Archive for March, 2008

I had to really lay into this movie in my review. I tend to write reviews for products that I’m impressed with and just keep quite on products that don’t really impress. This movie, however, was the exception. It got such good reviews on Amazon that I felt compelled to give it a look. The Internet Movie Database (IMDB) had some of the best information on this flick outside of Amazon. It didn’t make the mainstream movie reviews sites like since it never made it to the box office. 2 stars was probably a bit harsh, 2.5 would have been more appropriate. I felt the genuine need to remove this movie from the 5 star plateau though as this is genuinely deceitful. My Amazon review follows:

Already Dead

I really live or die by Amazon reviews. 99% of the time, they are spot on. I felt like I was burned a bit by the reviews on this one.

I should have been a bit suspicious when a movie that never even made it to the box office (mainstream, independent, or otherwise) was holding down a 5 star rating on Amazon. Some of the sites that I normally rely on for movie ratings didn’t even cover this movie since it didn’t get a lot of press and didn’t get any reviews by national or regional critics.

The majority of reviews that I read seemed held back on information so as not to give the “plot turns” away. Let me lay it out for you, there are no real plot turns so don’t hold your breath waiting for any. Once you get past the opening scenes and understand the premise of the film, it quickly degrades into a typical Hollywood action / adventure type flick. That said, this is no worse than a lot of the trash that Hollywood releases to fill the theaters during the peak summer movie months. In some cases (pick most any action film on installment 3 or greater), it’s actually better.

“Already Dead” is a 2-3 star movie that might be worth the low price you pay for the rental at Unboxed or your local retail outlet. Don’t go in expecting too much though. There’s a reason this didn’t get picked up for mainstream distribution.

Comments Comments Off on Already Dead

Having non-static machine keys when hosting on IIS is just one of those things that’s just bound to cause trouble eventually. This holds true equally for single server hosting environments and load balanced web farm environments. Especially if your goal is to shield your users from any knowledge of IIS lifecycle activities (e.g. application pool recycles), the use of static machine keys is to be strongly recommended. The implications of static versus dynamic keys are enumerated for several different hosting situations below:

Virtue of Static IIS Machine Keys

  • Single Machine – Most of the recommendations around machine keys involve synchronizing machine keys across multiple machines. There is, however, value in setting static machine keys for a single machine, single worker process environment. Quite simply, if machine keys are not static, the generation of a dynamic machine key for an IIS reboot or application pool recycle will cause any machine key related elements (e.g. view state) rendered before the event to be invalid. This will likely result in exceptions that will impact normal user processing.
  • Single Machine / Web Garden – The introduction of the Web Garden option to IIS can be viewed as the “poor man’s load balancing”. This option provides for a simple round robin routing across multiple worker processes, usually with each process owing affinity to a particular processor. Due to the simple load balancing approach taken, there is no option for web gardens but to synchronize machine keys. This is of course, unless you’ve managed to make your application completely stateless, in which case (congratulations) none of this advice applies to you.
  • Multiple Machines / Web Farms – The applicability of static machine keys to a web farm environment applies, theoretically, only to web gardens in which the load balancing approach does not guarantee server affinity. Once again, to avoid impacting user processing during load balance machine failover or due to recycles or reboots, I’d always recommend using static machine keys. Even when these areas are not concerns, I’ve found other troubles just seem to arise when you can’t guarantee static machine keys across machines. For web events regarding cryptographic exceptions or viewstate verification issues, I’ve found it best to start troubleshooting with synchronizing machine keys and then working down from there.

The definitive guide to configuring machine keys in ASP.NET 2.0, including .NET code for generating the keys, can be found here. Microsoft has never revisited their ruling that machine key issues can arise outside of web farms. Once again, if you’re observing cryptographic or viewstate errors, I’d advise that you start with static machine keys. If compiling and running Microsoft’s code to generate a machine key is asking too much, this online program will generate a key for you.

Finally, I’ve been asked a couple of times about the downsides of sharing static machine keys across machines. This depends upon what you use the machine key for. In most cases, I wouldn’t advise that you use the machine key for anything more than viewstate encoding. In this case, a machine key compromise will mean that someone can theoretically hack your viewstate. If they got your machine key, it also means that they have access to your web.config file, in which case you usually have bigger concerns than viewstate hacking.

Comments Comments Off on The Virtue of Static IIS Machine Keys

I’ve been contemplating the move towards a self-hosted Subversion repository for quite a while. My earlier attempts worked but left me with a lot of inconvenient and sometimes quirky side effects. These experiences always led me back to hosting Subversion on Linux, which is really where it works most naturally. Recently, however, I decided to retry my luck with Subversion hosting on Windows and I made the call to go with a “package” instead of doing the Apache / Subversion integration myself.


The tool that I went with, VisualSVN, is a Windows version of Subversion that targets primarily Microsoft developers using VisualStudio as their development platform. Matter of fact, the Subversion server package is freely distributed and the actual product that is sold is the Visual Studio plugin that allows you to tap into Subversion from Visual Studio. With a 30 day trial period and $49 price tag, I decided that it couldn’t hurt to try it out. My findings are below:

  • VisualSVN Server – The VisualSVN server, as mentioned earlier is a freely distributed product. You can get this piece of software whether or not you ultimately decide to buy and use the Subversion Visual Studio plugin. The server runs exclusively over HTTP / HTTPS (using OpenSSL) and does not support Subversion’s binary protocol or running Subversion over SSH. Obviously, this means that Apache is in play. A version of Apache is included in the distribution. Initial configuration of the server is very easy, the setup instructions describe the extent of it. As I blogged about previously, this changes a bit if you try to get Apache and IIS to run side-by-side. In this case, you need to be very explicit and tell the very greedy IIS to stop listening on other IP addresses so that port 80 can be shared by IIS and Apache. I included links to the Microsoft article in my earlier post. In this case, you’ll want to use httpcfg delete iplisten -i to stop IIS from listening on the port Apache is running on.

The folks who designed VisualSVN added some cool management functionality that shields the administrator from lower level Subversion commands. Implemented as a Windows MMC snap-in, Subversion repository administration be performed right alongside other server management tasks. The MMC enables one step creation of repositories (with or without the standard Subversion folder structure), creation of users and groups, and assignment of user privileges to repository actions.

  • VisualSVN Visual Studio Plugin – As useful as the server is, the real product is the VisualStudio plugin. The most recent version of this plugin works on VisualStudio 2008 so I thought I’d install it and give it a whirl. Installation is fairly easy. Both TortoiseSVN and the VisualSVN plugin must be installed. I don’t know exactly how VisualSVN communicates with Tortoise but it seems to make sense to leverage an existing Windows Subversion library rather than building everything from scratch. Using both the plugin and Tortoise gives you two ways to work with Subversion. In my experience with other Java IDE plugins (Netbeans and Elcipse), this is sometimes necessary to get around the shortcomings of the browser plugin.

Adding a project to VisualSVN using the plugin is, as it well should be, a relatively easy task. VisualSVN has some intelligence built in above and beyond the basicTortoiseSVN libraries. In my case, the plugin didn’t add my Visual Studio settings, binaries, or a bunch of MP3 and JPEG photos that represent content and really didn’t belong under source control. Other than that, a lot of the processing is just handed over to TortoiseSVN. The SVN UI presented by the plugin should all be pretty familiar to you if you’ve ever used TortoiseSVN before.

This looks to be my keeper for Subversion hosting. Now I need to port over my existing repositories into the VisualSVN server.

Comments Comments Off on VisualSVN