Raible Designs

[Microsoft] Day 1 Morning

"An open and honest dialog" - that's what the goal of this shindig is. Most of these sessions aren't really interesting to me. If there's APIs I can talk to, I'm cool with that, but as far as SQL Server 2005 and Windows Architecture ... I'm not interested. The thing I'm looking forward to today more than anything is meeting Scoble.

Most of the folks in this room seem to be community leaders, i.e. JUG Founders and architects. There's also a fair amount of "Developer Evangelists" in the room. Probably half the room is MS people. I wonder what the hell a Developer Evangelist does? Do they write any code? I'm guessing there's no MS coders in the room.

Michael Howard - Improving Security at Microsoft by changing the process

Michael Howard is the co-author of the "Writing Secure Code" book that we all received this morning. He's writing a new book called the "19 Deadly Sins of Software Security" - which apparently covers everything: Windows, Linux, OS X, Java, JSP, MySQL, Oracle, etc. Sounds like a pretty good book - it's got some open-source guy as a co-author too. It's a McGraw Hill book and should be short-n-sweet at 300 pages. Michael is the Senior Security Program Engineer and sounds like a champion of the "Trustworthy Computing" mantra here at Microsoft.

zone-h.org tracks the number of web server attacks. Michael is talking about the fact that IIS 6.0 has had one security bug in 2 years, while Apache 1.3 has 13 and Apache 2.0 has had over 20. "Apache has more security bugs than IIS."

Everyone has security bugs, we're the only ones doing something about it.

Threat Modeling - they do a lot of research on skills vs. motivations. They're basically trying to understand not only how, but why hackers attack.

OK, this is a pretty boring talk - mostly because it doesn't interest me. There's a lot of talk about security in "Whidbey", which is the next version of Visual Studio.NET. Apparently, it's now got some tools to detect security issues and memory leaks. My boredom has caused me to start working on AppFuse, and to try out the USB Flash Memory Drive they gave us. It's kinda funny - the box it came in has a link to where you can download the drivers for Windows 98/SE. No driver is needed for ME/2000/XP. I also discovered that it works great on the Mac. Cool - too bad it's pretty much useless if you're always online like I am.

Heh, shortly after writing the above, I yanked out the device and it killed both Keynote and BBEdit. It's definitely a useless device!

Don Box - Microsoft Messaging Futures Using Indigo

Don is taking an interesting approach to his presentation - and typing it all in notepad. He wants us to tell him why we think MSFT sucks. Don works on the XML messaging stack. Specifically, he's an architect on Indigo and he worked on the WS-* specs. An audience member puts a stop to the typing because he's legally blind and can't read anything. Here comes the talking. How does Microsoft suck?

Audience feedback:

• Community Involvement sucks
• Need to do security by default
• COM+ isms not there - transactions more mature in J2EE
• Does MS believe in managed code?
• 2 year platform cycles, re-invention w/ every release
• Dependency hairball - shouldn't have to buy other products to make simple things work
• Dependency Injection, IoC, ORM

I brought up the fact that MSFT crushes or buys their competition more often then not. Don spent some time answering this question, defending MSFT a bit, but also saying that we're in a new decade now and it's a very competitive industry. For the record, I don't really believe MSFT is the "Evil Empire" like many hard-core Linux and open-source guys. I have quite a few MSFT certifications, but I've found most of them useless in my career - except that I can easily troubleshoot and fix most of the issues I have on Windows. I use Windows and prefer it over OS X for the most part, but that's because I'm more efficient using Windows, and because my Windows box is much faster than my PowerBook.

Don reminds me of a good friend of mine - Chad Shoup - but he's about 10 years older. For those of you who know Chad, you know he's fun to listen to. I don't have much interest in the talk (I don't even know what Indigo is), but it's an enjoyable talk - mainly because he's enthusiastic about what he's talking about - and he's walking around the room, keeping the audience involved.

RelaxNG is better than XSD. The primary goal of Indigo is to satisfy the customers and consolidating the choices in .NET so that choices are easy and explicitly - instead of having a number of different products that do the same thing. They don't plan on taking choices away - they just plan on making the choice easy and explicit. If you're working with .NET, there might actually appear to be an architect behind it all.

Don goes on to address all the audience feedback and explain MSFT's position and what they're doing to address this. Sorry, I tuned out as I wasn't that interested. The one interesting quote I got out of this session is "I believe we're going to be more than competitive in O/R Mapping. Soon."

Richard Monson-Haefel asks "Is there a place for AOP in .NET or is it too sophisticated for your developers." Don's take is "My development platform should allow me to write code w/ a couple of beers in me." He ragged a bit on Java developers and said their main problem is they think they're smarter than they are. He also said that if he could change on thing at MSFT, it would be that Ruby becomes the language of choice.

Break time: yogurt and granola. I got a picture with Don and will post that as soon as I find a cable. I'm also going to see what this "Double Strength, Double Size, Rockstar Energy Drink" is all about. It sounds poisonous, but it's likely to give me a wicked buzz or make me throw up. Seems like a good experiment.

Looking outside, it's raining now - which seems appropriate now that we're going to have a Programming Language Design Panel. The rain goes with my depression that I have to sit through this session. I doubt it'll be of any interest to me.

Programming Language Design Panel: Jim Miller (CLR Architect), Herb Sutter (C++ Architect), Jim Hugunin (Lead for IronPython and dynamic languages on CLR)

Jim Miller: The five programming languages that Microsoft ships: C#, VB.NET, C++, J# and JScript. Generics are now a part of the run-time environment. Closures and light-weight code-generation will also be available.

Herb Sutter: Only guy on the panel that cares about managed and native code.

C# Guy: C# 2.0 features: Generics - code looks a lot like Java, but implementation is very different in CLR. Closures so you can pass methods as arguments. Iterators - lazy enumeration of collections like Python and Ruby. Partial types or structured include files - multiple files make up one class (good for code generation).

Jim Hugunin: Used to be a Java Developer, working with AspectJ and other dynamic languages. He wanted to see why .NET was such a horrible platform for dynamic languages. A year later, he found himself working for Microsoft. He's found that .NET is a good platform for dynamic languages (of course, right?). His current job is getting IronPython to 1.0.

Dion asks about Ruby on .NET and about AOP in .NET. Jim doesn't know of any major projects that are addressing Ruby on .NET. C# guy says that we have a lot we can learn from dynamic languages and thinks the best thing is to allow less typing (i.e. declare type once) in strongly-typed languages like C# and Java. As far as AOP, the C# guy is still in the wait-and-see mode.

Rockstar Energy Drink Status: I made it about 1/3 of the way through it before the stomach ache kicked in. Now I'm jittery and nauseous... <great/>

IronPython will likely be an open-source project b/c the Python Community will probably reject it otherwise.

Will Java 5.0 code be able to easily port into J#? The panel doesn't know and thinks it's more of a legal question. J# currently supports JDK 1.4 syntax and they don't think there current license allows supporting JDK 5.0.

Mono - they've been taking a wait-and-see approach to see the commercial uptake on it. So far, they haven't seen a whole lot of commercial interest in Mono, nor any licensing requests from Novell.

So who's at this Developer Summit?

I expected that this place would be filled with Java Developers and Experts that I know from conferences and open-source mailing lists. Not so - there's only a handful of guys I know. Here's the list of folks I actually recognize. I apologize to anyone I forgot.

• Ben Galbraith
• Dion Almaer
• Jay Zimmerman
• Matthew Schmidt
• Richard Monson-Haefel
• Rick Ross

After talking with a lot of Microsoftees (including the lady who came up the idea), this whole week seems pretty harmless. They want us to critique their products and strategies and tell them what they're doing wrong. We had fun ragging on some guys tonight about IE7 and TDD. They admitted that the test-driven development we're doing is very interesting to them. With any luck, we'll get to rag on IE7 enough so it's actually better than Firefox.

Microsoft's Agenda at the Competitive Influentials Summit

They said I could blog everything about the conference I'm going to tomorrow, so let's see how far they're willing to go. A lot of folks have asked me what the agenda is, and until now - I've had no clue. However, today I was sent an e-mail and I'm happy to let y'all know what's going to happen. One thing I noticed is that the Word document's title was "Competitive Influentials Summit". Heh - I guess I'm an "influential" now.

I'm really looking forward to this event. I think we're really going to get wined and dined, and maybe even learn something. It'll be the first time in my life that someone will be picking me up from the airport with a "Raible" sign. I'm leaving at noon on Thursday to do a little St. Patty's day celebrating with my sister (it's her birthday), so I'll miss the "Open Source and Microsoft" session. Hopefully someone else will blog that so we see what they're thinking.

Firefox and the lack of a developer community

Joe points to some interesting news about Firefox. The part that struck a cord with me is Mike Griffin's post about free products and burn-out.

As a co-author of a free product myself I know the kind of burn-out issues these folks are going through. Most folks working on free products need real jobs to pay the bills. This means they work on these free products late into the evenings and on weekends if it's a product of any real worth.

At first the thrill of a new project and the recognition that goes with it carries you through those tiresome evenings. You are creating something new and there are no bean-counters around to mess everything up. However, as time goes on, as with most things, the thrill begins to wax and wane, and after months of getting no more than 4 hours of sleep per night it begins to affect your health. You get sick more often than you used to, and you're main goal quickly becomes to merely get through each day. And then there's the guilt of spending too much time on it, when the basement needs painting, things need fixed around the house, and you're not spending enough quality time with your kids (and when you do you're the walking dead so it doesn't count). Finally, and much to your surprise, the project doesn't really turn out to be the big career booster you thought it was going to be. In fact, perspective employers are hesitant to hire you when they find out you have a mistress on the side pulling at your time and resources.

In the end, it's a matter of commitment. You've created something folks have come to rely on and they need you, you cannot walk away from it. You realize how foolish you were thinking that it was all going to be good times and not tough times (like at work) and then you hunker down for the long haul. There are ups and there are downs, in the end you a providing a free product and you have to pace yourself. There isn't a day that goes by that I didn't wish my free product was my real and only job, but it isn't, and I knew that when we started it.

I couldn't have said it better myself. I've definitely experienced the "affects your health" part, but I can't agree with the career booster part. Maybe I've just been lucky, but I believe my extra-curriculars continue to help my career.

That being said, I'm burned out on both AppFuse and Spring Live at the moment. Luckily, I'm committed and will be able to find motivation for both of these projects in the near future. There are sooo many nights when I work on these projects and I'd much rather just go to bed or weekends when I wish I could goof off and play with the kids. The nice thing is that I can choose to do this stuff. Users may scream and readers may complain, but sanity and family must have a higher priority.

I've only stayed up late once in the last two weeks and I didn't touch the computer for more than 5 minutes this last weekend. With this week being a 1-day work-week (the rest being spent at Microsoft and on vacation), I should be rejuvenated and enthusiastic about working for free again soon.

Brian McCallister hits the nail on the head with his comment. For an open-source project to remain successful long-term, it needs a strong developer community. "A project with a truck number of two is in deep trouble." Seems like recruiting new developers might be more important than new releases. Something to think about...

Spring MVC vs. WebWork Smackdown at OSCON

Matthew Porter and I are going to try something a bit different at this year's OSCON. Rather than just getting up in front of the crowd and spewing our technical know-how, we're actually going to make a go at providing some entertainment. I've been to a lot of conferences and I'm tired of just watching someone talk - I'd rather see a good presenter over a knowledgeable presenter. This has inspired our OSCON 2005 talk:

This presentation has a unique delivery style. Rather than one person doing a comparison, there are two presenters - each which is an expert in the framework they're defending. The presentation is delivered as a friendly comparison/debate, which hopes to add some humor in to make it fun for the audience.

Java web developers often have a difficult choice when choosing a web framework these days. There are currently more than 35 open-source Java web frameworks available. How do you which one to use for your project? This presentation picks two of the most popular frameworks, Spring MVC and WebWork and compares and contrasts their features. Topics will include:

1. View options - i.e. Velocity, JSP, HTML Templates (ala XMLC), etc.
2. Testability - How easy is it to unit test with JUnit, with examples
3. Type conversion - i.e. Date, Integer, etc.
4. Validation - How do do it, stengths and weaknesses
5. Tools Support
6. Strengths and Weaknesses

Now the pressure's on - we have to both teach and entertain the audience. Please feel free to post your experiences with Spring or WebWork and why you think one is better than the other.

Display Tag being ported to Ruby/Rails

Found via Brian McCallister - a codefest grant has been awarded to Dave Tiu to reproduce the Display Tag in Ruby/Rails.

Codefest Grant recipients:

1. Ruby Displaytag (Dave Tiu)

A port to Ruby/Rails of a popular Java/Struts library for displaying
and interacting with HTML table presentations.

Maybe if I wait a little longer to write my first Rails app - they'll add client-side validation too.

Is Laszlo a waste of time?

According to Rife founder Geert Bevin, Laszlo ain't all it's cracked up to be:

It's a shame, I really had huge expectations about Laszlo and even tried to sell it to a customer. I'm glad that project was cancelled or I would be in deep trouble.

Under normal circumstances, I'd dismiss this as FUD, but Geert sounds like he did his homework on this one.

Simple Web Framework

You gotta admit, the Simple Web Framework does look interesting with all of the recent Ajax talk:

The Simple Web Framework (SWF) is an event based framework targeting Struts developers who want to build rich Web applications but do not want to migrate to JSF. The SWF is built upon the same Jakarta commons basis as Struts, but uses a different request processor (front controller.) The SWF event model supports form/submit style event posting, similar to VB.NET or JSF, as well as XmlHttpRequest based event posting with In place Page Updating (IPU) rather than page reloading, similar to the techniques underlying gMail. Read the SWF Overview for additional information.

My hope is that all web frameworks have some support for IPU by the end of the year. Then I won't have to build it into AppFuse.

Ajax webapps are cool, but non-javascript versions still needed

I think we can all probably learn a lesson from Google. I've heard that GMail is the "gold standard" for Ajax applications. If that's the case, then you should note that they've recently added a "basic HTML" link to the bottom of their pages. With this link, you can view your e-mail using the old way: Yahoo-style, no-JavaScript-needed. My guess is they added it because of demand, or simply to compete with other providers who have this feature. I think it's a good lesson though: use Ajax features in webapps where appropriate, but don't make JavaScript necessary to use your app.

A couple of Ajax features I've been thinking of developing:

• Saving forms with XMLHttpRequest: just display a success message at the top, and switch the "Cancel" button to "Done". Since the form's content doesn't change, this seems like a reasonable use of the technology.
• Switching out entire "content" <div> elements. Most of my apps have a <div id="content">, so it'd probably pretty easy to just replace that in response to button and link clicks. Of course, the hard part is having the requested server-side object load the view template, process it, and send back the content. This is probably more trouble than it's worth.

[TSSS] BOFs, Booze and Benitar

On Friday night, I attended all three of the 7:30 Birds of a Feather sessions. The first one I went to was Spring, where Rod talked about what's coming in Spring 1.3. Rod did a 25 minute presentation on the new stuff and then opened the floor up to Q and A. The session was well attended and I skipped over to the Tapestry/Trails BOF when the Q and A started.

I was surprised to find that very few folks where at the other BOFs. While the Spring BOF had 50+ attendees, the Tapestry one only had around 15-20 and JSF had around 8. I quickly left the Tapestry/Trails BOF when Chris started walking through his Trails Video. He was doing a live version of it, and since I'd already seen it, I figured I wasn't going to learn anything new. I've also been following Trails since it first started, and was more interested in talking about Tapestry.

I walked into the JSF BOF as Ed was talking about JSF 1.2 and what's next for JSF 2.0. This was good timing as I had a few suggestions for 2.0: HTML Templates like Tapestry, bookmarkability (don't make everything a post) and thinking about tools like Tiles and SiteMesh. While neither tools is part of the spec, I think they should be remembered in case there's an opportunity to make integrating with them easier. Ed did mention that JSF 1.2 has pretty much solved the content-interweaving problem, so putting HTML in your JSF JSPs should be better supported.

The very interesting part of this BOF is that Ajax capabilities are very much on the radar for JSF 2.0. They plan on providing native XMLHttpRequest capabilities. My suggestion for this was to provide the setup and registration of requestable class methods as part of the framework, and leave writing the JavaScript to the developer. This was a good BOF and I'm pumped to see that JSF is embracing the next-gen way of developing webapps. Let's just hope JSF 2.0 is released this year and not 2 years from now.

After the BOFs, I joined Matt and Jim to wait for one of Matt's buddies (Scott) to come into town. After he arrived, we headed over to the OpenSymphony open bar at the Bellagio. There, I got to meet Patrick Lightbody and enjoyed several beers and good conversation with the likes of Seth Ladd, Thomas Risberg, Mike, Dion and Christian.

After the open bar closed, Jim, Matt, Scott and I headed just off the strip to the Gold Coast Casino. Matt and Scott wanted to find some poker (tables had a 2-hour wait on the strip) and Jim and I wanted cheap Blackjack. We were pleased to find $5 tables and stayed there for several hours. I don't know what time we headed back to our hotel, but I'm guessing 1 or 2. The rest of the night was pretty funny. Jim and I gambled until 7 in the morning at several blackjack tables. Our hotel had this "celebrity theme", so we had dealers like Pat Benitar and Stevie Wonder throughout the morning. Both of these dealers were great and I got "hooked up" on several occasions. There were at least 10 times where I asked for a card and they didn't give it to me (after which I won b/c they busted). We ended the night at 7:00-7:30 with 5 crisp $100 bills in my pocket. Total cost of the whole trip: $100. Not bad eh?

Getting home yesterday was quite an adventure. After going to bed at 7:30, I woke up by some miracle at 11:00. I don't know if I had a wake up call or what, but my buzz was still in full swing. I caught a cab and headed to the airport. I paid the cabbie with a $25 chip, which he didn't like, but after I told him to keep the change (it was a $6 cab ride) - he happily obliged. At the airport, I took a nap while waiting for my flight to board and almost missed it. They called my name over the intercom b/c I was the only passenger left to board. Luckily, I was awake and made the flight. Upon arriving in Denver, I walked to my car and promptly locked my keys in the trunk. The airport officials got them out for free and I made it home to a very happy family around 6:00 p.m. It's good to be home.