Tech-ed 2009 - Day 1

Thought I'd commit my precious thoughts on the first day before I lose my note-book (of the IPaperBased type), or get caught-up in the second day of festivities (today).  I'm taking advantage of the Gen-i lounge - so this is totally off-the-cuff and sans-spellchecker.

Keynote

Saw some great looking 1 minute demos, the VOIP integration in Outlook/Exchange 2010 looks awesome, and it was nice to see Chris Liddell - the Kiwi CFO for MS.  Apart from that it was a bit ho-hum; not really up to the inspiring and thought provoking talk from Lou Carbone of 2007.

Ok - the sessions I attended (in order, no less) on day 1...

ACR303 Making enterprise code re-use work in the enterprise, with Tom Hollander

I've seen Tom once before in 2007; he's a good speaker and does fairly well with dry content - don't go expecting to be wow'd with flashy demos.  The talk focused on various ways of looking at re-use, including strategies, and specifics like code generation.  For example - there's a continuum here around how much to re-use: Consume - extend - customize. 

The options you choose depends on the level you're working in, for example; low level: .Net framework = cosume; mid-level: EntLibs = extend; top-level: app frameworks = customize.

Good advice on how to manage top-down vs. bottom-up approaches to re-use:

• Let the (enterprise) architects focus on platforms, integration patterns, security services, frameworks and components that supoort these.
• Let project teams have autonomy with these constraints.

Other good bits of advice included:

• harvest stuff the actually works
• build stuff atleast twice before committing to it as a re-useable standard (once isn't enough)
• and don't go specifically building a framework or component without actual need.

(I'm happy to say I'm not gulity of that with Morphfolia - that definately came from specific needs).

As usual (and one of the overwhelming reasons to attend events like Tech-ed) my brain got stimulated with all sorts of ideas and tangents:

• Possible new features for Morphfolia:
• A "Cmd Bar" for admins - something that lets you directly call public business logic level methods, with history and feed-back UI similar to a typical cmd prompt.
• I need to make some of the (suitable) classes partial for easier extension by other developers.
• I need to look at the Ajax Control Tool Kit and WCSF 

Speaking of Ajax, I'm definately going to Ajax-ify some of the admin fuctionality in Morphfolia - specifically the Edit Page functionality.  It works - but it's not exactly sexy.

ARC205 How to build a small software enterprise from zero, with Joe Albahari

A great session about starting up something yourself and becoming a micro-ISV.  Joe's a excellent speaker and quite fun (I really love that larconic dry English sense of humour).

Joe has built a thing called LinqPad; I've never used it as I'm not into Linq (c'mon, I haven't had time - you have to choose what you focus on and Linq's never been super high on my list), but it looks like a great little tool if Linq is your thing.

Joe's journey is clearly different to mine - his app is (basically) a small desktop exe, where-as Morphfolia is a web-based CMS and framework - clearly different beasts.

Some advice from Joe:

• There are 3 kinds of partner you might use:
1. Business person - make sure they are richer than you (you want a successful one) (my additional word of caution here would be to make sure they didn't get rich by ripping-off former business partners)
2. Sales-person - good ones will want payment by comission - which is good for you to.
3. Domain experts.

Domain experts are what you need if you want to break into a vertical market, but some words of caution: don't let them design your software, and use 3 if you can: otherwise you'll end-up with a tool that suits only that one persons perspective.

• Experiment all the time (he was discussing pricing at the time).
• If you're making tools for other developers, target MVPs
• Uservoice.com is a great way to manage user feedback (sounds like a great idea to me - need to look into their service)
• Ads should be a "call to action", and have a simple message
• Focus on the killer use cases (sounds a bit agile to me)

Joe likes PayPal - it's a great way to take payment and he works very much with the US market in mind (around 60% of his market - I think).

The other good bit of advice was to answer feature requests with a beta build that included said feature (provided back over-night, if you can).

He had lots of other great tips - check him out.

SEC201 Inside the Microsoft Security Development Lifecycle: And how you can use it!, with Michael Howard

Wow - I took heaps of notes here, but don't take that as  bad sign that I don't know what I'm doing!  (Well, maybe I don't)

• Michael strongly advocates having a dedicated security resource - whether it be a person or a team.
• Use FXCop and CAT.NET daily.  Michael (with a degree of shame) suggested that the standalone FxCop was better (for static security analysis) than the one included with VS.
• Always use a factory pattern for hash/crypto algorithums - you don't want to hard-code that stuff. Ever.  Using a different algorithum should be a config change - not a re-build.
• Use DPAPI for secrets.
• Use approved random number generators.
• Use AES 128 (or better), RSA 2048 (or better) and SHA-256 (or better).
• Don't use SHA-384 (it's not actually faster than SHA-512).
• Use VS 2008 SP1 - the compiler is better (for security code gen, etc) - you get lots of great stuff 'for free'.
• Lastly, use safe redirects - no dymanic code! - unless you're pedantic about parsing it.  You don't want the bad guys controlling where your users go.  Use hard-coded urls where you can.  If you need to be dynamic - don't just trust a string as a url - convert it into a uri object and check the host property.

I made other notes, but that's most of it.

WUX202 Free up the UX Bottleneck: Wireframing and Prototyping with Expression Blend and Sketchflow, with Shane Morris

A great talk - and a fun too.  His (accidental?) quote of the day: "...just google it on bing", had people snickering for ages afterwards.

SketchFlow is an excellent tool for rapidly prototyping UI's and applications.  It looks excellent for agile work.  A great tool for Architects and savvy BAs.  You can throw out prototypes for comment and it has a great feedback loop too.

You map out a process of 'steps' - could be a screen - could be something that just needs doing but you not sure exactly where.  You can't (yet) directly import processes already defined elsewheer - but - it's xml based and you could roll your own if you wanted to.

DEV302 Get ready: What's coming with .NET 4.0 with John-Daniel Trask

Again - a fairly dry subject handled well.  JD got a few interjections from the floor, but handled them well.

• .Net 4.0 HAs the first new CLR since .Net 2.0.
• The best news for me was a more grainual control of the viewstate.

Well, that was it for the first day - better grab a smoothy and head to the next session for today.

P.S - Minor emergencey - had to resort to a Lindt bar as I didn't bring any dark Toblerrone with me. Doh!