers aremostly integrating systems behindtheir firewalls, making legacy codeand systems work side by side withnew projects. We expect this integrationto take place outside thefirewall in a B2B scenario in the nearfuture, and in a B2C scenario in thenext 12-18 months.own port of the CLI to FreeBSD –the Shared Source CLI. We createdand delivered over a million lines ofcode that developers can downloadfor noncommercial uses free ofcharge on FreeBSD and WindowsXP. Regarding Mono specifically,we’re really happy to see that Miguel[de Icaza] is also finding the platformtechnologies to be compelling anduseful. They are a concrete exampleof people building on the ECMAstandards process..NETDJ: Does Microsoft feel thatWeb services must remain rootedin XML in order to succeed?such as Web services, which shouldideally run well on very limiteddevices and platforms?DT: That’s a fairly common criticism ofXML, but look at how other technologiesthat emphasize interoperabilityand scale over absolute performancehave fared over the years. A greatexample is TCP/IP. In the late 1980sand early 1990s, there was a lot ofdebate in the industry about whetherTCP/IP would ever be ubiquitous, sinceit was much “fatter” than other networktransport protocols like NetBEUI andXNS. Some people claimed thatTCP/IP would never run well on PCssince it was so heavyweight relative to“I haven’t met a developer yet thathasn’t raved about the improvementsover traditional ASP when they’veused ASP.NET”HOMEDESKTOPSERVEREVERYWHERE.NETDJ: Since Web services are, bydefinition, platform independent –why choose Microsoft?DT: Time to market, cost, performance,and standards compliance.We have the best platform andtools, making it easy to build applicationsthat expose and consumeXML Web services. We offer integralsupport for the entire stack of XMLWeb services standards – XML,SOAP, WSDL, and UDDI – and apowerful, familiar programming environmentthat most developersalready know. We offer developmentin over 20 popular programming languages.We’ve got high-performanceaccess to SQL Server andOracle databases. The list goes onand on. But overall, we said we’dagree on standards and compete onimplementation. We’ve poured lotsof blood, sweat, and tears into makingour implementation rock..NETDJ: What is Microsoft’s positionon Mono and other non-FreeBSDattempts to port .NET to other platforms?DT: Of course, we’re partial to ourWhat about other, non-XMLbased approaches to Web servicesthat are currently gainingmomentum?DT: Web services are about connecting.IBM, Microsoft, and otherindustry leaders have pushed XMLas the base technology to build onbecause of its ubiquity, flexibility,and power. The openness and ubiquityof XML are key to the connectivityvision of Web services, and allthe major software vendors haveinvested a lot of time and money intrying to add XML to their applicationserver offerings. Otherapproaches – binary protocols, orprotocols that perform simple operations– have been tried and havefailed to deliver on global-scale,multiplatform integration. XML is notonly a viable approach, it’s the onlyapproach based on current technologythat can deliver..NETDJ: So, what would be yourresponse to critics who say thatXML is far too bandwidth and processingintensive to form a foundationfor interoperability technologiesthe other protocols. The fact is that itneeded that extra heft in order toachieve its primary goals, and the enormousforces caused by Moore’s Lawand the Internet simply overwhelmedany marginal performance advantagethat the other transports had. I expectthat the same thing will happen withXML and Web services: the interoperabilitywill prove so compelling that anydownsides are swept away as theindustry works hard to apply the powerof Web services to a broad array ofdevices.David Treadwell is the generalmanager for Microsoft's .NETDeveloper Platform team, part ofthe Developer Division. The team isresponsible for the .NETFramework and CommonLanguage Runtime (CLR), the coreruntime platform of .NET; the .NET Compact Framework,which brings the platform to small devices; and theMicrosoft Shared Source Common Language Infrastructure(CLI), which makes the platform, including underlyingsource, available on several operating system platforms.David played an important role in the establishment ofMicrosoft’s .NET strategy for developers. David holds aBSE in electrical engineering from Princeton University.8Preview Issue • dotnetdevelopersjournal.com

.NETQuestions?Sams Publishing is dedicated to craftingquality books on Microsoft technologiesby partnering with the best minds andgreatest teachers.Visit www.samspublishing.com fordiscounts on these and other booksfrom Sams.For all of your technology questions,Sams has the answers.Sams Teach Yourself ASP.NETin 21 Days, Second Editionby Chris Payne ISBN: 0-672-32445-8 ISBN: 0-672-32068-1 ISBN: 0-672-32232-3ALSO AVAILABLE:Microsoft .NET XML Web ServicesISBN: 0-672-32088-6XML and Web Services UnleashedISBN: 0-672-32341-9Sams Teach Yourself C# in 21 DaysISBN: 0-672-32071-1C# UnleashedISBN: 0-672-32122-XProgramming Data-Driven WebApplications with ASP.NETISBN: 0-672-32106-8.NET and COM: The CompleteInteroperability GuideISBN: 0-672-32170-X.NET Common Language RuntimeUnleashedISBN: 0-672-32124-6Database Programming with Visual Basic.NET and ADO.NET: Tips, Tutorialsand CodeISBN: 0-672-32247-1ISBN: 0-672-32421-0ISBN: 0-672-32143-2ISBN: 0-672-32476-8ISBN: 0-672-32234-Xwww.samspublishing.com

.NET SecurityTamper-Proofing Your AssemblyUsing Code Access Securityto foil unauthorized usersDESKTOPBY KEVIN HOFFMANHOMESERVEREVERYWHEREby now you’ve probablyalready created your first“Hello World” applicationusing one of the languagesin the .NET Framework suchas C# or VB.NET – or perhaps you’veeven managed VC++. The .NETFramework allows all kinds of differentlanguages to utilize code writtenin various other languages and byother vendors. But there’s a downside:how do you make sure yourcode isn’t used by unauthorizedclients?There’s been an enormousamount of marketing and publicitysurrounding the .NET Frameworkand all the wonderful things it cando for you. If you browse the Web atall, you simply can’t escape theonslaught of advertising and marketingrelated to how XML Web serviceswill change the future of programmingand the future of the Web.One of the features that Microsoftuses as a selling point for theiradventurous new framework is theconcept of Code Access Security(CAS). Every piece of code executedby the Common Language Runtime(CLR) runs within a security context.Such code is granted permissionsbased on various identifying factorsthat are also the elements that contributeto the strong name of anassembly. They are:• Filename: The filename of theassembly itself (such as My-Assembly.DLL or MyProgram.EXE)• Culture: The target culture of theassembly (such as en, fr, or fr-CA)• Version: The version number ofthe assembly• Public Key: A key that’s assignedto your assembly when you buildit against an RSA signature fileIt is the last of these, the publickey, that we’ll focus on in this article.Keeping OutUnauthorized UsersAdministrators can execute asecurity policy that grants orrevokes permissions at various levelsthroughout the enterprise toassemblies based on any of theabove identifying characteristics.This allows an administrator to preventa given assembly from contactinghosts on the Internet or fromdeleting files from the local harddrive.It’s fine that administrators cancontrol what code is allowed to do –and what it’s not allowed to do – ontheir own machines. But problemsarise when the developers and theadministrators have a conflict ofinterest.Take the following scenario:you’re the publisher of some softwarethat reads and writes its datain an encrypted, proprietary format.This is advantageous to you becauseonly your software can read andwrite this data. Now, along comes.NET and you convert your softwareto .NET and distribute it. Let’s sayyou have a class library that managesall of the I/O with regard toyour proprietary file type. Well, withcommand-line utilities likeILDASM.EXE and programmatictools using Reflection, anyone cansimply examine the metadata forthat assembly and get a detaileddescription of all methods and theirarguments. It would take a programmeronly a few minutes todetermine how to use your assemblyto manipulate your proprietaryfiles.Obviously, you don’t want this tohappen. There are countless otherscenarios in which companies needto protect their own interests bypreventing their APIs and classesfrom being executed by unauthorizedusers.Strong-Naming an AssemblyIt might look bad, but you dohave an option. Earlier, we mentionedthat you can strong-name anassembly by signing it with an RSAsignature file. This creates apublic/private key pair and storesthat pair in a file. All assemblies builtusing this signature file will exposethe same public key, which allowsthem to be identified as coming fromthe same publisher. No one can producean assembly with the samepublic key unless they manage to getaccess to your RSA signature file.To create this RSA signature file,open up a command prompt(preferably the one Visual Studio.NET provides, which automaticallyconfigures your path settings) andtype the following:SN –k SecureProducts.snkFor our examples, we’re going towork with a fictitious companycalled Secure Products, Inc. Theyproduce APIs they want to restrictso only code written by SecureProducts, Inc., can use them.I mentioned earlier that signingall your assemblies with the samesignature file effectively marks themas having come from the same publisher.Let’s create a sample assemblyand sign it with the SecureProducts.snkfile.To do this, open up Visual Studio.NET and create a new Class Libraryproject (in C#). Call the projectSecureAssembly and leave thedefault namespace and filenamealone. Then open up theAssemblyInfo.cs, set the version10Preview Issue • dotnetdevelopersjournal.com

Write faster codeControl revisionsModelDeployAutomate the mundaneSimplifyWrite code fasterGet a lifebe liberatedBeing among the first Microsoft ® .NET developers may be exciting. But wasting time is not. That’s where we come in. We’vespent six years working with Microsoft, and we’ve developed a new solution for .NET that lets you work completely inside theVisual Studio ® .NET shell. Want everything from modeling to code analysis right at your fingertips? Done. Want your modelautomatically updated when you write code and vice versa? Done. Want to get rid of alt/tab and static void Main ()? Done.Want to try out the products that can make you the best .NET developer on the planet? Go to www.rational.com/offer/dotnet13. Done.Rational, the Rational logo, among others, are trademarks or registered trademarks of Rational Software Corporation in the United States and/or in other countries. Microsoft and Visual Studio aretrademarks or registered trademarks of Microsoft Corporation. All other names are used for identification purposes only and are trademarks or registered trademarks of their respective companies.ALL RIGHTS RESERVED. ©2001 Rational Software Corporation.

.NET SecurityDESKTOPf 1f 2 FigureFigure 1: Permission failed!2: Success!HOMESERVEREVERYWHEREnumber to 1.0.0.0, and modify theAssemblyKeyFile attribute to pointto the file we created.You should end up with twoattribute lines that look like this:[assembly:AssemblyVersion("1.0.0.0")][assembly:AssemblyKeyFile(@"..\..\SecureProducts.snk")]This gives the linker enoughinformation to properly strongnameyour assembly. Make sure youcopy the SecureProducts.snk file tothe root directory of the Secure-Assembly project; otherwise,VS.NET won’t compile it.Now we have an assembly that’sstrongly named and, theoretically,digitally signed as having comefrom Secure Products, Inc. Let’sremove the default Class1.cs classand add our own. We’ll call itSecuredClass.Add a method to SecuredClasscalled GetTopSecretInformation(not very original, but it’ll do for ourpurposes). Here’s the code for thatmethod:public class SecuredClass{public SecuredClass(){}public stringGetTopSecretInformation(){return "The neon blue eagle "+"flies at dawn.The turtle has landed.";}}We don’t want thecontents of this string tofall into enemy hands.Therefore, we need touse a feature of CAS todemand that only codewith the public keybelonging to SecureProducts, Inc., caninstantiate this class oruse it in any way.To do this, we need toobtain the full public keyfor Secure Products, Inc.In order to do that, we’lluse another commandlineutility called secutil.This allows us to extractsecurity information fromalready compiled assemblies.Get your commandprompt, go to theSecureAssembly\obj\debug directory, and typethe following:Secutil –hex –strongnameSecureAssembly.dll> secutiloutput.txtThis will create a text file thatlooks a little like this:Microsoft (R) .NET FrameworkSecUtil 1.0.3512.0Copyright (C) MicrosoftCorporation 1998-2001. All rightsreserved.Public Key =0x0024000004800000940000000602000000240000525341310004000001000100EB8C810B9B24A636F7FFCA28693AB03DA926839C0FCC5C2B4F0A94CE0C94EB9690F519AC71AAC3C38F9AADAD460DEC33BFD8678B8199322BDC586F757339E6CE88DDED22B03466F8AB2205C75E8406A0F40C33F7FC11F06C73A43C95B21DD9E9ABD27C5B9946054233FF5C6B37D89690696CCDB41D7E74F8B59E66FB5EA1059EName =SecureAssemblyVersion =1.0.0.0SuccessNow we’re going to highlight theentire public key hex string (exceptthe prefix of 0x, which is redundantsince we know the string is in hex)and copy it to the clipboard.Then, we’ll use the public key wecopied to place the following attributeat the top of our SecuredClassclass definition, as follows:[StrongNameIdentityPermission(SecurityAction.LinkDemand,PublicKey="00240000048000009400000006020000002400005"+"25341310004000001000100EB8C810B9B24A636F7FFCA28693"+"AB03DA926839C0FCC5C2B4F0A94CE0C94EB9690F519AC71AAC"+"3C38F9AADAD460DEC33BFD8678B8199322BDC586F757339E6C"+"E88DDED22B03466F8AB2205C75E8406A0F40C33F7FC11F06C7"+"3A43C95B21DD9E9ABD27C5B9946054233FF5C6B37D89690696"+"CCDB41D7E74F8B59E66FB5EA1059E")]public class SecuredClassWhat we’re doing here is informingthe CLR that any attempt toaccess this class (both static andobject instances) must have thepublic key we specify (hence theLinkDemand enumeration value).If not, the CLR will throw an exception.There’s no way to create anassembly that has this public keywithout possessing the private keybelonging to it – and that resides inour SecureProducts.snk file. Therefore,keep your signature files secure.Security TestNow, to prove my point and tomake sure this is more than just12Preview Issue • dotnetdevelopersjournal.com

Your connection to the .NET experienceThe most secure link between .NET and your data.The .NET platform enables you to create powerful software that fully harnesses the connectivity of theInternet. But how will you connect your .NET software to vital information that resides in the myriadof databases in your enterprise? DataDirect Connect for .NET.Our data provider delivers secure, high-performance data connectivity to the leading databases.And since every bit of unmanaged code that reaches outside the Common Language Runtime(CLR) increases security risks, it’s built with 100% managed code. So it runs entirely within the.NET CLR, providing you with better performance and fewer security risks.The .NET result? You get the best experience connecting your applications to your data.An experience that’s supported by our unparalleled relationships with the creators of the.NET standard and leading database vendors. To learn more and experience .NETthe way it was meant to be, visit our site today, www.datadirect-technologies.com/netYour Software, Our Technology—Experience the Connection. SM©2002 DataDirect Technologies. DataDirect Connect is a registered trademark of DataDirect Technologies. All other trademarks and registered trademarks are the property of their respective companies.

FeatureAll Data, All the Time…An introduction to .NET data accessand SQLXML Web servicesSERVERBY BOB BEAUCHEMINHOMEDESKTOPEVERYWHEREin this “Data Access” column,I will discuss topicsrelating to the Microsoft.NET data access stack,known as ADO.NET. This installmentstarts with an overview of thedifferent pieces of the stack and finisheswith an interesting developmentin the world of SQL Server,.NET, and XML Web services.The ADO.NET data access APIsconsist of three types of classes:1. Classes for executing databasecommands in connected mode:This is accomplished by a seriesof data providers that run inmanaged code as much as possible.Each of these data providersimplements approximately thesame set of interfaces andexposes an analogous class hierarchy.2. Disconnected data access classes:A series of classes in theSystem.Data namespace thatconsists of a complex in-memorycollection class (called theDataSet), which approximatesrelational database semantics,and supporting classes such asthe DataTable, DataRow, andDataRelation.3. Classes for XML integration:DataSets, with help from a fewadditional classes in the System.Xmlnamespace (althoughthey “live” in the System.Data.dll),integrate the XML and relationaldata access worlds. It’s also possibleto allow for data interchangewith heterogeneous platforms,such as Unix systems and IBMmainframes, using XML Web services.An ADO.NET Crash CourseWe’ll start with a crash course inADO.NET consisting of some simpleprograms.Executing Database Commandsin Connected ModeData providers include a SQLServer–specific provider (theSqlClient data provider) and adata provider, known as the OleDbdata provider, which is a bridgefor OLE DB data sources. Justbefore .NET shipped in February,Microsoft released a bridgeprovider for ODBC data sourcesfor download from the Web. So, ifyou use SQL Server or have anOLE DB provider or ODBC driverfor your database, you can use the.NET data access classes directlywith your data.The simplest starter program forreading a resultset (the results of aSQL SELECT statement) containingtwo columns from a SQL Server table(in C#) would look like Listing 1.The program uses the SqlClientdata provider’s Connection class(which includes a constructor thattakes a database connection string)to open a connection to SQL Server.The Command class encapsulatesSQL statement functionality andincludes a constructor that takes aSQL command string. We use this toexecute the SQL; the results arereturned in a DataReader class. Thisclass has methods that allow us tomove forward through the rows inthe resultset, along with methodsthat allow us to access the data ineach row by using zero-based columnordinals.We’ll discuss using dataproviders with different datasources in more detail in futurecolumns. In addition to Microsoft’sdata providers, third parties canbuild data providers. For example,DataDirect Technologies hasshipped native providers for Oracleand Sybase. You can also build yourown. I built a simple data providerthat’s available for download athttp://staff.develop.com/bobb.Disconnected Dataand the DataSet ClassThe DataSet class is a specializedcollection class that includes a collectionthat follows the relationaldata model. If you’re used to dealingwith tables, columns, rows, andrelationships, you’ll be right athome with DataSet. DataSets can beused as an in-memory cache or adata source for ASP.NET Web Formscontrols, or they can be directlybound and manipulated byWindows Forms controls. DataSetsinteract with data providers througha data provider’s DataAdapter class.Listing 2 shows a simple programthat reads data into a DataSet,updates the DataSet, and flushesthe updates back to the database.Note that you don’t have to open theconnection directly when you’reusing a DataAdapter because theDataAdapter.Fill method opens theconnection, reads the rows, andthen closes the connection automatically.Although using a DataSet is similarin concept to using the disconnectedADO Recordset class, aDataSet can contain multiple tables16Preview Issue • dotnetdevelopersjournal.com

and the XML integration is infinitelymore flexible. It’s instructive to lookat the DataSet as an ADO Recordseton steroids.You can use DataSets with datafrom any data provider, synthesizetables and data using the APIsdirectly, or fill the DataSet usingXML. Using DataSets alone or inconjunction with the XmlDataDocumentclass (a hybrid of DataSetand XmlDocument) allows you totransparently mix and switchbetween XML and relational data.Here’s an example that writes aDataSet as XML:DataSet ds = new DataSet();SqlDataAdapter da = newSqlDataAdapter("select au_id, au_lname fromauthors","server=myserver;uid=myuser;pwd=mypwd;database=pubs");da.Fill(ds, "authors");ds.WriteXml("c:\\authors.xml");ds.WriteXmlSchema("c:\\authors.xsd");I’ll look at some of the intricaciesof the DataSet and related classes infuture columns.SQL Server, XML,and Web ServicesNow that we’ve covered thebasics of the ADO.NET data accessstack, let’s turn to another featurethat helps integrate Microsoft’s SQLServer database, XML documents,.NET programming, and XML Webservices. This extension to SQLServer, known as SQLXML, is availableon the Web for download.The SQLXML Configuration ToolThe SQLXML 3.0 version addedthe capability to expose data fromSQL Server and perform databasemaintenance through Web services.This means that database operationscan be accomplished from anyplatform that supports Web services,without needing SQL Serverclient libraries, OLE DB providers,or ODBC drivers to be installed oneach user’s workstation. This isimplemented through an IIS ISAPI(Internet Services API) applicationthat supports sending and receivingmessages using SOAP (Simpledotnetdevelopersjournal.com • Preview IssueObject Access Protocol). The SOAPprotocol (and Web services in general)is designed to provide interoperabilitybetween heterogeneousplatforms. You don’t need to usethem when you have a direct connectionto SQL Server and can useSQL Server’s native TDS (TabularData Stream) protocol to communicate.However, if you have a Webservice that passes DataSets aroundas XML, there’s no automatic way toprovide .NET DataSets to VB6clients. VB6 could in this case beconsidered a heterogeneous platformas well.SQLXML 3.0 makes exposingresults from a stored procedure,user-defined function, or SQLXMLtemplate query (a SQL or XPathquery bracketed by XML) as easy asconfiguring it in the SQLXML IISconfiguration utility. No server-sidecode need be written. You even havea few choices of how to return yourSQL results: as a .NET DataSet, anarray of .NET DataSets, or an arrayof XmlElement. The XmlElement isa .NET class in the managed XMLstack that can represent an XMLdocument or a document fragment.When you’re returning arrays, yourepresent this in your .NET clientprogram as an array of type Object,because your stored procedure mayreturn errors of type SqlMessage iferrors occur in execution. I’llexplain more about the array ofobjects when we write the client.You also have a choice ofwhether your SQL resultsets aregenerated in “XML RAW” format or“XML NESTED” format. XML RAWformat returns each row in theresultset as an XML element namedrow; columns are returned in attributenormal form (i.e., each columnis an attribute of the row element).XML NESTED format returns hierarchicallynested XML elementsnamed after the tables used in theSQL SELECT statement. There maybe multiple levels of hierarchy,depending on the SQL statement.You also have the option of configuringyour Web service methods toreturn a SOAP Fault element insteadof a SqlMessage element if errorsoccur.To configure the SQLXML IISutility to return SOAP, you mustconfigure a virtual name for theSOAP Web service after mapping aSQLXML virtual directory to a SQLServer and a specific database. Youuse the Virtual Names tab to accomplishthis. You can add one or moreSOAP virtual names per virtualdirectory if you want. Although theSOAP virtual name can be anything,a common convention is to name it“soap” (see Figure 1).Once you’ve configured theSOAP virtual name, you add accessto your stored procedures, userdefinedfunctions, or templatesusing the configuration button. TheXML output format options mentionedin the previous paragraphcan be specified on a per-methodbasis. The SQLXML configurationtool even generates the WSDL (WebService Description Language) that’sused to describe your Web serviceparameters to the outside worldautomatically when you save theconfiguration. The endpoint thatexposes this WSDL document is acombination of the virtual directoryand the SOAP virtual name with“?WSDL” appended – so for example,if the name of the virtual directoryis “pubs” and the SOAP virtualname is “soap,” the WSDL may beobtained at http://webserver/pubs/soap?WSDL.Figure 2 shows how to configurea template. In this case, the storedprocedure byroyalty is mapped to aWeb service endpoint, namedAuthorsByRoyaltyAsDataSets, usingthe raw row formatting style. ThisWeb service returns errors asSqlMessage types rather than asnative SOAP errors.Writing the ClientNow that we’ve “written” the Webservice – by virtue of having a storedprocedure, UDF (user-defined function),or SQLXML template alreadyin place (wasn’t that easy?) – let’swrite the client. Writing a .NET clientis fairly automatic (as it should be),no matter how we’ve chosen toreturn the results. In any VS.NETclient project, click on references inthe Project Explorer pane andchoose “Add Web Reference.” Pointthe Add Web Reference dialog at theWSDL file, and click “Add Reference.”A Web service proxy class is automaticallygenerated. This proxy class willcontain methods that can be used to17

FeatureSERVERf 1HOMEDESKTOPEVERYWHEREFigure 1: Configuring the SOAP virtual nameinvoke your newly created Web service.As with all VS.NET-generatedproxies, both synchronous and asynchronousexecution are supported. Ifyou don’t have VS.NET, the sameresults can be obtained by using thewsdl.exe command-line utility.Listing 3, which can be found atwww.sys-con.com/dotnet/sourcec.cfm is an example of using a .NETproxy class to fill an array ofDataSets.I mentioned earlier that I wouldexplain what “array of objects”means as a Web services returnvalue. This is best illustrated byinspecting the WSDL generated bythe configuration tool. The typessection of the WSDL file containsschemas for four generic types:1. SqlRowSet: Produced when youchoose to expose the results as aDataSet, which consists of anXML schema describing theresultset, followed by a resultsetin the XML DiffGram format, representedas an xsd:any type. Thisproduction corresponds to ageneric result (the xsd:any type)preceded by an inline schemadescribing the result.2. SqlXml: Produced when youchoose array of objects in the configurationtool. It consists of anxsd:sequence element followed byan xsd:any element. Since thexsd:any element is completelygeneric, the output is looselytyped and depends entirely on thestored procedure’s outputs.3. SqlResultCode: Consists of a singleinteger representing theResult parameter from a SQLstored procedure or UDF.4. SqlMessage: Contains multiple,well-defined elements consistingof the information returned whenSQL Server returns an error.These types are defined in threedifferent XSD schemas exposedinside the WSDL document. A list ofall the schemas for all of the types isbeyond the scope of this article, butas an example, here’s the schema forthe SqlXml and SqlRowSet complextypes. Note that the actual DataSetor XmlElement result is representedas XSD type xsd:any:If we return an array of DataSetor XmlElement it may also containthe SqlMessage complex type iferrors occur, so the entire series ofresults, known as a SqlResultStreamtype, appears to the client as anarray of .NET type Object. In thatcase, the correct type of any part ofthe SqlResultStream can be determinedby using Object.GetType asshown in the sample program or byprior knowledge of the result by theprogrammer.Web services aficionados maybe concerned with the loose typingimplied by the xsd:any types inthe SqlRowSet and SqlXml complextypes. It’s necessary for specificreasons. First, the DataSetitself is a generic container class;you can deduce the schema of aspecific DataSet instance onlyfrom the inline schema in theSqlRowSet. Second, the WSDL generatorin the SQLXML configurationutility can’t obtain metadatafrom the database that describesstored procedures’ resultsets.Stored procedures may obtain differentresults and even differentnumbers of results on a case-bycasebasis. But how will thesetypes be accessed by non-.NETclients that don’t have definitionsof the XmlElement or DataSetclasses? Doesn’t this amount toreturning every result as generic,untyped XML and forcing theclient to figure out what’s in there?Although the SQLXML configurationutility doesn’t know what canbe obtained from the stored procedure,UDF, or template returns, theTransact SQL programmer of theseXML Web services does know. Fornon-.NET clients that require strongtyping, you can hand-code alternativeWSDL and make it available atan alternate endpoint. If your clientcan handle inline schema, this maybe as easy as exposing a customschema that specifies a complextype your stored procedure produces.In the case of SqlXml, youcan code an alternate (stronglytyped) complex type. For example,the result returned in the exampleabove could be coded as:18Preview Issue • dotnetdevelopersjournal.com

Get all the details online!Go to www.gartner.com/us/eai now for . . .• Complete session descriptions• Updated keynote guest roster• Hotel & travel discounts and information• Fast and easy online registration• $200 Early Bird SavingsA clear view of theintegration future.And a roadmapto get you there!Application Integration and Web Services:The Next-Generation Software Infrastructure EmergesOctober 28 – 30, 2002Sheraton Chicago Hotel and TowersChicago, IllinoisTo register call1.800.778.1997 or +1.203.316.6757or visit www.gartner.com/us/eaiAnd don’t miss these specialconference features:■ Facilitated peer networking■ Corporate case studies■ Interactive vendor panels■ Gartner analyst One-on-OnesAfter years of false starts and missteps, the future of application integration andWeb services is finally clear – and at Gartner’s groundbreaking conference thisfall, you can be among the first to see it. From product and vendor selectionto project planning and implementation, our balanced strategic guidance andtactical advice can help you make the right decisions now – saving time, moneyand ensuring your organization a lasting competitive advantage.Choose from dozens of in-depth sessions in three high-focus tracks:Track A: Application IntegrationLearn how key application integration concepts, technology, products andvendors will transform and develop – and what to do now in order to stayahead of it all.Track B: Web Services and Software InfrastructureExplore in detail how J2EE, .NET – and the very nature of Web servicesthemselves – are altering the way systems are designed, implementedand managed.Track C: Management IssuesExamine each key element of a successful integration project – includingproject payback, IS staffing, vendor viability, software acquisition and otherimportant application integration and Web services management issues.Reference Priority Code: APNWSJ

Featurel 1Listing 1SqlConnection conn = new SqlConnection("server=myserver;uid=myuser;pwd=mypwd;database=pubs");SqlCommand cmd = new SqlCommand("select au_id, au_lname from authors", conn);SqlDataReader rdr;try {conn.Open();rdr = cmd.ExecuteReader();while (rdr.Read())Console.WriteLine("author {0} has name {1}", rdr[0],rdr[1]);}catch (Exception e) {Console.WriteLine(e.Message);}finally {if (conn.State == ConnectionState.Open)conn.Close();}f 2 Figure2: Configuring a stored procedure toreturn SOAPThis complex type should be usableby any client, not only those writtenin ADO.NET.DataSet ds = new DataSet();l 2 Listing 2SqlDataAdapter da = new SqlDataAdapter("select au_id, au_lname from authors","server=myserver;uid=myuser;pwd=mypwd;database=pubs");// this classes builds commands to update the databaseSqlCommandBuilder bld = new SqlCommandBuilder(da);// connection is closed here...da.Fill(ds, "authors");// connection closed here toods.Tables[0].Rows[0][1] = "newlastname";da.Update(ds, "authors");Bob Beauchemin has more than 22years’ experience in the computerindustry as an instructor, courseauthor, software developer, andsystems administrator. He’s currentlya senior staff instructor atDevelopMentor, curriculum liaison forthe data access curriculum, andauthor of courses on ADO.NET, OLEDB, ADO, SQL Server applicationdevelopment, and Java data access.bobb@develop.comHOMEDirect Programmatic AccessWe’ve seen how SQLXML lets usproduce Web services consumable byany client with little or no coding onthe server side. We wouldn’t want touse these services gratuitously if consumingTDS directly is possible; usingTDS instead of XML is always going tobe more efficient. But for situations inwhich we want to make SQL Serveravailable to non-Microsoft clients,combining SQL, XML, and SOAP maybe an easy way to achieve interoperability.When using .NET clients, thisgives us the ability to permit controlledaccess to our SQL Server withoutrequiring either direct access orwriting an ASP.NET Web service application.A Web service allows directprogrammatic access.Advertiser IndexADVERTISER URL PHONE PGAltova www.altova.com 978.816.1600 4Crystal Decisions www.crystaldecisions.com/cr9/021/ 888.333.6007 27DataDirect www.datadirect-technologies.com/net 800.876.3101 13Gartner www.gartner.com/us/eai 800.778.1997 19Infragistics, Inc. www.infragistics.com 800.231.8588 2, 3Interland www.interland.com 800.845.8706 28/n software inc. www.nsoftware.com 919.402.0590 15Rational Software www.rational.com/offer/webservices13 800.728.1212 11SERVERDESKTOPEVERYWHERENext TimeSince .NET has been released,a plethora of .NET data providershave also hit the market. Nexttime we’ll discuss strategies formigrating existing code, lookingat how the ADO.NET modelmakes it easier for provider writersto expose data source–specificfeatures, and how this affectsinteroperability.Sams Publishing www.samspublishing.com 317.581.3500 9SYS-CON Media www.sys-con.com/dotnet/ 888.303.5282 21General Conditions: The Publisher reserves the right to refuse any advertising not meeting the standards that are set to protect the high editorialquality of Dot Net Developer’s Journal. All advertising is subject to approval by the Publisher. The Publisher assumes no liability for any costs ordamages incurred if for any reason the Publisher fails to publish an advertisement. In no event shall the Publisher be liable for any costs or damagesin excess of the cost of the advertisement as a result of a mistake in the advertisement or for any other reason.The Advertiser is fully responsiblefor all financial liability and terms of the contract executed by the agents or agencies who are acting on behalf of the Advertiser. Conditions setin this document (except the rates) are subject to change by the Publisher without notice. No conditions other than those set forth in this “GeneralConditions Document” shall be binding upon the Publisher. Advertisers (and their agencies) are fully responsible for the content of their advertisementsprinted in Dot Net Developer’s Journal.Advertisements are to be printed at the discretion of the Publisher.This discretion includes the positioningof the advertisement, except for “preferred positions” described in the rate table. Cancellations and changes to advertisements must bemade in writing before the closing date. “Publisher” in this “General Conditions Document” refers to SYS-CON Publications, Inc.20Preview Issue • dotnetdevelopersjournal.com

introductorysubscription offer!A TRULY INDEPENDENTVOICE IN THE WORLD OF .NET.NET Developer’s Journal is the leadingindependent monthly publication targeted at .NETdevelopers, particularly advanced developers. It brings.NET developers everything they need to know in orderto create great software.Publishedmonthly, .NETDeveloper’sJournal coverseverything of interest todevelopers working withMicrosoft .NET technologies– all from acompletely independentand unbiased perspective.Articles are carefullyselected for their primetechnical content – technicaldetails aren’t watered down withSUBSCRIBE ONLINE!www.sys-con.com/dotnet/or Call1 888 303-5282Here’s what you’ll find inevery issue of .netdj:Security WatchMobile .NET.NET TrendsTech TipsStandards WatchBusiness Alerts.NET NewsBook and SoftwareAnnouncements.NET Developer’s Journal is for .NETdevelopers of all levels, especially those “inthe trenches” creating .NET code on a dailybasis:• For beginners:Each issue contains step-by-step tutorials.• For intermediate developers:There are more advanced articles.• For advanced .NET developers:In-depth technical articles and columnswritten by acknowledged .NET experts.Regardless of their experience level, .NETDeveloper’s Journal assumes that everyonereading it shares a common desire to understandas much about .NET – and the businessforces shaping it – as possible. Our aimis to help bring our reader-developers closerand closer to that goal with each and everynew issue!lots of needless opinion and commentary.Apart from the technical content, expert analystsand software industry commentators keep developersand their managers abreast of the businessforces influencing .NET’s rapid development.Wholly independent of both Microsoft Corporationand the other main players now shaping the course of.NET and Web services, .NET Developer’s Journalrepresents a constant, neutral, expert voice on thestate of .NET today – the good, the bad, and theugly…no exceptions.SAVE16%OFFTHE ANNUAL COVER PRICEGet 12 issues of .NETDJfor only $ 69 99 !OFFER SUBJECT TO CHANGE WITHOUT NOTICEANNUALCOVER PRICE:$83.88YOU PAY$69 99YOU SAVE$13.89OFF THE ANNUALCOVER PRICE

FeatureEnterprise .NET for Smart DevicesIntroducing the .NET Compact Frameworkand Smart Device Extensions for VS.NETEVERYWHEREBY CHRISTIANFORSBERG& ANDREAS SJÖSTRÖMHOMEDESKTOPSERVER22if you want to extend yourexisting systems as wellas your knowledge of.NET development whilebuilding solutions for smart devices,the upcoming .NET CF (CompactFramework) and SDE (Smart DeviceExtensions) are definitely the way togo. In this article we provide anexample of how to implement amobile application that can work asan extension to your existing systems,and also show you how toextend your knowledge of .NETdevelopment.It’s perhaps more true than everthat mobile solutions rarely standalone. Most consumer-orientedapplications are created to work inan offline or disconnected mode,but for enterprise solutions theincreasing connectivity of newdevices opens up enormous possibilitiesfor online and “sometimesconnected” applications as well.When looking at real-world businessscenarios and the capabilitiesof current mobile devices, it’s obviousthat the options are greater thanjust offline or online. Specific userrequirements such as “how often?”and “at what bandwidth?” shoulddetermine where on the scale fromoffline to online we need to be (seeFigure 1).The more a mobile application isconnected, the thinner it can befrom an application logic and localstorage perspective. The less it’sconnected, the higher the demandon the application logic and localstorage. A typical online mobileapplication is a Web application targetedat smart device browsers likeInternet Explorer for Pocket PC.With a Web application there are nodeployment issues for the device, asthe browser is already in place.However, most other connectivityoptions (from “auto-connected” allthe way to “never connected”)require you to have a custom applicationrunning on the device.The need for connectivity alsoimplies that we’re most often talkingabout extending existing systems toanyplace. Many workers are currentlytied to a desk with a PC on awire. They would like to be free togo wherever they want, yet still beable to perform their duties. Is itasking too much to help those poorpeople out?Consider Some ExamplesLet’s take a simple scenario likereporting time. Many mobile workershave to specify how they spendtheir time during their work hours.This is a common task in an enterpriseenvironment, and many of usare familiar with the pain of “re-creating”the past week during theweekly reporting – late Sunday night– into our company’s central timereporting system. Why? Because wehave to wait until we find a PC that’swired to the company network.What if we could do it anyplace?And since we don’t need to do theactual reporting more than weekly,it would fall into the category “seldomconnected” (see Figure 1).What if we didn’t actually have to beconnected when we do it?Another issue is how we can helpthose workers get the new tools ofthe trade. What if we could use thesame knowledge that we alreadyhave in building our enterprisesolutions? In the not too distantfuture, most of those solutions usingMicrosoft technology will be developedfor .NET, and therefore itwould be great if we could extend.NET and .NET development skillsto build those solutions for mobiledevices. As you may already know,you’ll soon be able to do just that.Build a Business CaseIn defining how we can benefitfrom turning paper-based processesinto mobile solutions, the keywordsare speed and quality.First of all, since time is money,we want to save time. By savingtime we can get an instant paybackon the investment in most mobilesolutions. We can save time for themobile worker, and most probablyalso for the back-office personnelwho now enter submitted paperdata into a system. Perhaps mostimportantly, we could also save thetime between data entry and datausage. For example, if the timereported was submitted each dayinstead of each week, we couldexpedite invoices related to thattime.Second, we’ll collect the data at thesource, gaining speed in our businessand improving data quality. Writingdata on paper, then passing it tosomeone else to read and enter into asystem is probably the most certainway to achieve poor-quality data.Higher quality most often translates tosaved time, and also to improved relationshipswith customers, partners,and even employees.Preview Issue • dotnetdevelopersjournal.com

What we’re trying to say is that ifyou want to build a successfulmobile solution, do your homework– document the business casebehind the solution. Most often, ifyou just spend some time thinkingit through, it’s not very hard.Technology OverviewSo, what is enterprise .NETdevelopment for smart devices? Ifwe look at the connectivity optionsfor an application (see Figure 1), wesometimes want to build a thinbrowser-based Web application, inwhich case we would probably use atool like Microsoft Mobile InternetToolkit with ASP.NET. But for mostother connectivity options, we needsomething that provides a soliddevelopment environment on thedevice. This is why the upcomingrelease of the .NET CompactFramework and Smart DeviceExtensions for Visual Studio .NET(VS.NET) becomes interesting..NET CF is a subset of the full.NET Framework. Careful thoughthas been put into selecting theclasses that make the most sense ona mobile device, taking into accountthe smaller footprint required ondevices and the accompanyingmemory and performance restrictions.It includes a CLR targeted forsmart devices.SDE is a set of extensions toVS.NET that enable you to buildapplications for the .NET CF. Theextensions include profiles that customizeVS.NET for smart devicedevelopment. For example, whentargeting the .NET CF, you getIntelliSense for the supported classesand only supported controls areavailable in the toolbox.For enterprise developers, thismeans that we’ll now get back to theOfflineNeverConnectedf 1SeldomConnectedFigure 1: The offline/online scaleOftenConnecteddotnetdevelopersjournal.com • Preview Issuestate where there’s a single tool setfor building applications for PCsand smart devices like Pocket PCand the coming SmartPhone 2002.C# or VB.NET?There’s been much discussion onthe selection of a development languagefor VS.NET. As we’ve made achoice to implement our sampleapplication in C#, we’ve stated ourpremium choice of language.However, we think that all enterprise.NET developers will have tomanage development in both C#and VB.NET. Various projects will berun using each, and we think thatthe choice will most often be madein relation to historical issues ratherthan technical issues like performanceor productivity, or evenissues like speed of developmentand ease of maintenance.Traditional Visual C++ developersand even Java developers willprobably select C# as their premiumchoice, and we think that even Javadevelopers converting to C# willhave a less painful migration thanVisual Basic 6 developers will haveconverting to VB.NET.The interesting part of .NET isnot the languages, but the framework.Despite the excellent languageinteroperability in .NET, wedon’t recommend mixing languagesin the same project if youcan avoid it.Time Reporting ExampleTo show you what we mean,we’ve put together a sample applicationto report the time you spendon different activities. With this simpletool, you can report your timeanyplace and at any time.The opening screen of the sampleapplication (see Figure 2) showsAuto-ConnectedOnlineAlwaysConnectedf 2 Figure2: Time reporting applicationa list of times reported for differentactivities (usually projects), whichyou can manipulate with the Add,Edit, and Delete buttons. You usethe Save button to save all timesreported and exit the application.When you tap the Add or Editbutton, you’re presented with a newscreen (see Figure 3). Here you canreport or update an activity withdate, project, and hours spent.Obviously, you save with the OKbutton and abort with the Cancelbutton.The sample application allowsthe user to work offline using XMLfiles. The Project ComboBox (seeFigure 3) is filled from an XML file(projects.xml) and the reportedtime is saved in (and retrieved onstartup from) an XML file (timereport.xml).Code WalkthroughLet’s have a look at the code forthe sample application. As we’vealready stated, our choice of languagefor the sample is C#, and wehope that most VB.NET developerswill be able to follow the logic anyway.(Authors’ Note: We built our sampleapplication using prerelease versionsof Visual Studio .NET, .NETCompact Framework, and SmartDevice Extension, and therefore itmay not be compatible with thefinal release versions.)One of the core features of the.NET CF is native support for23

FeatureEVERYWHEREf 3 FigureHOMEDESKTOPSERVER3: Report time screenXML. The code to populate theProject ComboBox in Figure 3 is inListing 1.As the ADO.NET DataSet hasnative support for XML, we can usethis to load an XML file (projects-.xml) containing the current projects.Each row’s Name field in theDataSet (XML file) is then added tothe ComboBox (cboProject). And ifsomething goes wrong (such as thatwe can’t open the file), we add adummy project name instead.Finally, we select the first project asthe default value. The project.xmlfile looks like this:SDE SampleLearn .NET CFLearn SDEIn a similar way, the reportedtime is saved in an XML file (timereport.xml)each time the applicationexits. The code for the closing eventof the main form looks like this:DataSet dsTime = new DataSet();dsTime.ReadXml(@"\Windows\timereportempty.xml");dsTime.Clear();// Get data from ListViewforeach (ListViewItem lit inlvwItems.Items){DataRow dr;dr = dsTime.Tables[0].NewRow();dsTime.Tables[0].Rows.Add(dr);dr["Date"] = lit.Text;dr["Project"] = lit.SubItems[1].Text;dr["Hours"] = lit.SubItems[2].Text;dsTime.AcceptChanges();}// Save to XML file dsTime.WriteXml(@"\Windows\timereport.xml");Again, an XML file (timereportempty.xml)containing thestructure of the data is used to createthe DataSet. Then the DataSet iscleared and each of the rows in theListView (lvwItems) is added to theDataSet. Finally, and most elegantly,the DataSet is saved to an XML file(timereport.xml). The timereportempty.xmlfile looks like this:This is a very simple way of creatingthe structure of a new DataSet.We could create the DataSet usingcode for adding a table with fields,but it would require much more typingthan if we create the XML file.The resulting timereport.xml file(with the data from Figure 2) lookslike this:02/17/02SDE Sample102/18/02Learn .NETCF202/19/02Learn SDE3(Authors’ Note: The project.xmland timereportempty.xml files arerequired to be available on thedevice [emulator or physical] inthe \Windows folder to make thesample application work. You haveto download this file to the devicebefore you run the sample. Thetimereport.xml file will be createdon application exit, but you willget a message box telling you thatit’s missing on application start.)The native support for XMLmakes working with data in XMLfiles very efficient, and for someapplications this is the only localstorage you’ll ever need. For moredemanding scenarios, you’ll need tohandle local storage through a relationaldatabase like SQL Server forWindows CE.Communicating Between FormsAnother interesting feature of.NET that we’d like to cover is theway you can communicate betweenforms. As a Visual Basic 6 developer,you had to build your own plumbingto make forms talk to eachother, usually by implementing acustom public method for showingthe form. Your pain is over! Todemonstrate, let’s have a look at thecode behind the Edit button inFigure 2:frmTimeReportItem frmItem = newfrmTimeReportItem();frmItem.Date = lvwItems.Selected-Items[0].Text;frmItem.Project = lvwItems.SelectedItems[0].SubItems[1].Text;frmItem.Hours = lvwItems.Selected-Items[0].SubItems[2].Text;if (frmItem.ShowDialog() ==DialogResult.OK){lvwItems.SelectedItems[0].Text =frmItem.Date;lvwItems.SelectedItems[0].SubItems[1].Text = frmItem.Project;lvwItems.SelectedItems[0].SubItems[2].Text = frmItem.Hours;}We start by creating the subform(frmTimeReportItem, shown in24Preview Issue • dotnetdevelopersjournal.com

Figure 3) and setting the publicproperties Date, Project, and Hoursfrom the currently selected row inthe ListView. We then show the formwith the ShowDialog method and ifthe return value of that call indicatesthat we tapped the OK button,the ListView is updated from thesame properties. Here’s the implementationof the Project property inthe frmTimeReportItem form:write by hand. Most of the remainingcode is generated by the projecttemplate and forms designer. Thecomplete sample is less than 100lines of code – including the lineswith only a “{“ or a “}”.The version of the SDE we’veused (the tech preview released atMicrosoft’s Professional DevelopersConference in November2001) didn’t include a formsprojects (projects.xml), and updatesan XML file (timereport.xml) withthe reported time. In a real-worldenterprise scenario, these fileswould be synchronized with a centraltime-reporting system on aserver. One requirement is that thecentral time-reporting system mustbe able to handle import and exportof XML – are there any of thosearound today that can’t?“We think that all enterprise .NET developers will haveto manage development in both C# and VB.NET”public string Project{get{return cboProject.Text;}set{cboProject.Text = value;}}The property simply gets andsets the Text property of the ProjectComboBox (cboProject). To makethis work, we have to make sure thatthe ComboBox is loaded before weaccess the property. That’s why thecode to load the ComboBox isplaced in the constructor of theform class.To make the ShowDialog methodreturn different values for differentbuttons, you simply set theAcceptButton and CancelButtonproperties of the form. This codecomes from the InitializeComponentmethod in the code generatedby the forms designer:this.AcceptButton = this.btnOK;this.CancelButton = this.btnCancel;For a complete example, youshould download the sample codefor this article from www.syscon.com/dotnet/sourcec.cfm.Lessons LearnedThe really cool thing with thissample is that the code we’ve shownyou so far is nearly all that you needdotnetdevelopersjournal.com • Preview Issuedesigner. But interestingly thistaught us something about howeasy it is to migrate a desktopWindows application to a smartdevice like the Pocket PC. We startedto build the sample as a nativeWindows application, then copiedthe forms into a smart device projectand made some minorchanges – and there we were with aworking sample application! Theminor changes in the .NETFramework and .NET CF ObjectModels were efficiently pointedout to us by the compiler and wereeasily corrected.In the version of the .NET CFthat we used there was noNumericUpDown control – itwould’ve been nice for enteringHours (see Figure 3). On a mobiledevice like the Pocket PC, the goal isalways to minimize user input, andtapping of up and down arrows –rather than entering numbers fromthe soft keyboard (or letter recognizer)– will speed data entry significantly.However, replacing theTextBox control when theNumericUpDown control becomesavailable is no more than a minoradjustment.The device used to test thesample was a Compaq iPAQ 3650upgraded to Pocket PC 2002. Thesample worked fine in the emulator,too. It should run on a standardiPAQ (with Pocket PC 2000) aswell.Extending Existing SystemsThe sample application assumesthere’s an XML file with all ongoingConclusionIf you want to extend your existingsystems, as well as your existingknowledge of .NET developmentwhile building solutions for smartdevices, the .NET CF and SDE are theway to go. All you have to do now isget started with extending your existingsystems, and you’ll be off buildingmobile enterprise .NET solutions!Even if this is a great first steptoward extending your time reportingto “anyplace,” the next logical stepwould be to make the synchronizationwith the server in a standardizedway. The way we’re thinking ofinvolves another core part of .NETWeb services. However, it requiresthat the server system be able to handleWeb services. If you have a serverwith Windows, this is most certainlydoable, and might even make a greatsubject for a future column.l 1Listing 1Christian Forsberg and Andreas Sjöströmare Microsoft MVPs (Most ValuableProfessionals) for Mobile Devices and havejointly authored the bestselling bookPocket PC Development in the Enterprise.They can be visited atwww.businessanyplace.net.chris@businessanyplace.netandy@businessanyplace.net// Load projects from XML filetry{DataSet dsProject = new DataSet();dsProject.ReadXml(@"\Windows\projects.xml");foreach (DataRow dr in dsProject.Tables[0].Rows)cboProject.Items.Add(dr["Name"].ToString());}catch (Exception e){MessageBox.Show("Couldn't open projects.xml file!");cboProject.Items.Add("?");}finally{cboProject.SelectedIndex = 0;}25

.NET Book WatchHOMETitle: Sams TeachYourself ASP.NET in 21Days, Second EditionAuthor: Chris PaynePublisher: SamsList Price: $39.99Rating:Reviewed by DerekFergusonTitle: Visual Basic.NET and the .NETPlatform: AnAdvanced GuideAuthor: AndrewTroelsenPublisher: ApressList Price: $59.95Rating:Reviewed by DerekFergusonDESKTOPSERVEREVERYWHEREiSams Teach Yourself ASP.NETin 21 Days, Second Editionwill always rememberobtaining my advance copyof this manuscript, as itrequired a walk from my hotel roomin lower Manhattan to the W Hotelin Times Square. The trip was wellworth it, however! I began leafingthrough the manuscript on the trainback home and didn’t even go tosleep until I had read the entire firsthalf. I finished the remaining half inthe morning before we arrived inChicago. When a book is this good,you don’t even need the 21 dayspromised by its title.The book begins with virtuallyno assumptions about the reader’sprevious development experience.This is very ambitious, consideringthat by the end of the book thereader will have covered all key conceptsnecessary in order to becomea highly skilled ASP.NET developer.This process is helped along enormouslyby the presence of exercisesat the end of each chapter, to allowreaders to check their progresstoward the goal of ASP.NET mastery.Part of the reason I so quicklybecame engrossed in this manuscriptis that it gets off to a veryquick start. It smartly sidesteps theissues associated with teachingeither C# or VB.NET and digs rightinto a working example to get readersinterested in exactly whatASP.NET can do for them in theirdaily work. Later on, Chapter 3 managesto compress into a single chapterso much C# versus VB.NET materialthat it would take days of scouringthe Microsoft documentation todeduce it for yourself.The book makes very quick workof teaching the basics of ASP.NETstructure and syntax, so the remainderof the manuscript is wisely spentexamining the various .NETFrameworks related to advancedASP.NET development. Just a few ofthese topics include XML, COMinteroperability, and internationalization.One thing I particularly likedabout this book was that every tooldescribed in it is absolutely free fordownload. Assuming you alreadyhave an ASP.NET-capable operatingsystem (Windows 2000 or WindowsXP, for example) this book showsyou how to install IIS, the .NETFramework, and the free debuggeravailable in the .NET SDK.The book’s attempt to cover Webservices in any form is admirable,and a basic understanding of thetechnology is very well communicated.On the other hand, topicssuch as SOAP headers, DISCO, andnon-ASP.NET clients (a Java applicationrunning on Solaris, for example)are mentioned in passing, andthen passed over. This is probably awise decision, considering the scopeof the manuscript.sVisual Basic .NET and the .NETPlatform: An Advanced Guideo, there I was in the bookstore,trying to decide whatbook to buy for a plane tripout to Redmond. I’d been invited toa special .NET technology “bootcamp” for authors and wanted toarrive knowing even more about.NET than I knew stepping onto theplane.My peculiar situation was that Iknew a great deal about one specificarea of .NET (mobility – aboutwhich I’d already written a book,Mobile .NET). However, my day jobat Expand Beyond (www.xb.com)keeps me up to my armpits in Javamost of the time. What I needed wassomething that would expand thebreadth of my .NET knowledgewithout talking in terms that anexperienced Microsoft developerwould find insulting.The first thing you’ll notice aboutVisual Basic .NET and the .NETPlatform: An Advanced Guide is itssize. At approximately a thousandpages, I knew this wasn’t going to bea book I could finish in a round tripbetween Chicago and Seattle – muchless on my way out. However, I alsoimmediately felt that a book of thissize could present a serious claim tothe title of being “the” book on .NETdevelopment.Well, I wasn’t disappointed. Thismay not be “the” book on .NETdevelopment, but it’s certainly thebook to read if you’ve already doneMicrosoft development and arenow looking to learn about .NET.I was sold from the moment theauthor, Andrew Troelsen – ofIntertech-Inc fame – introducedILDASM on page 33. ILDASM is atool that lets you examine the contentsof any .NET assembly rightdown to the level of the individualIL instructions. Any book that’salready talking about this tool onpage 33 has made a conscious decisionto dispense with the fluff andget right down to business!Now, it should be noted that thisbook is essentially just a VB.NETtranslation of the author’s earlierwork, C# and the .NET Platform. So,if you’ve already read the previousbook, you might not find this booknearly as useful as I did. (We’ll keepour eyes peeled here at .NETDeveloper’s Journal for the perfectbook or books for those of you whohave already learned .NET using C#and now want to tackle VB.NET – orvice versa!)Similarly, given my own extensivebackground in Java, I didn’tneed any of the in-depth explanationsgiven for object-orienteddevelopment or multithreading.However, for the bulk of the readership– who will undoubtedly becoming from a Visual Basic 6 (orearlier) background – I’m sure thismaterial is indispensable. In anyevent, it was all wonderfully writtenand thoroughly explained.Two things that I’m glad thisbook doesn’t cover are XML Webservices and Web applications. Ifully understand that Web servicesare integral to .NET’s entire valueproposition. I also understand thatWeb applications represent one ofthe most stunning applications of.NET’s incredible flexible architecture.However, the author gives amore than adequate introduction tothe concept here, so there’s no needto devote any more coverage to it.Microsoft’s own documentation andnumerous other works do an excellentjob where this is concerned.For over a thousand pages, thisbook tells you everything you needto know about .NET – without a bitof fluff – and that’s quite an accomplishment.I must deduct half a star,however, because I couldn’t locatethe author’s e-mail address anywherein the text or on the cover.26Preview Issue • dotnetdevelopersjournal.com

To learn more, visit www.crystaldecisions.com/cr9/003/ and sign up for afree online seminar. To purchase, call 1 888 333 6007, go to our online storeat www.crystaldecisions.com/cr9/021/, or contact your preferred reseller.(c) 2002 Crystal Decisions, Inc. All rights reser ved. Cr ystal Decisions, Cr ystalReports,Crystal Enterprise, Cr ystal Analysis,Crystal Ser vices,Crystal Care, Cr ystal Assist, Crystal Applications, SeagateInfo,Holos and the Crystal Decisions logo aretrademarksorregistered trademarksof Cr ystal Decisions, Inc in the U.S. and/or other countries.Allother trademarksreferenced arethe propertyoftheirrespective owners.

Your dedicated serverdeserves a dedicatedsupport manager.Steve S.DedicatedSupport ManagerWith Interland Web hosting, dedicated support is always there for you.• NEW dedicated service programIt’s about you. Your business. Your Web site. Your needs. Interland promises to delivercustomer service beyond your expectations. You get your very own dedicated supportmanager, backed by a support team focused on your site and your business. And yourvery own dedicated toll-free phone number means your access to support is fast and easy.• Our best will always be thereTechnical problems rarely confine themselves to regular office hours. That’s why Interlandoffers superior technical support 24 hours a day, 7 days a week. Available online or overthe phone, our best support managers are ready to solve your problems. And you getpriority routing to ensure your account receives immediate attention. This incrediblesupport is just one more reason why Interland is the #1 provider in managed dedicatedhosting to small and mid-sized businesses.• Plans start at only $ 129/mo.Regardless of your business, we have a dedicated Web hosting plan that will meet yourneeds. You’ll get the bandwidth you need at a price you can afford. Compare our prices,setup fees and customer service to our competitors - you’ll see why Interland is theobvious choice when it comes to choosing a dedicated Web host provider.Web hosting that’s here to stay.Visit interland.com or call us at 1-800-845-8706.*Offer valid through October 15, 2002. Offer is valid only on new Power 200, Power 300, Accelerator 200 and Accelerator 300 plans with a 12-month or longeraccount. Offer is valid on all new TrueAdvantage and Freedom Plans with a 24-month pre-paid account. Free months are added at end of full contract accountperiod. Setup fees will apply. Promotional offer valid only for telephone sales. Promotions cannot be combined with any other offers. © 2002 Interland, Inc. Allrights reserved. Not responsible for errors or omissions in typography or photography. Interland is a registered trademark and the Interland design, Power,PowerView, Web Extras, True, TrueAdvantage, TrueBasic, TrueAdvanced, TrueBusiness, Freedom Accelerator, ezSiteStarter and ezSiteBuilder are trademarks ofInterland, Inc. Microsoft is a registered trademark of Microsoft Corporation. All other product names appearing herein are for identification purposes only andmay be trademarks of their respective companies. All orders subject to credit approval, availability and other terms and conditions (including terms of serviceand acceptable use policy) available at www.interland.com. Features, functions and pricing subject to change without notice.DEDICATED HOSTINGPLANS START ATONLY $ 129/mo!POWER 200Heightened performanceThis dedicated hosting plan providesthe speed, performance and reliabilityyou need to support high-traffic anddatabase-driven Web sites. Complete withroot access for the control youneed to self-manage your business.1 GHz CPU speed512 MB installed RAM2x18 GB hard disk storage100 GB monthly transferStarting at just $499.95 per monthBased on 12-month contractIncludes Powerview (remote reboot and event notification), rootaccess to control your Web site, 24x7 basic monitoring, customersupport and business email. RAID configuration is also available.GET 3 FREEMONTHS OFWEB HOSTINGfor each new Interland account you open.*