DNDJ 4-9.indd - sys-con.com's archive of magazines - SYS-CON ...

2 

September 2006 Volume: 4 Issue: 9 Visit us at www.dontnetdevelopersjournal.com

Visit us at www.dontnetdevelopersjournal.com September 2006 Volume: 4 Issue: 9 

3

Inside DNDJ 

GUEST EDITRIAL 

A Second Glance at SharePoint 

2007 Features 

By Kevin Hoffman ........................................................................................................7 

PODCAST 

Heard on Hanselminutes 

By Carl Franklin & Scott Hanselman ....................................................10 

Introducing C# Generics 

Leverage code reuse without sacrificing type safety 

By Robert R. Hauser 20 

METHODOLOGIES 

The Five Cs of Agile Management 

By Robert Holler ............................................................................................................18 

PROTOCOLS 

Exploring FTP in .NET 2.0 

By Alexander Gladshtein ....................................................................................28 

TOOLS 

Effective Database Change 

Management 

By Christoph Wienands .......................................................................................38 

Clean and Protect a Large .NET Code Base with 

Coding Standards and Unit Testing 

How to avoid runtime exceptions, instability, 

crashes, degraded performance and insecure 

backdoors 

By Hari Hampapuram and Matt Love 34 

MONKEY BUSINESS 

A Short History of Basic on Mono 

By Dennis Hayes .......................................................................................................... 42 

FIRST LOOK 

A First Look at Visual Studio 

2005 Code Snippets 

By Tommy Newcomb ...............................................................................................44 

4 


1min 

AJAX-enable any 

application 

2 min 

Reporting 

Solution 

ASP.NET 

UI Suite 

AJAX 

Framework 

WinForms 

UI Suite 

Step 1: 

Drag the AJAX Manager 

control on the WebForm 

Total time: ~ 5 sec. 

Step 2: 

Use the single dialog to set: 

• which controls initiate AJAX 

• which controls are updated 

with AJAX 

Total time: < 1.55 min. 

• No Previous AJAX Experience Needed 

r.a.d.ajax does not require any prior experience with AJAX. You don’t need to learn an “AJAX-specific” way of building new applications. 

• No Modifications to Your Application Necessary 

No need to place Callback Panels around areas that need to be updated. No need to set triggers or manually invoke AJAX requests. 

• Intuitive and Centralized Management of AJAX Relations 

All relations between controls which initiate AJAX and those that are updated with AJAX are managed from a single dialog. 

• Codeless Development 

Drag-and-drop the AJAX Manager control on the page, tick the respective checkboxes in the dialog, and hit F5. 

See r.a.d.ajax demonstrated at these events: 

(Santa Clara, CA Oct. 2–4) 

(www.ftponline.com/virtual/ajax/) 

Watch a video at: 

www.telerik.com/ajaxvideos 


5

4 

 

4 

 

 

4 

 

 

4 

 

 

 

 

 

 

 

 

6 


EDITORIAL BOARD 

dotnetboard@sys-con.com 

Editor-in-Chief 

Derek Ferguson derekf@speakeasy.net 

Group Publisher 

Jeremy Geelan jeremy@sys-con.com 

Mobility Editor 

Jon Box jbox@psgi.net 

Security Editor 

Patrick Hynds phynds@criticalsites.com 

Open Source Editor 

Dennis Hayes dennisdotnet@yahoo.com 

Product Review Editor 

Doug Holland doug.holland@precisionobjects.com 

VB Editor 

Keith Franklin keithf@magenic.com 

Smart Client Editor 

Tim Huckaby timh@interknowlogy.com 

BizTalk Editor 

Brian Loesgen brian.loesgen@neudesic.com 

ADVISORY BOARD 

dotnetadvisors@sys-con.com 

Derek Ferguson derekf@magenic.com 


Thom Robbins trobbins@microsoft.com 

John Gomez John.Gomez@eclipsys.com 

Scott Hanselman scott@hanselman.com 

Dean Guida deang@infragistics.com 

John Sharp johns@contentmaster.com 

Jacob Cynamon jacobcy@microsoft.com 

Chris Mayo cmayo@microsoft.com 

Gary Cornell gary@thecornells.com 

Joe Stagner joestag@microsoft.com 

Peter DeBetta peter@debetta.com 

Executive Editor 

Nancy Valentine nancy@sys-con.com 

Associate Editor 

Lauren Genovesi laureng@sys-con.com 

SUBSCRIPTIONS 

For subscriptions and requests for bulk orders, 

please send your letters to Subscription Department 

Subscription Hotline: subscribe@sys-con.com 

Cover Price: $6.99/issue 

Domestic: $69.99/yr. (12 issues) 

Canada/Mexico: $99.99/yr. Overseas: $129.99/yr. 

(u.s. banks or money orders). Back issues: $12/ea., 

plus shipping and handling. 

EDITORIAL OFFICES 

SYS-CON Media 135 Chestnut Ridge Rd., 

Montvale, NJ 07645 

Telephone: 201 802-3000 Fax: 201 782-9601 

.NET Developer’s Journal (issn#1541-2849) is 

published monthly (12 times a year) for $69.99 by 

SYS-CON Publications, Inc., 577 Chestnut Ridge Road, 

Woodcliff Lake, NJ 07677. 

Postmaster: Send address changes to: 

.NET Developer’s Journal, 

SYS-CON Publications, Inc., 

577 Chestnut Ridge Road 

Woodcliff Lake, NJ 07677. 

Copyright © 2006 by SYS-CON Publications, Inc. 

All rights reserved. No part of this publication may be reproduced or 

transmitted in any form or by any means, electronic or mechanical, 

including photocopy or any information storage and retrieval system, 

without written permission. For promotional reprints, contact Reprint 

Coordinator Dorothy Gil, dorothy@sys-con.com. 

Worldwide Newsstand Distribution 

Curtis Circulation Company, New Milford, NJ 

Newsstand Distribution Consultant: 

Gregory Associates / W.R.D.S. 

732 607-9941 - BJGAssociates@cs.com 

For list rental information: 

Kevin Collopy: 845 731-2684, 

kevin.collopy@edithroman.com; 

Frank Cipolla: 845 731-3832, 

frank.cipolla@epostdirect.com 

All brand and product names used on these pages are trade names, 

service marks, or trademarks of their respective companies. SYS-CON 

Publications, Inc., is not affiliated with the companies or products 

covered in .NET Developer’s Journal. .NET and .NET-based marks are 

trademarks or registered trademarks of Microsoft Corporation in the United 

States and other countries. 

SYS-CON Publications, Inc., reserves the right to revise, republish and 

authorize its readers to use the articles submitted for publication. 

A Second Glance 

at SharePoint 2007 

Features 

By Kevin Hoffman 

I 

have been guilty of underestimating the power of Features. 

It wasn’t really until I started digging deep into the bowels 

of the new Features and Solutions system in SharePoint 

2007 that I finally started to realize how pervasive this stuff is. 

At first glance, it’s extremely easy to make a sweeping generalization 

that Features are just a simple ability to add “stuff” in a 

couple of different locations throughout SharePoint. SharePoint 

actually does a really good job of hiding its own use of Features, 

which makes this misunderstanding all the more easy to make. 

When you create a new Feature, you essentially define a Scope 

at which that Feature will be visible, such as Web or Farm, etc. 

Within your feature, you define Elements. These elements are 

the key to expanding SharePoint’s capabilities. The following 

is a list of the types of elements that you can have in your 

Feature (each of these element types corresponds to an XML 

element in the element manifest for the feature, and you can 

have 0 to many of each element type): 

• List Template - defines the custom schema for a list 

• List Instance - indicates that when your feature is activated, 

the scope in which it was activated will contain an instance 

of a list 

• Module - defines a file set. If you create a feature that adds 

custom web part pages to an existing site, the module indicates 

the list of those files to add 

• Content Type - defines a custom content type within the 

feature 

• Field - defines a shared column that can be re-used by any 

list schema within that scope (including lists defined by 

your feature) 

• Workflow Type - defines a workflow that can be used at the 

site scope 

• Event - defines an event binding so that custom code you 

have created (possibly included in the module file-set) will 

be invoked upon given events in a given list. Event handlers 

can be bound to a specific list or to a content type. 

• Custom Action - defines a custom action, such as a new 

menu item in the administration menu or a new link in the 

“Site Actions” dropdown menu, etc. In addition to defining 

new custom actions, your feature can hide existing ones! 

• Delegate Control - A ridiculously powerful feature that 

allows you to essentially say “I’d like to replace this stock 

SP control with my own, add it to the queue of candidate 

controls for replacement”. This is exactly how Portal Server 

replaces the WSS search that comes with team collaboration 

sites 

About the Author... 

Kevin Hoffman has been programming since 

he was 10 and has written everything from 

DOS shareware to n-tier, enterprise Web 

applications in VB, C++, Delphi, and C. He 

is coauthor of Professional .NET Framework 

(Wrox Press) and co-author with Robert 

Foster of Microsoft SharePoint 2007 Development 

Unleashed 

http://www.amazon.com/exec/obidos/ 

ASIN/1861005563/billsatlcomnote/104- 

7254258-0048761 

Guest Editorial 

– CONTINUED ON PAGE 27 

tlamot@sbcglobal.net 


7

Book Review 

Amazon.com Top 10 .NET Books 

10 

9 

8 

7 

6 

5 

MCAD/MCSD 

Self-Paced 

Training Kit: 

Developing Web 

Applications with 

Microsoft Visual 

Basic .NET and Microsoft Visual 

C# .NET, Second Edition 

Microsoft Corporation 

Hardcover 

Debugging 

Applications for 

Microsoft .NET 

and Microsoft 

Windows 

Robbins, John 

Hardcover 

735619271 

Microsoft .NET 

XML Web 

Services Step by 

Step Freeman, 

Adam Paperback 

Test-Driven 

Development 

in Microsoft 

.NET (Microsoft 

Professional) 

Newkirk, James 

W. 

MCAD/MCSD 

Training Guide 

(70-320): 

Developing XML 

Web Services 

and Server 

Components with 

Visual C# .NET and the .NET 

Framework 

Amit Kalani 

Enterprise 

Solution Patterns 

Using Microsoft 

.Net: Version 

2.0 : Patterns & 

Practices 


4 

3 

2 

1 

Programming 

Microsoft 

Windows Ce 

.Net, Third 

Edition 

Boling, Douglas 

MCAD/MCSD 

Training Guide 

(70-315): 

Developing and 

Implementing 

Web Applications 

with Visual C# and Visual 

Studio.NET 

Kalani, Amito 

Programming 

Microsoft Visual 

Basic .NET 

Version 2003 

(Book & CD- 

ROM) 

Balena, Francesco 

MCAD/MCSD Self-Paced 

Training Kit: Microsoft .NET 

Core Requirements, Exams 

70-305, 70-315, 70-306, 

70-316, 70-310, 70-320, 

and 70-300 


PROVIDED BY 

President and CEO 

Fuat Kircaali fuat@sys-con.com 

Group Publisher 


ADVERTISING 

Senior Vice President, Sales and Marketing 

Carmen Gonzalez carmen@sys-con.com 

Vice President, Sales and Marketing 

Miles Silverman miles@sys-con.com 

Robyn Forma robyn@sys-con.com 

Advertising Sales Manager 

Megan Mussa megan@sys-con.com 

Associate Sales Managers 

Kerry Mealia kerry@sys-con.com 

Lauren Orsi lauren@sys-con.com 

PRODUCTION 

Lead Designer 

Abraham Addo abraham@sys-con.com 

Art Director 

Alex Botero alex@sys-con.com 

Associate Art Directors 

Louis F. Cuffari louis@sys-con.com 

Assistant Art Director 

Mandy Eckman mandy@sys-con.com 

WEB SERVICES 

Information Systems Consultant 

Robert Diamond robert@sys-con.com 

Web Designers 

Stephen Kilmurray stephen@sys-con.com 

Paula Zagari paula@sys-con.com 

ACCOUNTING 

Financial Analyst 

Joan LaRose joan@sys-con.com 

Accounts Payable 

Betty White betty@sys-con.com 

Accounts Receivable 

Gail Naples gailn@sys-con.com 

SUBSCRIPTIONS 

201 802-3012 

888 303-5282 

subscribe@sys-con.com 

CUSTOMER RELATIONS 

Circulation Service Coordinator 

Edna Earle Russell edna@sys-con.com 

8 


BPEL is the 

SQL of SOA 

Get started building next-generation 

SOA applications with the leading vendor of 

BPEL technologies 

Download BPEL tooling & server software today 

 

BPEL consulting, certification and training. 

BPEL design tools, servers and source code for Eclipse, Apache Tomcat, JBoss, 

WebSphere, WebLogic, BizTalk and Microsoft .NET. 

activeBPEL 

Copyright 2006 Active Endpoints, Inc. All Rights Reserved. 

All product names are trademarks or service marks of their respective companies. 


9

Podcast 

Heard on Hanselminutes 

Interview with Web developer and technologist Scott Hanselman 

Hosted by Carl Franklin 

About the Authors… 

Carl Franklin has been a fi gurehead in the 

VB community since the very early days 

when he wrote for Visual Basic Programmers 

Journal. He authored the Q&A column of that 

magazine as well as many feature articles for 

VBPJ and other magazines. He has authored 

two books for John Wiley & Sons on sockets 

programming in VB, and in 1994 he helped 

create the very fi rst web site for VB developers, 

Carl & Gary’s VB Home Page. He now 

teaches hands-on VB .NET classes for 

his company, Franklins.Net. He has taught 

developers from Citigroup, Aetna, Fidelity 

Investments, Fleet Bank, Foxwoods Casino, 

UTC, Hubbell, Microsoft, Mohegan Sun 

Casino, Northeast Utilities, to name a few. 

Carl is co-host of a weekly talk show on his 

website for .NET programmers called .NET 

Rocks! Carl is MSDN Regional Director for 

Connecticut. 

carl@franklins.net 

Scott Hanselman is chief architect at the 

Corillian Corporation, an e-fi nance enabler. 

Recently, Scott was in the top 5% of audience-rated 

speakers at Tech-Ed 2003. His 

thoughts on the Zen of .NET, programming, 

and Web services can be found at http:// 

www.computerzen.com. 

scott.hanselman@authors.sys-con.com 

Hanselminutes is a weekly 30-minute podcast 

with Web developer and technologist Scott 

Hanselman and hosted by Carl Franklin. 

The following is a transcript from show number 29, 

entitled “Dynamic vs. Compiled Languages”. You can 

listen online at www.hanselminutes.com. 

Carl Franklin: Today we are doing a show on Disruptive 

Technologies. What do you mean by that 

exactly? 

Scott Hanselman: Well, I think the disruptive technologies 

are the ones that come along every few 

years, and remind us that maybe the way we are 

doing things is a little more difficult than it needs to 

be, spending a little more time on things that aren’t 

as important. I think that Ruby is a good example, 

particularly Ruby on Rails, of something that’s come 

along and reminded us that development on the 

Web really doesn’t need to be this complicated. Now, 

we spend a lot of time as .NET developers suffering 

in the ASP - early, early, early ASP.NET years - and 

things are coming along that are disrupting the way 

we think. People are moving away from complex 

Web applications to simpler patterns, and I think 

that Ruby and Ruby on Rails, and the success of 

those technologies, are worth exploring, but not just 

because it’s something interesting that’s not Microsoft 

- because most people who listen to this show 

are Microsofties, meaning in some way Microsoft 

and .NET pay our mortgages. But as .NET developers, 

what can we learn from Ruby and Ruby on Rails 

that we can apply to our lives? 

Carl Franklin: Okay. 

Scott Hanselman:This doesn’t mean we should 

necessarily jump ship, but you are writing code - for 

example, the code that you used to manage Hanselminutes 

and the shows that you work on. It’s all 

written in ASP.NET, right? You can have an administrative 

counsel, it’s mostly using what we call CRUD 

- Create, Read, Update, Delete. I mean how much 

code did you use for the Hanselminutes admin? 

Carl Franklin: Not a lot of code. 

Scott Hanselman: Couple of thousand lines, couple 

hundred line? What do you think? 

Carl Franklin: Oh! Couple hundred lines. Really, 

not a lot of code at all. 

Scott Hanselman: So, you use a lot of DataGrids, 

Data Binding, and things like that. 

Carl Franklin: Exactly. 

Scott Hanselman: Did you write a lot of stored 

procedures? 

Carl Franklin: Just a few, yeah. 

Scott Hanselman: You are doing code generation? 

Carl Franklin: No. 

Scott Hanselman: So, there is an example a middle 

of the road .NET application that does some Creates, 

Reads, Updates and Deletes. You probably used a lot 

of wizards; you took advantage of as much as .NET 

as possible, and being that you are a trainer on this 

kind of stuff, you are not going to waste your time 

writing code that already exists. 

Carl Franklin: Exactly. And for us, the only people 

who have to use it are in-house, maybe three, or four 

people, and usually only one at a time. 

Scott Hanselman: Sure. So it doesn’t need to necessarily 

be pretty, but it is very functional. I mean I’ve 

used it and I have done administration on the show, 

so its not that big of a deal, but it’s a good example of 

the 80% example. It’s the adding of information to a 

system, retrieving it, looking at it, sorting it, adding 

details. If you were going to do something like an upgrade 

to it, you would probably do it manually. You’d 

change the schema and then you would change the 

code and it would work just fine. Now, in the .NET 

world, when you go File/New/Web Application 

you get a blank page. Hello World is really the start 

when you go File/New/ASP.NET Application. In the 

Ruby on Rails world, you get a little bit more. Rails 

assumes that you are probably going to be talking to 

a database, and has a thing called Scaffolding. You 

basically say, “I want to scaffold out an application”, 

and when you run scaffolding after installing Ruby 

on Rails, and maybe something like MySQL, you sit 

down and you basically go and say, rails (space) and 

then if I wanted an application called Foo, I’d say, 

rails (space) Foo, and I would get a whole application 

created for me, an empty Web application that 

would run under really any Web server. But typically, 

you can run it under either their built-in Web server, 

10 


SUPERCHARGE 

YOUR APPS WITH 

THE POWER OF 

LOCATION 

INTELLIGENCE 

Enable Location Intelligent web services 

Single environment for deployment 

to desktop or web 

Full integration with VisualStudio .NET 

Create applications for: 

• Web-based store/asset location finders • Visualizing where your customers are 

• Analyzing where revenue comes from – and where it doesn’t • Managing assets such as cell towers, vehicles and ATMs 

Try it and see for yourself. Visit www.mapinfo.com/sdk 

Learn more about the MapInfo Location Platform for .NET, 

access whitepapers and download free SDKs. 

Contact us at sales@mapinfo.com 


11

Podcast 

or under something like Apache. When you start it 

up, you basically get a Hello World page that says, 

“Congratulations, you are on Rails.” 

saying debug=falls - do you indicate that now I am 

developing, now I am testing, now I am in production? 

Carl Franklin: That reminds me of the Visual Basic 

Application Wizard. 

Scott Hanselman:Right, it gives you a lot more I 

think than we are really used to getting. I think 

that… 

Carl Franklin: But is it good? Is it good code? Is it 

typical wizard output, or is it something that is actually 

sustainable? 

Scott Hanselman:: Well, so here’s the thing that’s 

so interesting about Rails. They have a philosophy, 

which they call Convention over Configuration, we 

talked about this a little bit in a previous show as a 

philosophy that we like to apply to .NET code, but 

they have a lot of conventions, they say that stuff 

goes in the config folder, and we have a folder called 

“Test” and we have a folder called “App” you can’t 

change those, right that’s what the folder’s name is. 

And this is the generalization, but in a .NET application 

you typically have some app -- config file where 

you could overwrite that; the name of that directory 

as this, or I want this file to be over there. They say, 

no, we are going to really focus on convention. 

Carl Franklin: Standardize that stuff. 

Scott Hanselman: Exactly, one less thing to worry 

about. Now, the code that gets generated, what’s 

interesting about it is that there is so nothing 

there - it’s incredibly simple. And what really 

makes Rails work is that; it understands how 

the software development process should 

work. For example, when you are dealing 

with a database, you typically have a development 

database, maybe a test one for running a unit test 

and a production one. With .NET there is really no 

built - in way that knows that this is the case, right? 

You typically will have different connections strings, 

right? Of a connection string that you would modify 

in a Web.config. In Rails they have a thing called 

database.yml file, it’s basically like in .ini file, and 

within that you indicate different environments, you 

can say, “Well I am going to use the MySQL adapter 

during development to talk to this database on the 

local host with this name and password, but when 

I go to test I will run over here, and when I go to 

production I’ll be using this different adapter.” So, 

it actually knows that there are different modes, it’s 

built that in. So, there is just an example where the 

way that development is done in software, it’s built 

into the application itself, so the whole framework 

knows that this is how things happen. 

Carl Franklin: Well there is plenty of that stuff in ASP. 

NET I would argue. 

Scott Hanselman: Where in ASP.NET - other than 

Carl Franklin: No, no, no that’s not what I meant. I 

meant the kind of nice extra things such as the ability 

to just drag a table from data, and have an editable 

grid that’s a nice high-level feature. The connection 

strings in the config file is a standardized way, the 

personalization, I mean there is a lot of high-level 

features in ASP.NET especially 2.0 that you could 

consider falling into that same camp of extra stuff. 

Scott Hanselman: Okay, let me rephrase then. It’s 

a good point. There are lots of things in ASP.NET 

that make development easy, but I don’t think there 

are necessarily a whole lot of things that make the 

development process easy: migrations, for example. 

When you migrate from one version of an App to 

another version of an App, right? 

Let’s say I build an application, I make a table with 

people, and I have got a first name column, and a 

last name column. And I have got an object that I am 

going to be storing in that column. Within ASP.NET, 

I might create a class Person and he has first name, 

and a last name and then I might take that user and 

maybe I will use something like NHibernate. But not 

a lot of average-Joe developers use tools like that, that 

are Object Relational Mappers, and typically, they will 

write the Data Access Layer themselves, right? And 

they will take that object apart, and make sure that 

the object gets put into the table appropriately. So, 

then the application changes. I have to modify the 

schema, right? So, I’ll go into SQL, modify the schema 

and then generate a SQL file that I have to remember 

to run on the production database to alter that table 

and add a new column, and then I have to go into my 

code and then tell it that there is new middle name 

field that’s going to be added to our Person table, and 

then update my Data Access code to put that middle 

name in there. So, it’s not hard, its just detail oriented. 

There is a lot of stuff there. 

Within Rails there is this notion of Migrations, 

where you make a change and it keeps track of what 

is going to be required to get you from this state, like 

version 1.0, to this state version 1.1. So, all of this is 

being handled by a thing called ActiveRecord. And 

ActiveRecord would let you do things like, class 

project and then you could say, something like 

drives from ActiveRecord and a project belongs to a 

portfolio and a project has one Project Manager, a 

project has many milestones. It sounds like I am just 

reading English that’s kind of what Ruby looks like 

when you are using ActiveRecord. You might have in 

the database the description of what a project looks 

like and you just write your class like that. I mean 

the class project might be five lines just exactly 

as I described it - you would literally write down 

“class project has one project manager”. And those 

relationships then get managed by this ActiveRecord 

12 



13

Podcast 

system. And it handles the persistence of that tune 

from the database because Ruby is such a dynamic 

language it handles it. So, if I wanted to migrate from 

one version of my application to another, I can automatically 

just generate the migration by describing 

what’s changed, by making a change and saying, 

“All right I will go from this version, to that version.” 

And it will handle it for you. It also keeps track of 

irreversible migrations when I move forward, but I 

can’t back up. There is one of the other things that 

Rails allows you to do is say, “I want to roll back, I 

just made a goof. I added something to my database. 

I have changed my application, but it was a bad 

idea. I need to push the easy button and roll back 

everything automatically.” 

Carl Franklin: So, Scott, the next question that comes 

to my mind is, are these features that Microsoft if 

they were listening, could say, “Hey that’s a good 

feature we will add that in the next ASP.NET”, or is it 

more indicative of the dynamic nature of Ruby that 

these features become possible? 

Scott Hanselman: I think you have absolutely nailed 

it right there. You have asked both the right questions. 

Is Microsoft going to move towards this, and 

definitely I think that this is a computer science 

thing that’s happening, not necessarily a Microsoft 

thing. Everyone’s headed in this direction where we 

are -- we have had this schizophrenia, right? Thirty 

years ago, you have your Smalltalk folks that have 

got this very dynamic world and then C++ and C 

start getting more static typing. C++ starts making 

decisions about how inheritance works. C# says “all 

right, we don’t allow multiple inheritance.” Things 

get stronger and stronger typed. So, in the Windows 

world we are kind of having the screws tightened on 

us. So, over the last kind of 15-20 years, the screws 

have been tightened and the developers are dealing 

with it, right? To mix my metaphors, right? You know 

how to boil a frog, right? 

Carl Franklin: Yeah you put him in cold water and 

turn up the heat slowly, right? 

Scott Hanselman: So, why do you think that people 

are so excited about JavaScript and AJAX and about 

PowerShell, because suddenly there’s all the power 

of .NET, and all the freedom of a dynamic language 

is kind of coming out. So, I think that, yes, part of it 

is that Ruby is such a dynamic language, but I think 

if you take a look at C# 3.0 like at shrinkster.com/hei 

you are going to see that Anders and a few folks that 

are designing C# are adding this dynamicism ? 

Carl Franklin: Dynamism… 

Scott Hanselman: That too (laughs). They are adding 

that to C# 3.0 and they are making that happen. And 

its technologies like LINQ at shrinkster.com/heh and 

that are making that possible, right? Where you can 

have all of the benefits of a compiler, but also some of 

that dynamic behavior that you see in an interpreted 

language. And this is a really interesting question, 

what is limiting this technology in the Microsoft 

world right now? And I think it’s the fact that underneath 

VB, and underneath C# there is that IL, right? 

Carl Franklin: Right. 

Scott Hanselman:There is that compiler. What do we 

lean on? What do we count on? Well, C++ programmers, 

they really count on the compiler. I don’t have 

a lot of bugs, or I know that nothing horrible is going 

to happen, because the really, really strict compiler 

told me it was cool. Right? They know that something 

horrible is wrong before they run because the 

compiler catches it. But there were some dynamic 

language aspects that VB 6.0 had (variants) that you 

really didn’t know the behavior until you actually run 

it. So, they moved that responsibility out of the compiler 

a bit, but where’d the responsibility go? They 

took 20% of the responsibility out of the compiler. 

There weren’t a lot of unit tests, I didn’t want to use a 

lot of unit tests in VB 6.0, did you? 

Carl Franklin: No, there wasn’t even such a thing 

really. 

Scott Hanselman: Exactly. So, then about 20% of 

the “responsibility” -- this theoretical responsibility, 

of who is going to check stuff - kind of fell 

on the floor. That got picked up when we moved 

into the .NET world, where we had really strong 

compilers, but also some dynamic aspects of 

things with Reflection and with Late Binding 

that allowed us to do things that could get us in 

trouble, but we picked that ball up with Test-Driven 

Development. So now we lean on the compiler 

half-way and on the tests half-way. 

Carl Franklin: So, you are saying with test driven development, 

or even just you are running nUnit, for 

crying out loud, we are, we can now -- variants aren’t 

evil anymore, is this what you are saying? 

Scott Hanselman: That’s a good way to put it sort of 

like an inflammatory way to put it, but you are right. 

Carl Franklin: I am trying to eek out the truth here… 

Scott Hanselman: No, you are right, because what I 

am saying is that, dynamic languages are less evil if 

you have a parachute, right? 


Scott Hanselman: So, our parachute in C++ was a really 

hardcore compiler that wouldn’t let us get away 

with anything. 

Carl Franklin:Yeah. 

Scott Hanselman: And we had a less of a parachute 

in VB 6.0, and this is why you get object reference 

not set. 

14 


Carl Franklin: Yeah. 

Scott Hanselman: All the time, with all VB applications, 

right? This is because… what does that really 

mean, what does an exception mean? If you get an 

unhandled exception in your application it means, 

something happened that you weren’t ready for, 

something exceptional happened, something you 

didn’t expect occurred. Now, in a dynamic language 

I can write a Ruby application and I can hit save, 

and no one is going to do anything, no one cares 

that I have syntax errors all through it. So, it’s on me 

to then fill it up with better testing. So, what I am 

saying is that, really awesome tests within an interpreted 

dynamic environment can actually take the 

place of the compiler because all the compiler does 

is syntax checks, your intent. 


Scott Hanselman: But a test is a really great way of 

expressing your intent. 

Carl Franklin:And it goes beyond the compiling 

stage, it actually looks for results. 

Scott Hanselman: Exactly. 

Carl Franklin: Yeah. 

Scott Hanselman: So, then someone could really get 

some real good work done. If they had a language 

they had a really great compiler, but also a flexible 

enough syntax that would let them do the kinds of 

things like ActiveRecord that one would want to do, 

in a per format way and then they could built tests 

around it, and they have the best of both worlds and 

I think that five years from now, we are going to see 

a very Ruby-esque C Sharp and a very Ruby-esque 

VB, as people start to realize that Smalltalk has had 

these kinds of features for 30 years, and we have 

been kind of off in the desert, in our strongly typed 

hardcore compiler languages. We are going to find a 

very dynamic middle ground that’s going to involve 

very few lines of code. So, what are some examples 

of ActiveRecord and/or Rails in the Microsoft world? 

Carl Franklin: Well before you answer that question, 

let me ask this, which maybe on the listeners’ mind 

also: What if you are not embracing Test-Driven 

Development? 

Scott Hanselman: Wow, be afraid… 

Carl Franklin: And not everybody does. 

Scott Hanselman:: Well everybody should! 

Carl Franklin:But they won’t! 

Scott Hanselman: And that will mean more work 

for you and me. Let me give you an example. I had 

an intern this summer - I wanted to actually get 

him on the show but it didn’t work out- and we 

gave our presentation to everybody, and he worked 

on an ASP.NET application. They did some online 

Banking stuff for some things that I am working on 

which I can’t talk about. This is a sixteen-year-old 

sophomore in High School, okay? The guy’s never 

coded C# before, he has had a little bit of Java in 

High School, he did a little VB 6.0, and he played 

with Ruby once, or twice. In 30 working days, he 

put together a nice clean online banking site, where 

someone could log in and pay their bills. Now 

how did he accomplish this? We used test-driven 

development; we used Watir; we used the Web application 

testing in Ruby for all of our tests; and we 

used Test-Driven Development. He wrote 168 tests 

in Watir that would just beat on this thing, most of it 

with negative testing. 

This is a guy who has no computer science background 

- he is a 16-year-old kid who just thought 

about, “What would someone evil do to try to break 

my application?” So, he had hundreds of tests that 

would put garbage in textboxes, try to transfer too 

much money, or just fight with the application. He 

pounded on it like only a 16-year-old could. And we 

ended up with more code in our tests than we did 

in our application because the goal was, for the application 

to do exactly what it needed to do, and no 

more, and allow the only correct input. 

When he coded in this style, he ended up with 

a lot of work in the tests, but then that test 

became his parachute. Then we have to go 

and do some refactoring. After we gave the 

presentation he had a few hours before the 

end of his summer, and we had a bunch of 

requirements, they said “We need these 

things changed”, he said, “Oh man I don’t 

want to change this application, it’s going 

to break everything.” and I said “No, it’s 

not, you’ve got a 168 tests that will make 

sure you know immediately if anything 

is broken.” And we were right. That 

sense of confidence of, ‘Wow I can 

refractor this,’ we cut another 100 lines 

out of the application and the 168 

tests passing were our confidence 

that this thing works, not just that it 

compiles because compiling just says the syntax is 

right, but the intent, the semantics, were correct. 

Carl Franklin: Well, Scott that’s a very good argument 

why people should use and embrace Test Driven 

Development. However, there are those people that 

won’t simply because it’s not required. 

Scott Hanselman: Yeah I understand what you are 

saying. And they’ll have buggy code. 

Carl Franklin: Well the question is, will it be buggier 

with a dynamic C# and a dynamic VB? 

Scott Hanselman: Yeah, here’s an example. Let’s say I 

wrote some test scripts … to work on an application 

and let’s say that you’re going to write it in an application 

that has only object, totally dynamic. 

Podcast 


15

Podcast 


Scott Hanselman: And then I’ll write it in C# and our 

test will run against both applications. 

Carl Franklin: Yes. 

Scott Hanselman: Right? So, the exact same tests 

we’ll do the exact same stuff to a browser, and the 

App just happens to be written in two different -- totally 

different languages. As long as all 100 and some 

odd tests pass, does it really matter? What language 

it was written in? 

Carl Franklin: Okay, now take away the tests. 

Scott Hanselman: There you go; if the tests weren’t 

there we can’t know. 

Carl Franklin: Right. So, the question is if you have a 

dynamic language that’s set up to allow this kind of 

variant behavior… 

Scott Hanselman: Exactly, yeah that’s a good point. 

Carl Franklin:…does it put -- does it make it a liability 

not to use Test-Driven Development? 

Scott Hanselman: I think it does, that’s a good point. 

So, doing Dynamic development -- doing development 

in a dynamic language without a lot of tests 

could potentially open you up to a lot of weird data 

typing, conversion type of errors. That’s why I think 

that negative testing is so important. 

Scott Hanselman: Right? Every few years we go and 

we see the big DataGrid presentation. 


Scott Hanselman: Except this year… we dragged the 

DataGrid over and it did AJAX, okay? With things like 

BLinq, B-L-I-N-Q at shrinkster.com/heg, which is 

the closest thing to Rails on ASP.NET that Microsoft 

has come out with. 


Scott Hanselman: Let’ssay you basically dynamically 

generate an entire ASP.NET Website for 

displaying, creating data, doing all CRUD type 

data based on a database schema without writing 

any code at all. So, there is not even any dragging 

around, I mean they don’t even go into – you don’t 

even have to go to Visual Studio. You just say “Do 

it,” and it happens. 

Carl Franklin: Wow! 

Scott Hanselman: So, I think when people see that 

we could go and rewrite the Hanselminutes Admin 

with a tool like this BLinq prototype - once people 

see that if they don’t move, then they don’t move 

forward - then maybe that’s not what they wanted, 

right? Microsoft is trying to make products to make 

life easier. If Microsoft doesn’t do it somebody else 

will and people will say ooh… I want that. 

Carl Franklin: So, then that brings us to the other 

conclusion, which is if you do not -- if there are more 

people not doing Test Driven Development, than 

doing Test Driven Development, are they not going 

to move to the new dynamic languages and… stay 

with the old version of .NET. 

Scott Hanselman: There were too many nots there; I 

got confused… 

Carl Franklin: In other words, let’s say 65% of the 

development going on does not use Test Driven 

Development, which -- it’s even more than that. 

Scott Hanselman: Oh, I am sure it’s lots. 

Carl Franklin: Right. So, C# 3.0 comes out VB.NET 

17.0 whatever it is, comes out and they are both dynamic 

languages; is that going to keep people from 

upgrading to the new version, possibly of a new 

framework, of a new language? 

Scott Hanselman: That’s a good question. I think 

that the beat marches on, right? Things continue 

to move forward. The issue is that when you go to 

a Microsoft presentation every three or four years 

they sit down with the Northwind database. They 

drag a DataGrid over and they say, “Look what I did 

without writing a single line of code.” They’ve been 

doing this for 15 years. 

Carl Franklin: Sure. 

Carl Franklin: …I don’t know if that’s a strong 

enough argument for me but we’ll see. 

Scott Hanselman:That’s a very good question. 

Carl Franklin: Basically, what it means is that people 

are being forced into Test Driven Development, and 

will they go? So, it would be interesting to see. 

Editor’s Note. By “Test-Driven Development”, Carl 

means “Test First” which is the most extreme form 

of TDD. 

Scott Hanselman: Well, let me ask you this, then. 

Here’s a better argument. Were people forced into 

using Source Control, when Microsoft started giving 

away Visual SourceSafe? Before anyone in the Windows 

world was using Source Control - they were using 

Source Control in the Unix world - but Microsoft 

people would just zip up their files and say, “Here 

you go, that’s the version for today” and I’ll zip it up 

and put it over on a share. 

Carl Franklin:Yeah. 

Scott Hanselman: People are going to use Test-Driven 

Development because, 

a. It’s free and, 

b. It works. 

Carl Franklin: Once you experience it. So, you think 

there will be a competitive advantage to being Test- 

Driven? 

16 


Scott Hanselman: Oh yeah. Let me give you an example, 

there is a shareware developer who had some 

applications that I installed because… if it exists I’ve 

run it and installed on my machine at least once and 

I went to -- I had some trouble with it so I emailed 

him, and you know what he said, it’s amazing. He 

says, “Go to the Help about” I am like “Okay, Help 

about” and he says, “You see a button there that says 

‘Run tests’”. He actually ships his nUnit tests, and in 

the Help about menu hid an nUnit runner. So, he 

actually shipped them and I ran his entire test suite 

on my machine, which let him see if the environment 

that I was running on would pass his tests and 

one of the tests didn’t pass because he had made an 

assumption about a path. 

Carl Franklin: Neat. 

Scott Hanselman: What a brilliant way to do production 

time debugging. 

Carl Franklin: There’s no doubt about it that when 

you reach the end of a life cycle of an application 

built with Test-Driven Development you’ve got a superior 

product. I guess the people on the other side 

of the camp -- and I am not taking a position either 

way-- I am saying the people on the other side of the 

camp say, “Well, if you live in an ivory tower world, 

where there’s an infinite amount of time and money 

to develop, great, but for the rest of the real world 

people out here we’re trying to build apps as fast as 

we can, as most stable as we possibly can.” 

Scott Hanselman: Right. Well, let me give you one 

more argument, and then we’ll do a couple of links 

and move on. 


Scott Hanselman: So, you can express the business 

requirement in a simple test, right? The requirement 

is they must be able to read a record, change it, and 

save it and these conditions will be met. You can say 

that in English - or any language for that matter. You 

can say it in prose and write it in a Word document. 

But as I’ve said before, a Word document doesn’t 

have any teeth, right? Word documents don’t break 

builds. Exceptions stop applications, but Word documents 

don’t actually do anything; but if I can write a 

test in a very simple straightforward way that says, 

“This is my intent”, right? We spent so much writing 

code to express our intent. But, we’re expressing that 

intent to the computer, right? But the computer is 

not the customer here; the customer is whoever has 

hired me to write this application. 

Carl Franklin: Sure. 

Scott Hanselman: So, my tests are the best description 

in computer language of what that person’s 

intent is. So, if you look at Test-Driven Development 

as a way of translating that person’s intent into 

something the computer understands and then also 

proving that the requirement is met. You can look at 

all of those green bars that light up in nUnit telling 

you that your application works well. That’s basically 

saying, “My requirement was met for this application.” 

And if you look at it that way, you’ll spend less 

time writing specs because specs aren’t useful, right? 

Specs can’t test my application, only tests can. So, 

that might be a better argument. 


Scott Hanselman: One other thing I wanted to 

mention was that, we are talking about Rails -- what 

it was like to have Rails, and/or ActiveRecord on 

Windows. 


Scott Hanselman: There’s something worth checking 

out called the Castle Project. You can take a look at 

shrinkster.com/hen. A Castle is a set of tools-- you 

can work with them together or you can use them 

independently-- that let’s you… integrate your applications 

[better] and the really interesting ones are 

MonoRail. MonoRail - they used to call it Castle on 

Rails – is basically Rails for ASP.NET. It’s a different 

style, it’s more of a Model-View-Controller, what 

they call MVC, or action-packed way of doing things. 

There is an interesting explanation about how it 

works, why you might want to do it, why it would 

be useful, if you like Rails you might check that 

out. But the most interesting thing I think is 

a layer that sits on top of nHibernate, right? 

nHibernate is the Object Relational Mapper, 

that let’s you take objects and map them with 

XML or relationship files into the database. 

This is a version of ActiveRecord and the 

ActiveRecord pattern for .NET. It’s built on 

top of NHybernate but it frees you of all 

that XML tediousness. 

Carl Franklin: All right, so a couple more 

-- we’ve got time for a couple of more 

links. 

Scott Hanselman: Sure, yeah. If you 

want to check out Blinq, which is B-L-I-N-Q, 

there’s a really good tutorial at Arstechnica at shrinkster.com/hej 

and then FTPOnline has a great tutorial 

from last month before last on how to use Blinq at 

shrinkster.com/hek and again you can download 

Blinq at shrinkster.com/heg and then do check out 

the Castle project-- It’s a really interesting way to 

think about things. It’s different from ASP.NET. It’s 

not how you are used to doing Web applications and 

that might be a good thing-- at shrinkster.com/hen. 

• • • 

You can listen to this entire show at http://shrinkster. 

com/hxg 

Podcast 


17

Methodologies 

The Five Cs of Agile Management 

Courage, context, course, cadence, and cost 

By Robert Holler 

About the Authors 

Robert Holler is president & CEO, Version- 

One LLC, a developer of .NET-based Agile 

planning and management software. 

robert.holler@authors.sys-con.com 

Anyone who has ever been responsible for 

leading or managing a software development 

project knows that software isn’t easy. 

Successfully coordinating and dealing with project 

sponsors, customers, unexpected risks, and changing 

scope challenges even the most experienced 

project leader. 

Over the last decade, several methodologies 

(such as Extreme Programming, Scrum, Crystal, 

Feature-Driven Development, DSDM, and Lean 

Development) have emerged to help companies 

effectively deal with projects incorporating tight 

deadlines, volatile requirements, and/or emerging 

technologies. Applicable to a wide variety of today’s 

software projects, these agile approaches have 

gained tremendous industry momentum due to 

their overall simplicity and laser focus on business 

value, accelerated delivery cycles, and ability to 

adapt to changing business demands. 

Leading projects in an environment that embraces 

change and rapid delivery can be a daunting 

responsibility in any organization. Companies and 

individuals with the desire to change the fundamental 

rules of the software game and accept the 

empirical nature of software development are 

faced with numerous challenges. To capitalize on 

the evolving nature of agile development, today’s 

leadership community must embrace and direct 

five key aspects of agile development – Courage, 

Context, Course, Cadence, and Cost. 

Courage 

Agile development isn’t for the faint of heart. 

It doesn’t mean that project management won’t 

ultimately be simplified, just that any new way of 

doing business requires practice and hard work. 

Don’t be afraid to fail, especially early on. With 

agile development, at least your failures are limited 

in scope to a couple of weeks, at which point you 

re-evaluate the situation and adapt accordingly. 

Use these early iterations to learn, adjust, and 

stabilize. Teams, and people, generally get good at 

what they practice. In agile development, planning, 

estimating, and delivering occur every few weeks 

as opposed to once a year. Your team will quickly 

develop a rhythm. Focus on removing whatever 

obstacles get in the way and let this rhythm emerge 

and solidify as soon as possible. 

Also one of the four primary values of Kent Beck’s 

Extreme Programming (XP) methodology, courage 

takes on a much broader and strategic scope outside 

the boundaries of pure product development. 

Software development requires many interfaces 

– customers, other project teams, customer support, 

professional services, external stakeholders, 

human resources – and the confidence to step up 

to the plate and be willing to enact positive change 

in the face of tradition can be a risky, but ultimately 

a rewarding and valuable experience. 

Context 

With much of the fundamental project infrastructure 

– scope, priorities, estimates, schedules, 

and risks – in a state of flux, it has never been more 

important to steer and manage decisions in an 

overall business context. While functional value can 

often drive the details of a project, business values 

have to drive project goals. Force hard decisions 

about the business and project context as early as 

possible. Get as simple answers as possible to key 

questions such as: 

• What’s the project’s vision? 

• What are its primary goals and business drivers? 

• What are the values that should drive key project 

and product decisions? 

• What are the expectations of project sponsors 

and stakeholders? 

The answers to these questions serve as the basis 

for future decision-making, as well as providing a 

thread that can prevent a project from spiraling out of 

control. The degree of visibility afforded these priorities 

can serve as a foundation for managing conflict 

and stakeholder negotiations. Get answers to them 

on a single page or project Web page, and keep them 

visible throughout the life of the project. They will 

serve as a bar to which you will be held accountable. 

Course 

Context and course are complementary ideals. 

Where context defines overall circumstances, course 

defines direction and progress. Just because some 

agile approaches suggest not looking in detail beyond 

one to two iterations, do not be lured into believing 

that longer-range planning isn’t necessary. Longerterm 

software plans serve as a roadmap for important 

18 


interim business and project decisions. Iteration, 

milestone, and release plans remain critical components 

in planning and measuring progress. Keep 

in mind that the further out your plan, confidence 

levels diminish, but a three-to-six-month roadmap 

can serve as a continuous reality check in the face of a 

changing environment. 

Make a concerted effort every week to revisit 

your objectives, reconcile overall direction, review 

time frames and deadlines, and communicate 

variances. Reality has proven that rarely does time 

get made up on software projects. This is especially 

true in the world of agile development. Change is 

accepted and even fostered for business reasons, 

even if technical in nature, so be prepared to communicate 

in addition to delivering early and often. 

Methodologies 

Cadence 

I’d like to take credit for using the term cadence 

in this context, but its initial utterance came from 

Gary Evans of Evanetics, Inc. (http://www.evanetics.com) 

in a conversation we had about the virtues 

of agile development. At VersionOne, we have consistently 

used the concept of cadence, or rhythm, 

to convey one of the most beneficial effects of agile 

development. Most successful agile teams get into 

a powerful groove that can significantly benefit ongoing 

commitment and reliability. And this deep 

ingrained grasp of delivery in its broadest sense can 

serve as significant mitigator of risk. 

Instead of delivering once a year or more, agile 

teams deliver working, tested, installable software 

every iteration. In this type of environment, 

unexpected loose ends greatly diminish, defects 

are easier to manage, integrated builds are second 

nature, and production deployment becomes more 

streamlined and foolproof. This is not to say that 

some problems won’t arise, but those that do will 

be more manageable. 

To early practitioners, this team rhythm is a goal 

to strive for as early as possible. To experienced 

practitioners, this rhythm greatly simplifies agile 

development efforts. Additionally, with this kind of 

stable rhythm natural to a team, greater predictability, 

both in the short term and the long term, 

can be achieved and counted on for project planning 

and execution purposes. 

Cost 

Even agile development can’t escape the financial 

component of software development. The 

challenge and advantage of agile development is 

the opportunity to justify the cost with business 

value and customer benefit along the way. Instead 

of managing projects as cost centers, agile development 

views software as an investment, with the 

highest possible returns being generated earliest in 

the development cycle. 

While you may not have the same direct influence 

over the business benefit that you do over 

the cost, the opportunity for business to extract 

value, continuously align business and technology 

objectives, and adjust to changing business 

dynamics is extremely valuable. Although the 

cost model for most agile development projects 

is fairly straightforward (i.e., cost per iteration), 

fundamental changes to any financial assumptions 

still need to be managed and communicated 

as they evolve. In agile, while changes may 

occur more frequently, they should also be more 

obvious, making decisions regarding impact and 

future plans easier. 

Conclusion 

There are so many things that today’s project 

leaders can pay attention to during software 

development projects. A major goal of agile 

development is to simplify the process of software 

development, minimizing and streamlining those 

aspects and artifacts that actually matter outside 

of working software. Agree early on with sponsors, 

stakeholders, and team members the necessary visibility 

requirements of a project in light of working 

software being available for review, feedback, and 

potential deployment on a frequent basis. While 

planning and tracking a project may require less 

effort, the challenge and importance of communication 

in a changing and somewhat chaotic world 

is amplified exponentially. 

“Instead of managing projects as cost centers, agile development views 

software as an investment, with the highest possible returns being generated earliest 

in the development cycle” 


19

Feature 

C# Generics 

Introducing 

Leverage code reuse without sacrifi cing type safety 

By Robert R. Hauser 

About the Author 

Robert R. Hauser has a master’s degree in 

computer science specializing in artifi cial 

intelligence with more than 15 years of development 

experience in C, C++, C#, and Java, 

building software for networking, fi lesystems, 

middleware, and natural language processing. 

He works at Recursion Software, which 

is focused on providing a next-generation 

application platform for .NET and Java. The 

company’s agent-based Voyager Edge 

product gives software engineers maximum 

fl exibility to develop dynamic, intelligent, 

mobile, and decentralized applications easily 

in the software language(s) of their choice on 

the devices, virtual machines, and operating 

systems they need to target, while leveraging 

all of their existing code. Recursion Software 

also provides extensive toolkit libraries for 

C++, Java, and C# .NET to aid further in the 

development of next-generation applications 

How often have you 

wanted to reuse some 

code you previously 

wrote but it didn’t quite fit in 

your current project? Code 

reuse is an oft-touted benefit 

of modern object-oriented 

programming. With the advent 

of generic support in the C# 

language appearing in the 

.NET Framework 2.0 developers 

have new leverage for writing 

code that can be reused 

without compromising type 

safety. 

About Type Safety 

A key benefit to languages 

that support type checking is 

type safety. Type safety at build 

time and/or runtime prevents 

code from manipulating data 

of an incorrect type. As part 

of its type safe approach, C# 

detects type mismatch errors 

at build time in the compiler 

and at runtime in the Common Language Runtime 

(CLR). The following is a type mismatch error that 

C# will catch at build time: 

Object a = new Object(); 

String b = a; 

The second line will generate a compiler error 

because a plain Object can’t be used as a String 

while maintaining type safety. Unfortunately, buildtime 

type checking is ineffective if explicit casts 

are used. A cast lets the programmer circumvent 

the type checking at build time. For programming 

languages without runtime type checking this can 

result in invalid operations on data types having 

unpredictable consequences, such as manipulating 

a fragment of a String data type as if it were an int. 

C# provides type safety checks at runtime as well as 

build time. Here is a type mismatch error that won’t 

be caught until the program is run: 

Object a = new Object(); 

String b = (String)a; 

The program will build without errors. However, 

when running the program, it will generate an 

InvalidCastException on the second line because 

the Object referred to by ‘a’ can’t be converted to 

the type String. 

This type mismatch error is blatant but serves to 

remind us to avoid explicit casting since it negates 

the type safety provided at build time. Relegating 

these errors to program runtime incurs additional 

20 


Now Evan can use the collection as follows: 

Feature 

List1 aList = new List1(); 

aList.Add(“a”); 

aList.Add(“b”); 

for (String item = aList.Remove(); 

item != List1.NO_ITEM; 

item = aList.Remove()) 

{ 

// Do something with item 

} 

List1 is type safe, meaning it accepts and returns 

String types and this type safety is enforced at build 

time. 

Eventually Evan has to track the products waiting 

for the oven, items in the oven, and goods 

under the display counter. This is an opportunity 

for reusing the previously programmed collection, 

List1. The problem is he now needs to collect 

BakeItems, not Strings. Evan could copy the source 

code to form a new collection by replacing String 

with BakeItem, but this approach has dire consequences. 

If an error is found later then both copies 

of the source code will have to be fixed. The baker 

has also indicated that Evan will also have to track 

waiting customers, inventory shipments, and other 

things. Writing separate collection code for each 

data type is clearly not desirable. 

Evan decided to rewrite the collection with the 

most generally available type, Object. This results 

in a List2 class where the only difference is the 

replacement of all uses of the data type String with 

Object noted in bold text. Below is a fragment of 

List2. 

productivity cost (See “The Zen of Strong Typing” 

sidebar). In fact, now that we have the flavor of the 

type checking performed at build time, languages 

providing type safety features shouldn’t lead us into 

situations that require us to turn off type safety by 

introducing such casts. 

Reusing Code Without Generics 

Evan, a programmer hired to write software for a 

local bakery, needs to manipulate strings. The implementation 

of a minimal collection is shown in 

Listing 1. The collection is a singly linked list called 

List1. Since Evan is only interested in storing String 

type data at this point, he builds the collection to 

fit the need to store String data. The bold text in 

Listing 1 shows the locations where the collection is 

specific to the type String. 

public class List2 

{ 

public static Object NO_ITEM = 

default(Object); 

internal class ListNode 

{ 

public ListNode next = null; 

public Object obj = NO_ITEM; 

} 

// … 

public virtual void Add(Object obj) 

// … 

public virtual Object Remove() 

// … 

Deprecating List1 in favor of List2 requires refactoring 

the earlier string collecting code. 

List2 aList = new List2(); 




21

Feature 

for (Object item = aList.Remove(); 



{ 

String theValue = (String)item; 

// Do something with theValue 

} 

The advantage of this rewrite is that we can use 

List2 for any type of thing we want to collect. For 

primitive types, C# will perform a conversion to 

an appropriate object in a process called boxing. 

This lets us transparently handle primitive types as 

if they were objects. Therefore, we could use List2 

with int as follows: 

} 

aList.Add(1); 

aList.Add(2); 




{ 

int theValue = (int)item; 

// Do something with theValue 

For Evan, List2 seems well prepared for String, 

int, BakeItem, Customer, or anything else he might 

need. However, note that a cast is now necessary 

to convert from the most general type, Object, to 

the actual type, String or int in the code fragments. 

Recall that explicit casting is just the situation we 

want to avoid so we don’t negate the type checking 

done at build time. For instance, during the development 

effort, Evan accidentally added an instance 

of a data type called BakeItem to a List2 collection 

meant only to contain Customer elements. The 

error will appear as an InvalidCastException at runtime, 

with no indication of problems at build time. 

This weakens the original intent of having 

multiple different homogenous collections in a 

way that allows any individual collection to accept 

unintended data types. Even with the explicit casts 

that negate build time type checking, this approach 

to reusing code is superior to the alternative of 

writing code for a multitude of type-specific collections. 

This code reuse versus type safety tension 

was a problematic state of affairs with C# 1.1. With 

the addition of generics to C# 2.0 there is now a 

better solution to hand. 

Reusing Code with Generics 

By using generics Evan can get the benefit of 

type safety at build time without having to duplicate 

code. Let’s see how with a code fragment 

showing the major changes needed. The full code 

for generic List3 is found in Listing 2. 


{ 

internal static T NO_ITEM = default(T); 


{ 


public T obj = NO_ITEM; 

} 

// … 

public virtual void Add(T obj) 

// … 

public virtual T Remove() 

// … 

With the syntax immediately after the class 

name, we indicate a type parameter, T, which 

stands in place of some actual type that’s specified 

at each location where a new List3 is used. In fact, 

we won’t call this class List3 but rather List3. 

Within the class itself the type parameter T is 

used as if it were a real type (like our old String or 

Object types). The C# build time and runtime will 

conspire to use this generic class, List3, as a 

template that can be used to generate as many 

“regular” classes as needed for each actual type 

that a program specifies to take the place of the 

type parameter T. 

Here’s how Evan can refactor the string manipulation 

code to use the generic class List3. 

List3 aList = new 

List3(); 






{ 


} 

Note that where we want to use List3 we 

must specify what the type parameter really is – in 

this case String. The C# runtime will create a class 

for List3, unless it’s already done so. You 

don’t need explicit casting because the Remove() 

method for List3 returns a String. At build 

time we have the advantage of full type checking 

that prevents entering the wrong type of object into 

the collection. 

Where the same code could operate identically 

on many types, using generics elegantly solves the 

tension of how to write reusable code while maintaining 

type safety. 

Back to the Bakery 

Back at the bakery, Evan uses the generic 

List3 with Strings, Customer objects, and 

22 



23

Feature 

BakeItem objects: 

List3 waitingForOven = new 

List3(); 

List3 inOven = new 

List3(); 

List3 onDisplay = new 

List3(); 

With three collections the software is modeling 

the process as bakery items are queued for the 

oven, cooked, and then put on display. To facilitate 

some cooking experiments, the baker asks Evan to 

track how many of a particular bakery item were in 

the oven at the same time. Each bakery item should 

maintain the maximum and minimum number of 

items in the oven during its cook time. 

First, Evan creates an IWatermark interface and 

implements that interface in the BakeItem class. 

The IWatermark interface is as follows and the 

BakeItem class that implements this interface is 

shown in Listing 3. 

// Do stuff with IWatermark methods 

} 

Unfortunately this approach is undesirable. 

It adds useless code in the general case where 

List3 is used with a type that doesn’t implement 

IWatermark. Another pitfall of this approach is that 

any object that implements IWatermark will be 

instrumented in any List3 that it’s put in, not 

just the collection that’s being used to represent the 

oven. Finally, this strategy hides the intrusive nature 

of List3 and thus can hide type mismatch 

errors. 

Leaving the List3 as general as possible, Evan 

implements List4 with a constraint that it requires 

anything put in it to implement IWatermark. 

See Listing 4 for the full watermarking collection. 

Here’s the first line: 

public class List4 : List3 where T : Iwatermark 

public interface IWatermark 

{ 

int HighMark { get; set; } 

int LowMark { get; set; } 

} 

The bakery items that are in the oven are in a 

List3 collection in a variable called inOven. 

If this collection knew that it held items that 

implement the IWatermark interface then it could 

invoke the required instrumentation during the 

additions and removals of items in the collection. 

Having looked at the documentation for C# 

generics, Evan considers placing a constraint on 

a generic parameter type. Evan considers turning 

List3 into an intrusive container that makes use 

of the properties available via IWatermark. It would 

look like this: 

public class List3 where T : Iwatermark 

However, this would require implementing 

IWatermark on all of the classes List3 contains, 

including Customer types and String types. This 

would also prevent List3 from using primitive 

types. A more viable approach could be to alter 

List3 to test internally if the type that it holds 

implements IWatermark and if so then record the 

necessary statistics. We could make use of C#’s 

is operator in the implementation of List3 to 

test type compatibility dynamically for any T with 

IWatermark as follows: 


{ 

if (obj is IWatermark) { 

A generic class can be used as a base class so 

Evan chose to specialize List4 from List3 

but added a constraint that List4 requires all 

items put in it to implement IWatermark. The 

generic class List4 is explicit about its intrusive 

nature on the objects it holds and C#’s type safety 

provisions come into play at build time and runtime 

to prevent it from operating on inappropriate 

types. Here’s the modified code snippet: 

List3 waitingForOven = new 

List3(); 

List4 inOven = new 

List4(); 

List3 onDisplay = new 

List3(); 

Delving Deeper 

Through illustration we introduced generic 

classes and how to put a constraint on a generic 

type parameter. 

C# allows for generic classes, structs, interfaces, 

delegates, static methods, and instance methods. 

Any of these can be parameterized based on type 

and we’re not limited to a single type parameter. 

For example, we could have a generic class 

Several where each type parameter could 

be the same or unrelated. 

Several a = new Several(); 

You can use generic methods to define algorithms 

that are clearly separated from the data type 

on which they operate. A generic method specifies 

type parameters following the method name: 

24 


public U DoSomething(U u, V v) 

Both parameters and return type can be made 

generic and the type parameters don’t have to 

be the same as type parameters on the class. The 

C# compiler can do type inferencing on method 

parameters so that, for the above method, instead 

of coding DoSomething(“name”, 2) you 

can simply type DoSomething(“name”, 2). 

The compiler infers the generic type parameters 

from the data types of the method parameters. 

Properties and indexers don’t allow for introducing 

new type parameters but they can use any type 

parameters of the class that contains them. Generic 

methods support constraints on their type parameters 

like classes. 

You can apply constraints to each type parameter 

separately and, for a type parameter T, 

the constraint begins with the syntax, “where T 

:”. The list continues as comma-separated items 

beginning with an optional base class followed 

by any interfaces. Following these, you can list 

a default constructor constraint using “new()” 

– which requires the type parameter to support 

the public default constructor. Finally, you may 

add a reference or value constraint with a class or 

struct keyword. The class Test shows multiple 

constraints. 

class Test where T : MyBase, IComparable, IMy- 

Interface, new() 

Use constraints with caution since they reduce 

generality and can prevent code reusability. 

Operators, such as the == operator, can’t be a constraint. 

In List3 we commented out the code: 

//if (obj == NO_ITEM) 

// throw (new Exception(“Cannot hold the 

default() value.”)); 

This code fragment isn’t permitted because the 

type parameter T can’t be guaranteed to have the 

== operator available. Our original design of the list 

collection is using default(T) as the value to return 

if the list is empty. For reference types, default(T) 

resolves to a null and produces zero-filled contents 

for value types. Since we can’t constrain type 

T to require the == operator, the compiler won’t 

allow its use and we remove it. However, this code 

disallowed entering the default(T) value into our 

List3 collection and we’ve now introduced 

ambiguity. When Remove() returns the default(T) 

value, how will the code using the collection distinguish 

whether the list is empty, or that the default 

value has actually been removed? 

When storing only reference types such as String 

and Object, it was reasonable for our collection 

to reject storing null values. However, if the fully 

generic List3 is used as List3 it makes little 

sense to disallow adding the value ‘0’ – which is 

default(int) – to the collection. Although we don’t 

undertake it here, the right approach to this problem 

is to redesign the collection to be able to hold 

any value, including default(T), and to use another 

mechanism to indicate that the list is empty. 

In the boxing process mentioned previously 

involves taking the primitive and creating a simple 

object for it from heap memory. When we use 

generics with primitives, no such process is necessary 

and we get a modest performance gain for 

doing things in the more elegant way. The performance 

gain is negligible in typical programs doing 

network and file operations, but for programs that 

spend the bulk of their time looping through collections 

of primitive types the gain is dramatic. 

The type information about generics, the number 

of type parameters and their constraints, is fully 

supported by the C# 2.0 bytecode and runtime. 

This provides type safety for reflection even when 

using third-party assemblies containing generics. 

Generic Collections 

In our illustration we used only a minimal 

generic collection. Due to their utility, collections 

are often the first classes to become generic. C# 

2.0 provides the following collection classes in the 

System.Collections.Generic namespace: 

• Dictionary : A key and value collection 

• LinkedList : A linked list 

• List : A list (implemented on an array) 

• Queue : A queue 

• SortedDictionary : A key and value sorted 

collection 

• SortedList : A sorted linked list 

• Stack : A stack 

There is also System.ComponentMode. 

BindingList, which can fire state change events. 

C# defines several generic interfaces including 

IEnumerable, which enables all collections to 

support enumeration and C#’s for each keyword. 

This is how it works on a LinkedList: 

LinkedList a = new 

LinkedList(); 

a.AddLast(1); 

a.AddLast(2); 

foreach (int item in a) 

{ 


} 

Both System.Collections.Generic.List and 

System.Array have many useful generic methods, 

many designed to use four generic delegates in the 

System namespace. 

Feature 


25

Feature 

public delegate void Action(T t); 

public delegate int Comparison(T x, T y); 

public delegate U Converter(T from); 

public delegate bool Predicate(T t); 

Combining generic delegates with utility methods 

enables powerful processing of collections. 

Unfortunately, collections other than List and 

Array lack equivalent generic utility methods but 

there are third-party generic libraries, such as 

Recursion Software’s C# Toolkit, that support C# 

generics and provide extensive additional collections, 

algorithms, functions, and predicates. 

Conclusion 

We focused on the tension between writing reusable 

code and maintaining type safety, and then 

showed how C# 2.0 provides generics to address the 

problem elegantly. With generics, you can employ 

the type safety features of C# without preventing 

effective code reuse where the data type varies. 

Resources 

• Juval Lowy. “An Introduction to C# Generics.” 

http://msdn.microsoft.com/library/default. 

asp?url=/library/en-us/dnvs05/html/csharp_generics.asp 

• Generics. http://msdn.microsoft.com/vcsharp/2005/overview/language/generics/ 

• Bill Venners with Bruce Eckel. “Generics in C#, 

Java, and C++ – A Conversation with Anders Hejlsberg, 

Part VII.” http://www.artima.com/intv/ 

generics.html 

• “An Extended Comparative Study of Language 

Support for Generic Programming.” http://www. 

osl.iu.edu/publications/prints/2005/garcia05:_ 

extended_comparing05.pdf 

• Andrew Kennedy and Don Syne. “Design and Implementation 

of Generics for the .NET Common 

Language Runtime.” http://research.microsoft. 

com/projects/clrgen/generics.pdf 

• Standard ECMA-334. “C# Language Specification.” 

4th edition. June 2006. http://www.ecma- 

international.org/publications/standards/Ecma- 

334.htm 

LISTING 1 – A MINIMAL COLLECTION CLASS 

FOR STRING TYPES 


{ 

public static String NO_ITEM = 

default(String); 


{ 


public String obj = NO_ITEM; 

} 

internal ListNode head = null; 

internal ListNode tail = null; 

internal int length = 0; 

public List1() {} 

public virtual void Add(String obj) 

{ 

if (obj == NO_ITEM) 

throw (new Exception(“Cannot hold 

the default() value.”)); 

ListNode node = new ListNode(); 

node.obj = obj; 

if (++length == 1) 

head = node; 

else 

tail.next = node; 

tail = node; 

} 

public virtual String Remove() 

{ 

if (length > 0) 

{ 

ListNode node = head; 

head = head.next; 

--length; 

return node.obj; 

} 

} 

} 

return NO_ITEM; 

LISTING 2 – A MINIMAL GENERIC COLLEC- 

TION CLASS FOR ANY TYPE 


{ 

internal static T NO_ITEM = default(T); 


{ 


public T obj = NO_ITEM; 

} 

internal ListNode head = null; 

internal ListNode tail = null; 

internal int length = 0; 

public List3() {} 


{ 

//if (obj == NO_ITEM) 

// throw (new Exception(“Cannot 

hold the default() value.”)); 

ListNode node = new ListNode(); 

node.obj = obj; 

if (++length == 1) 

head = node; 

else 

tail.next = node; 

} 

tail = node; 

public virtual T Remove() 

{ 

if (length > 0) 

{ 

26 


} 

} 

ListNode node = head; 

head = head.next; 

--length; 

return node.obj; 

} 

return NO_ITEM; 

LISTING 3 – A CLASS FOR REPRESENTING 

BAKERY ITEMS 

public class BakeItem : IWatermark 

{ 

private int id; 

public BakeItem(int i) 

{ 

id = i; 

} 

public int Id 

{ 

get { return id; } 

set { id = value; } 

} 

// Implement IWatermark 

private int highMark = default(int); 

private int lowMark = default(int); 

public int HighMark 

{ 

get { return highMark; } 

set { highMark = value; } 

} 

public int LowMark 

{ 

get { return lowMark; } 

set { lowMark = value; } 

} 

} 

LISTING 4 – A SPECIAL COLLECTION TO RE- 

CORD WATERMARKS IN EACH ITEM COLLECTED 

public class List4 : List3 where T : 

IWatermark 

{ 

public override void Add(T obj) 

{ 

base.Add(obj); 

obj.LowMark = length; 

for (ListNode node = head; node != 

null; node = node.next) 

{ 

// Since T is constrained we can 

use the HighMark property here 

if (node.obj.HighMark < length) 

{ 

node.obj.HighMark = length; 

} 

} 

} 

public override T Remove() 

{ 

T result = base.Remove(); 

for (ListNode node = head; node != 

null; node = node.next) 

{ 

// Since T is constrained we can 

use the LowMark property here 

if (node.obj.LowMark > length) 

{ 

node.obj.LowMark = length; 

} 

} 

return result; 

} 

} 

– CONTINUED FROM PAGE 7 

A Second Glance at SharePoint 2007 Features 

• Feature / Site Template Association - Allows you to indicate that, 

when your feature is active, all new provisions of an existing site template 

will also contain an activated feature of your choosing (could be 

your own, could be a different feature). Example: you could make it 

so that, once your My Company Corporate Policy feature is installed, 

all future provisions of the Team Collaboration site template also 

include the Corporate Default Document Libraries feature. Hopefully 

I don’t need to explain further how unbelievably useful this type of 

Feature element can be. 

There are two key points that I want to make here. The first is that 

Features allow you unprecedented ability to create new functionality 

for SharePoint and extend existing functionality. The second key point 

is that Features aren’t just something that SharePoint implemented to 

allow you to extend things, SharePoint itself is built using Features. 

After I wrote some code to enumerate the list of hidden features contained 

in my test Farm (the source code is in my latest book, Microsoft 

SharePoint 2007 Development Unleashed), I found that SharePoint 

installs with 136 Features. Most of these are hidden Features, but, because 

they use the Feature infrastructure, all of that pluggable flexibility 

is available to you as a SharePoint developer. 

Here’s a quick list of some of the non-hidden Features that ship with 

SharePoint 2007: 

• Team Collaboration 

• Review Workflows 

• Premium Web 

• Slide Library (splits a PPT presentation 

into individually viewable 

slides on the site without 

breaking the PPT file open) 

• Premium Web Application 

• Premium Root Site 

• Transaction Management Library 

• Global Web Parts - stock set of 

web parts that can be used at 

any scope 

• Enhanced Search 

• Base Web Application 

• Spell Checking 

• Signatures Workflow - standard 

workflow for getting "sign off" on 

documents 

• Reporting 

• Premium Site 

• Publishing Web - not sure, but 

I'm pretty sure this is what enables 

the Wiki functionality 

• Base Web 

• Base Site 

• Basic Search 

• Translation Workflow - workflow 

for sending a document through 

rounds of translation into multiple 

languages 

• Expiration Workflow 

• Excel Server - I could write an 

entire chapter on..oh wait, I 

did... 

• Search Web Parts 

• Publishing Site 

• Issue Tracking Workflow - That's 

right... the "Issue Tracking" list 

that comes with SharePoint is 

workflow enabled. 

So at this point, you should probably saying to yourself, “Self! I MUST 

get a hold of SharePoint 2007 when it comes out!!” 

Here’s the bottom line: If you are going to be developing and writing 

code for SharePoint 2007, then you must learn about Features and 

Solutions. Features aren’t simple, isolated points of extensibility (this 

assumption is easy to make, I made it too). Features are, in fact, the 

exoskeleton on which ALL of SharePoint is based. 

Feature 


27

Protocols 

Exploring FTP in .NET 2.0 

Microsoft’s heart wasn’t in it 

By Alexander Gladshtein 


Alex Gladshtein is a product manager at The 

CBORD Group, Inc. in Ithaca, NY. CBORD 

is the world’s largest supplier of food and 

nutrition software solutions, campus-wide 

ID card programs, cashless dining, and 

housing management systems. Alex holds 

undergraduate and graduate degrees from 

the University of Michigan, and when not 

obsessing about .NET he enjoys spending 

time with his wonderful wife and cheering on 

the Michigan Wolverines. 

agladshtein@hotmail.com 

Fall the network protocols missing from .NET 

1.0 and 1.1, the most notable is the File 

Transfer Protocol (FTP). Manually implementing 

the protocol for software developers was 

an unreasonable expectation, especially considering 

the complexity of the protocol in comparison 

to such protocols as HTTP or TELNET. This led to a 

thriving third-party component industry that has 

been perfecting FTP implementations since VB3 

(and has been an ideal example of the argument for 

buying versus building when FTP functionality was 

required, especially with a price point of around 

$250). With the coming of .NET 2.0, Microsoft has 

introduced a native FTP communications implementation, 

but with some very curious design 

decisions that may complicate programming sufficiently 

so as to make abandoning commercial FTP 

components ill-advisable for many users. 

The FTP Protocol 

FTP is the standard protocol for transferring files 

between computers and is based on RFC 959. The 

protocol can be used to upload files, download 

files, get directory listings, navigate directories, and 

conduct a number of different file operations. As 

long as both computers conform to the FTP specification, 

the type of computer or operating system 

is irrelevant. The basic operating principal is that 

a client accesses files stored on a server, which will 

in turn respond to the client, returning requested 

information or executing requested tasks. 

One of the more interesting aspects of FTP is that 

it uses two connections for communications rather 

than a single connection used by most other protocols 

such as HTTP or SMTP. The first connection 

is the Control connection, which is responsible for 

log-ins and command processing. This connection 

normally occurs over port 21 and uses the Telnet protocol 

for communications. The second connection is 

the Data connection which is responsible for sending 

files to the server, receiving files from the server, and 

sending directory listings from the server. 

Unlike the Control connection, the Data connection 

remains open only when data is transferred 

and only a single Data connection is available 

at one time; however, data can be uploaded and 

downloaded simultaneously over that connection. 

The operational process of communications over 

the Data connection consists of a client choosing an 

unused port to listen for the incoming data connection. 

Then, the client lets the server know which port 

is listening by sending a PORT command over the 

Control connection. This is followed by a follow-up 

command over the Control connection to initiate an 

action such as STOR or RETR. The server then connects 

to the client and begins the transfer of data. 

.NET 2.0 FTP Implementation 

The first striking aspect of the Microsoft implementation 

is their decision to extend the previous 

WebResponse/WebRequest model designed 

for HTTP to FTP with the FtpWebRequest and 

FtpWebResponse. This is somewhat of an unusual 

choice, as a pure request/response model is ideal 

for a stateless protocol like HTTP. FTP operations 

normally maintain their state while a series of commands 

are executed to fulfill an operation. What 

Microsoft has done is encompass a series of protocol-level 

requests into a single programmatic-level 

request. For example, programmatically a user will 

create a single request for directory list, but behind 

the scenes multiple requests will be sent containing 

the USER, PASS, PWD, CWD, TYPE I, PASV, and 

NLST commands, most likely in that order. 

The next unusual aspect of the implementation 

is a result of using the WebRequest/WebResponse, 

which means that the programmatic model is URI 

based (rather than the more intuitive approach of 

specifying a server, location, and filename). In this 

model, every request requires a valid URI such as 

ftp://balrog/source when creating a request for a file 

list. This is fine when working with HTTP, as every request 

is stateless, but when attempting to carry out a 

series of actions in FTP, specifying a new request with 

a URI for each action quickly becomes unwieldy. 

Further complicating the architecture is the 

requirement to understand the underlying connection 

model to effectively implement a series of 

commands. By default, KeepAlive is true, which is 

as it should be, as KeepAlive specifies whether the 

control connection to the FTP server is closed after 

the request completes. The non-intuitive aspect is 

that to close the connection, KeepAlive must be set 

to false during the last request, which will issue a 

QUIT command to the server. A more intuitive approach 

would be to have a more direct mechanism 

28 


to close the connection, such as a Close method. 

To specify which operation to execute, the WebRequestMethods.Ftp 

structure is used. While this 

structure supports most of the common operations 

such as WebRequestMethods.Ftp.ListDirectoryDetails 

and WebRequestMethods.Ftp.DownloadFile, a 

number of commands are missing. The most notable 

absent commands are directory navigation, which is 

understandable as a request/response model makes 

such commands more complicated to implement. 

This does not mean that there is no way to send 

custom commands. While FtpWebRequest.Method 

is normally used with the WebRequestMethods.Ftp 

structure, any valid command that a server will recognize 

can be specified as a string. This string can be a 

command or a series of commands that are separated 

by a “\n” character. Unfortunately, the Method property 

does not allow the use of a custom command 

that requires accompanying data or one that requires 

the server to respond to the command with data. 

Microsoft also warns that no command should be 

sent that will alter the state of the connection, such as 

MODE, PASV, or PORT. 

On a more positive note, Microsoft did include 

support for SSL-based security in the FTP implementation 

with the FtpWebRequest.EnableSsl and 

FtpWebRequest.ClientCertificates properties. The 

technique they use is Explicit security, which sends 

an AUTH TLS command. While Explicit security is 

the most common approach for encrypting FTP 

communications, a technique that is absent is Implicit 

security, which does not send any command, 

but rather expects to establish a secure connection 

immediately after establishing the TCP connection. 

Supporting both techniques guarantees the widest 

possible security compatibility, but supporting 

Explicit should be sufficient. 

Finally, the one missing element that is probably 

my greatest personal pet peeve is the lack of directory-list 

parsing. Identifying files from a directory 

command is a very common task, and while the 

parsing code can be written manually, supporting 

both the MS-DOS style listing and the various 

UNIX listings can be a time-consuming activity, 

especially in the area of maintenance. 

For simple FTP operations, such as uploading or 

downloading a file, the FtpWebRequest/FtpWebResponse 

classes can be bypassed by using System. 

Net.WebClient. This class will support http:, https:, 

ftp:, and file: scheme identifiers, and is useful in 

very simple scenarios. 

The Sample Application 

Many FTP implementations are used to poll an 

FTP server directory based on a predetermined 

schedule, search for a specific file, and download 

the file if present. The sample presented here is a 

Windows Forms application that polls a server on a 

predetermined schedule, requests a directory listing, 

looks at the result to see if the target file is present, 

downloads the file if present, and, for good measure, 

uploads another file to a separate directory. The application 

is designed to showcase the FTP functionality 

and is structured as such. An actual application 

that executed such a task would often run as a 

service, use a Server Timer rather than a Windows 

Timer, operate on a worker thread or asynchronously 

have the different FTP requests organized by functions, 

and have better FileIO error handling. 

In the sample application visible in Listing 1, 

Steps 1-5 demonstrate the code necessary to retrieve 

a directory list from an FTP server. The basic 

process is to initialize an FtpWebRequest class with 

the URI as demonstrated below: 

FtpWebRequest listRequest = (FtpWebRequest)WebRequ 

est.Create(ftpServer + remoteDir); 

This is the first step in every type of FTP request. 

The next step is to instantiate a NetworkCredential 

class. If this step is skipped, the request will be 

assumed as anonymous. Remember to repeat this 

for every request, even on the same 

connection, and to make sure not to 

change the information unless you plan 

to make a new connection. 

NetworkCredential credentials = new 

NetworkCredential(username, password); 

listRequest.Credentials = credentials; 

The third step is to specify the command 

to execute: 

listRequest.Method = WebRequestMethods.Ftp.ListDirectory; 

The fourth step is to initialize the object to hold 

the response: 

FtpWebResponse listResponse = (FtpWebResponse)list 

Request.GetResponse(); 

The last step is to read the data from the response: 

reader = new StreamReader(listResponse.GetResponseStream()); 

This order of operation is repeated for most 

activities that read data from the server, with the 

exception of uploading, where data is written to 

the RequestStream. Steps 6-12 demonstrate the file 

downloading process and Steps 13-22 explain file 

uploading, which as mentioned above, does differ 

slightly from the data retrieval model. 

While these three operations look like disparate 

processes in code, they are in fact occurring over a single 

Protocols 


29

Protocols 

connection in a non-broken stream of client-server communications. 

Listing 2 is a record of the FTP communications 

for the code discussed above and fully demonstrates 

how state is preserved until the connection is closed at 

the end of the upload process. (Listing 2 can be downloaded 

from http://dotnet.sys-con.com.) 

Conclusion 

While Microsoft has done a great job with the 

other network protocols in .NET 2.0, the FTP 

implementation leaves much to be desired. This is 

somewhat a surprise as FTP is arguably the most 

important end-user protocol after HTTP and SMTP. 

Shoehorning the protocol into a request/response 

model does not do it justice, especially in functionality 

and usability. The only positive is that FTP is 

now available in .NET, and most operations can be 

executed. However, I would hold on to those thirdparty 

components if you want to implement FTP 

quickly and with flexibility. 

LISTING 1: FTP COMMUNICATIONS SOURCE 

CODE 

[C#] 

using System; 

using System.Collections.Generic; 

using System.ComponentModel; 

using System.Data; 

using System.Drawing; 

using System.Text; 

using System.IO; 

using System.Net; 

using System.Windows.Forms; 

namespace FTPFileChecker 

{ 

public partial class Form1 : Form 

{ 

private string downloadFile = “sourcecode. 

zip”; //The name of the file to download 

private string localDir = “c:\\”; 

private string remoteDir = “//source”; //The 

directory on the FTP server where downloadFile 

is located 

private string uploadFile = “result.txt”; //The 

name of the file to create on the FTP server when 

uploading 

private string targetDir = “//result”; //The 

name of the upload directory 

private string ftpServer = “ftp://balrog”; 

//The name of the FTP server 

private string username = “tuser”; //The 

username for login 

private string password = “CBORD”; //The 

password for login 

public Form1() 

{ 

InitializeComponent(); 

} 

private void buttonStart_Click(object 

sender, EventArgs e) 

{ 

timer1.Enabled = true; 

buttonStart.Enabled = false; 

} 

private void timer1_Tick(object sender, 

EventArgs e) 

{ 

bool isPresent = false; 

labelLastAttempt.Text = DateTime.Now. 

ToString(); 

try 

{ 

isPresent = CheckForFile(); 

if (isPresent == true) 

{ 

labelLastResponse.Text = “Process Successful”; 

labelLastTransfer.Text = labelLastAttempt.Text; 

} 

else 

{ 

labelLastResponse.Text = “File Not Found”; 

} 

} 

catch (Exception ex) 

{ 

timer1.Enabled = false; 

MessageBox.Show(ex.Message); 

buttonStart.Enabled = true; 

} 

} 

private void buttonStop_Click(object sender, 

EventArgs e) 

{ 

timer1.Enabled = false; 

buttonStart.Enabled = true; 

} 

private bool CheckForFile() 

{ 

StreamReader reader = null; 

Stream downloadResponseStream = null; 

Stream uploadRequestStream = null; 

FileStream downloadFileStream = null; 

FileStream uploadFileStream = null; 

try 

{ 

//********************************************** 

********************************** 

//Look for the file on the server by getting a 

List from the server 

//Step 1. Create the FtpWebRequest with the required 

URI - in this case “ftp://balrog/source” 

FtpWebRequest listRequest = (FtpWebRequest)WebRe 

quest.Create(ftpServer + remoteDir); 

//Step 2. Create and set the credentials 

for login with the username and password 

NetworkCredential credentials = new NetworkCrede 

ntial(username, password); 

listRequest.Credentials = credentials; 

//Step 3. Specify the command to execute - in 

this case “ls” 

listRequest.Method = WebRequestMethods.Ftp. 

30 


ListDirectory; 

//Step 4. Create the FtpWebResponse to reference 

the incoming data 

FtpWebResponse listResponse = (FtpWebResponse)li 

stRequest.GetResponse(); 

//Step 5. Initialize the StreamReader with the 

GetResponseStream that contains the List 

reader = new StreamReader(listResponse.GetResponseStream()); 

string result = reader.ReadToEnd(); 

textResult.AppendText(textResult.Text + label- 

LastAttempt.Text + “\r\n” + result + “\r\n”); 

//********************************************** 

*********************************** 

//Check if the file is in the listing 

if (result.ToUpper().Contains(downloadFile.ToUpper())) 

{ 

//********************************************** 

******************************* 

//The file is there so continue to the download 

phase 

//Step 6. Create a new FtpWebRequest, this time 

with a URI of “ftp://balrog/source/sourcecode. 

zip” 

FtpWebRequest downloadRequest = (FtpWebRequest) 

WebRequest.Create(ftpServer + remoteDir + “//” 

+downloadFile); 

//Step 7. Set the credentials for the request. 

If NetworkCredentials are missing or changed, 

the request will attempt 

//to authenticate the user once again as either 

anonymous if the credentials are missing or to a 

new value if the 

//credentials are changed. This will most likely 

result in an error as the server is not in authentication 

mode. 

//This is proper operation as FtpWebRequest. 

KeepAlive is set to “true” by default and thus 

the previous connection 

//is being re-used. 

NetworkCredential downloadCredentials = new 


downloadRequest.Credentials = downloadCredentials; 

//Step 8. Specify that the operation will be a 

file upload 

downloadRequest.Method = WebRequestMethods.Ftp. 

DownloadFile; 

//Step 9. Create the FtpWebResponse to reference 

the incoming data 

FtpWebResponse downloadResponse = (FtpWebRespons 

e)downloadRequest.GetResponse(); 

//Step 10. Initialize the Stream with the GetResponseStream 

that contains the data 

downloadResponseStream = downloadResponse.GetResponseStream(); 

string fileName = downloadFile; 

//Step 11. Initialize the FileStream for the 

local file 

Protocols 


31

Protocols 

downloadFileStream = File.Create(localDir + “\\” 

+ downloadFile); 

byte[] downloadBuffer = new byte[1024]; 

int downloadBytesRead; 

//Step 12. Read the date from the Response and 

write it to the FileStream 

while (true) 

{ 

downloadBytesRead = downloadResponseStream. 

Read(downloadBuffer, 0, downloadBuffer.Length); 

if (downloadBytesRead == 0) 

break; 

downloadFileStream.Write(downloadBuffer, 0, 

downloadBytesRead); 

} 

textResult.AppendText(“Download complete.” + 

“\r\n”); 

//********************************************** 

***************************** 

//********************************************** 

***************************** 

//The download has finished so proceed to the 

upload phase 

//Step 13. Create a new FtpWebRequest, this time 

with a URI of “ftp://balrog/result/result.txt” 

FtpWebRequest uploadRequest = (FtpWebRequest)We 

bRequest.Create(ftpServer + targetDir + “//” + 

uploadFile); 

//Step 14. Set the credentials for the request. 

NetworkCredential uploadCredentials = new 


uploadRequest.Credentials = uploadCredentials; 

//Step 15. Specify that the operation will be a 

file upload 

uploadRequest.Method = WebRequestMethods.Ftp. 

UploadFile; 

//Step 16. Set KeepAlive to false to that a 

“QUIT” command is issued to the server, telling 

it to close the 

//connection after the file transfer. 

uploadRequest.KeepAlive = false; 

//Step 17. As a habit, Proxy should be set to 

null during uploads as this operation does not 

support an Http proxy 

uploadRequest.Proxy = null; 

//Step 18. Initialize the Stream with the GetRequestStream 

that will have data written to it 

uploadRequestStream = uploadRequest.GetRequest- 

Stream(); 

//Step 19. Initialize the FileStream with the 

file to upload 

uploadFileStream = File.Open(localDir + “\\” + 

uploadFile, FileMode.Open); 

byte[] uploadBuffer = new byte[1024]; 

int uploadBytesRead; 

//Step 20. Read the data from the local file and 

write it to the Request 

while (true) 

{ 

uploadBytesRead = uploadFileStream. 

Read(uploadBuffer, 0, uploadBuffer.Length); 

if (uploadBytesRead == 0) 

break; 

uploadRequestStream.Write(uploadBuffer, 0, uploadBytesRead); 

} 

//Step 21. Close the Request as this must be 

done before before getting the Response. 

uploadRequestStream.Close(); 

//Step 22. Create an FtpWebResponse to hold the 

server Response. The StatusDescription for the 

FtpWebResponse 

//should tell you that the transfer was complete. 

FtpWebResponse uploadResponse = (FtpWebResponse) 

uploadRequest.GetResponse(); 

textResult.AppendText(“Upload complete.” + 

“\r\n”); 

//********************************************** 

***************************** 

return true; 

} 

else 

{ 

return false; 

} 

} 

catch (UriFormatException ex) 

{ 

throw ex; 

} 

catch (WebException ex) 

{ 

throw ex; 

} 

catch (IOException ex) 

{ 

throw ex; 

} 

catch (Exception ex) 

{ 

throw ex; 

} 

finally 

{ 

//Step 23. Cleanup 

if (reader != null) 

reader.Close(); 

if (downloadResponseStream != null) 

downloadResponseStream.Close(); 

if (uploadRequestStream != null) 

uploadRequestStream.Close(); 

if (downloadFileStream != null) 

downloadFileStream.Close(); 

if (uploadFileStream != null) 

uploadFileStream.Close(); 

} 

} 

} 

} 

32 



33

Feature 

Clean and Protect a Large .NET 

Code Base with Coding 

Standards and Unit Testing 

How to avoid runtime exceptions, instability, crashes, 

degraded performance and insecure backdoors 

By Hari Hampapuram and Matt Love 

About the Authors… 

Hari Hampapuram is currently Parasoft’s 

director of development. He has extensive 

experience in building software development 

tools at Microsoft Research, Intrinsa, Philips 

Semiconductors, and AT&T Bell Laboratories. 

Hari has a PhD in computer science 

from Rutgers University. 

Matt Love is a software development 

manager with Parasoft Corporation. He has 

been involved in the development of Jtest, 

Parasoft’s automated code analysis and 

unit testing tool, since 2001. Matt has been 

developing since 1997 and earned his BS 

in computer engineering from University of 

California San Diego. 

Developer testing done early in the 

software’s lifecycle is known to have 

a high positive impact on application 

quality, since this is the phase 

where finding and fixing bugs is cheapest, easiest, 

and fastest. Ideally, coding standard checking and 

unit testing would be done on every piece of code 

before it was added to a team’s code base. However, 

this is not always practical. Many organizations 

don’t give developers the time and resources 

needed for this testing. Moreover, most organizations 

don’t develop applications “from scratch” 

by writing new code for all required functionality. 

Rather, they typically make incremental enhancements 

to a large amount of functioning legacy 

code, or add their own code to extend third-party 

or Open Source packages. The resulting code bases 

could include legacy code written by the organization, 

code obtained via a merger/acquisition, code 

obtained from an outsourcer, or code that was 

developed by the Open Source community and 

downloaded from the Internet. 

Consequently, most teams accumulate large and 

complex code bases with at least some code that 

hasn’t been subject to coding standard analysis and 

unit testing. This involves several critical risks: 

• When the application is used in a way that development 

and QA didn’t anticipate (and didn’t 

test), the code might throw unexpected runtime 

exceptions that cause the application to become 

unstable, produce unexpected results, or even 

crash. 

• The code might open the only door that an attacker 

needs to manipulate the system and/or 

access privileged information. 

• Small coding mistakes could lead to significant 

performance or functionality problems. 

• The code’s functionality might be broken as the 

application evolves over the course of its lifecycle. 

If your team already has a large and complex code 

base (hundreds of thousands of lines, or millions 

of lines), it’s not too late to benefit from coding 

standard analysis and unit testing. As long as these 

practices are automated and applied properly, they 

can still be used to identify critical problems before 

the release/deployment — as well as satisfy any 

contractual obligations for performing unit testing or 

complying with a designated set of standards. 

This article explains a simple strategy that has 

proven to deliver fast and significant improvements 

to large and complex .NET code bases: 

1. Use coding standard analysis to identify bugs 

and bug-prone code. 

2. Use unit-level regression testing to ensure that 

the functionality is intact and use unit-level reliability 

testing (exercising each function/method 

as thoroughly as possible and checking for unexpected 

exceptions) to ensure that all code base 

changes are reliable and secure 

Both steps can be automated to promote 

consistent implementation and allow your team 

to reap the potential benefits without disrupting 

your development efforts or adding overhead to 

your already hectic schedule. Moreover, automating 

these practices lets you concentrate on deeper 

design/logic issues during code review. 

1. Use coding standard analysis to 

identify bugs and bug-prone code 

WHY IS IT IMPORTANT? 

Complying with coding standard rules is a 

proven way to achieve the following key benefits: 

34 


time and effort — to design and implement the 

tests then track the problem back to a specific line 

of code. Using an automated code analysis tool, 

code that may cause memory leaks now or in the 

future can be automatically detected in seconds 

— without requiring team members to write any 

tests or manually track down the root cause of 

reported memory leaks. 

Feature 

1. Detect bugs or potential bugs that impact reliability, 

security, and performance. 

2. Enforce organizational design guidelines and 

specifications (application-specific, use-specific, 

or platform-specific) and error-prevention 

guidelines abstracted from specific known bugs. 

3. Improve code maintainability by improving class 

design and code organization. 

4. Enhance code readability by applying common 

formatting, naming, and other stylistic conventions. 

Rules that provide benefit number 1 will be 

referred to in the text as Group 1 rules; rules that 

provide benefit number 2 will be referred to in the 

text as Group 2 rules, and so on. 

For an example of why it’s important to check 

coding standards even after the code is written, 

assume that coding standard analysis reveals that 

code from a frequently used module violates the 

“Avoid static collections” rule. This rule is important 

because it identifies code that could cause 

memory leaks. Static collection objects (i.e., ArrayList 

etc.) can hold a large numbers of objects, 

making them candidates for memory leaks. How 

can .NET have memory leaks? If you put a shortlived 

object into a “static” collection, that object 

will be referenced by the collection for the life of 

the program if you forget to remove the object from 

the collection when you’re done with the object. If 

you’ve already removed all other references to the 

object, it can be difficult to see that it’s still referenced. 

Any memory leaks that resulted from this coding 

issue might be uncovered through profiling or load 

testing. However, this would require considerable 

WHAT’S REQUIRED TO DO IT? 

a. Decide which coding standard rules to check. 

First, review industry-standard .NET coding 

standard rules and decide which ones are most applicable 

to your project and will prevent the most 

common or serious defects. The rules defined by 

Microsoft’s .NET Framework Design Guidelines 

and the rules implemented by automated .NET 

static analysis tools offer a convenient place to 

start. If needed, you can supplement these rules 

with the ones listed in books and articles by .NET 

experts. Note that while many tools focus on rules 

that examine the IL code, it is also helpful to check 

rules that examine the source code; this enables 

you to check for many code issues that cannot be 

identified by IL-level analysis (for example, formatting 

issues, empty blocks, etc.). 

Also, consider rules that are unique to your 

organization, team, and project (for instance, an 

informal list of lessons learned from past experiences). 

Do your most experienced team developers 

have an informal list of lessons learned from past 

experiences? Have you encountered a specific bug 

that can be abstracted into a rule so that the bug 

never occurs in your code stream again? Are there 

explicit rules for formatting or naming conventions 

that your team is required to comply with? 

Because legacy code bases are typically very 

large, checking a legacy code base requires a special 

strategy. It’s important to recognize that legacy 

code’s compliance with design and development 

rules won’t be consistent because different parts of 

the code base probably originated from different 

sources. Applying rules from Groups 3 and 4 to the 

entire code base is likely to result in an impractically 

large number of rule violations that might be 

more overwhelming than helpful at this stage of the 

project. We strongly recommend that legacy code 

checking focus initially on rules from Groups 1-2, 

which will identify significant problems that should 

be corrected before the release/deployment. 

b. Automatically check the code base and respond 

to findings. 

Manually checking whether a large and complex 

code base follows coding standard rules would be 

incredibly slow, resource-intensive, and errorprone. 

Even if you had the vast resources required 

to review the code base manually, some rule 

violations would inevitably be overlooked, and just 


35

Feature 

one overlooked rule violation could cause serious 

problems. 

A more practical, thorough, and accurate way 

to check whether a large code base complies with 

coding standard rules is to use an automated coding 

standard analysis tool to check the entire code 

base at a scheduled time each night. 

The two complementary strategies below are well 

suited to the nature and size of legacy code: 

• Smoke alarm mode. Run a smaller rule set (including 

only Group 1 and Group 2 rules) on the 

entire code base to check if the code has critical 

problems. If violations are found, treat them as 

bugs (fix them immediately). 

• Gradual “fix it” mode: Select a code module, run 

a full rule set on it, then fix/refactor the code as 

needed. This mode is used to improve general 

compliance. Be sure to use this mode to check all 

new and modified code. If possible, check that 

code is compliant immediately after it’s written 

and before it’s committed to source control. 

It’s also possible that different modules in the 

legacy code base call for different rules, especially 

from Group 2. For instance, some code analysis 

tools let users apply a filter to enable or disable a 

specific rule or a group of rules for a given set of 

files, which allows such custom-tailoring of the 

rules to the nature and origin of the code. This can 

be thought of as “file-based” or “directory-based” 

application of specific rules. 

c. Hold weekly reviews for bug root cause analysis 

and prevention. 

Hold weekly meetings to analyze the root cause of 

the various bugs (defects that were reported by testers, 

customers, etc. — not violations of development 

rules) that were fixed during that week. The best time 

to do root cause analysis on a bug is when it’s still fresh 

in your mind. After root cause analysis, try to identify a 

set of rules that will prevent the same bugs from reoccurring 

then add these rules to the set of development 

rules you check. 

2. Use unit-level regression testing to 

ensure that the functionality is intact 

and use unit-level reliability testing to 

ensure that new code is reliable and 

secure 

The next step toward reliable and secure code 

is to do unit-level regression testing on all existing 

code, and then do unit-level reliability testing (also 

known as white-box testing or construction testing) 

on any code that’s added or modified. Regression 

tests capture existing functionality and don’t report 

any errors until a code modification changes that 

functionality. Reliability tests use unexpected stimulus 

and report any errors immediately. In .NET 

development, this involves exercising each method 

as thoroughly as possible for both categories of 

tests and checking for unexpected exceptions in 

reliability tests. 

WHY IS IT IMPORTANT? 

A large base of legacy code is a huge investment 

of time and resources. Its functionality has to be 

protected from undesired changes if some of that 

code is modified. After obtaining a certain level 

of acceptance, it’s critical not to go backwards by 

introducing bugs in functionality during the maintenance 

of legacy code. 

However, if your testing only checks expected 

functionality, you can’t predict what could happen 

when untested paths are taken by well-meaning users 

exercising the application in unanticipated ways — or 

taken by attackers trying to gain control of your application 

or access to privileged data. It’s hardly practical 

to try to identify and verify every possible user path 

and input or analyze every possible exception from 

legacy code. It’s important to identify the possible 

paths and inputs that could cause unexpected exceptions 

in new and security-sensitive code because: 

• Unexpected exceptions can cause application 

crashes and other serious runtime problems. If 

unexpected exceptions surface in the field, they 

could cause instability, unexpected results, or 

crashes. Many development teams have had 

trouble with applications crashing for unknown 

reasons. Once these teams started identifying 

and correcting the unexpected exceptions that 

they previously overlooked, their applications 

stopped crashing. 

• Unexpected exceptions can open the door to 

security attacks. 

Many developers don’t realize that unexpected 

exceptions can also create significant security 

vulnerabilities. For instance, an exception in login 

code could allow an attacker to completely bypass 

the login procedure. 

WHAT’S REQUIRED TO DO IT? 

a. Design, implement, and execute test cases 

for the entire code base. 

Create a “functional snapshot”: a suite of unit tests 

that exercise the methods and capture their current 

behavior, which is assumed to be correct. By creating 

this test suite, you establish a baseline against 

which you can compare code and identify changes 

expected when the code base grows and evolves. 

Testing legacy code will still produce exceptions 

that may be either defects or correct behavior 

under certain conditions. In this respect, the exceptions 

are similar to other outcome values from tested 

code that needs assertions for regression testing. 

One way to capture exception behavior in a regression 

test is to use the ExpectedExceptionAttribute 

available in Open Source Nunit tests (version 2.0 

36 


or later). NUnit tests with this attribute will pass 

only when the correct exception type and message 

is thrown. Applying this approach to a large code 

base will produce a “functional snapshot” that 

includes scenarios that throw exceptions. 

Manually developing the required number, 

scope, and variety of unit test cases to exercise each 

branch of code is impractical when you test each 

class as it’s completed, and is virtually impossible 

when you are working with a large existing code 

base. Achieving the scope of coverage required for 

an effective test suite mandates that a significant 

number of paths is executed. For example, in a 

typical 10,000-line program, there are approximately 

100 million possible paths; manually generating 

input that would exercise all of those paths is 

infeasible and practically impossible. 

When trying to create a baseline of tests for a 

large code base, a tool that automatically generates 

test code is essential. Team resources can then be 

focused on reviewing and addressing the reported 

test case failures and exceptions. 

b. Review and respond to test findings. 

The next step is to configure the automated testing 

tool to execute the complete regression test 

suite unobtrusively — all of the baseline unit tests 

— each night. 

Each test case failure (a test case that doesn’t 

produce the baseline outcome expected for a set 

of baseline input[s]) indicates a change in the 

code’s behavior. This change may be intentional or 

unintentional. When code functionality changes 

intentionally — as a result of a feature request, 

specification change, etc. — test cases related to 

that behavior are expected to fail because the new 

expected outcomes will be different than the ones 

recorded in the baseline. However, very often, other 

test cases will also fail unexpectedly. If so, this reveals 

a complex functional problem caused by the 

code modifications. If no unexpected failures are 

identified, you know that the modifications didn’t 

break the existing functionality. The appropriate 

response to a test case failure depends on whether 

the change was expected. If the new outcome is 

now the correct outcome, the expected test case 

outcome is updated, and it becomes part of the 

baseline. If not, the code is corrected. 

After you handle reported failures, review and 

address the unexpected exceptions reported for 

new code (you can configure the tool to “accept” 

all the exceptions reported for legacy code so 

only newly introduced ones will be reported). 

Each method should be able to handle any valid 

input without throwing an unexpected runtime 

exception. If code shouldn’t throw an exception 

for a given input, the code should be corrected. 

If the exception is expected or if the test inputs 

are not expected/permissible, document those 

requirements in the code and tell the tool that 

they’re expected. This prevents most unit testing 

tools from reporting these problems again in future 

test runs. Moreover, when other developers 

extending or reusing the code see documentation 

that explains that the exception is expected 

behavior, they’ll be less likely to make mistakes 

that introduce bugs. 

Ideally, you’d have the resources required to identify, 

review, and resolve unexpected exceptions across 

the entire code base. However, a more feasible strategy 

is to focus initially on finding and fixing exceptions 

in new code then later extend those efforts across the 

most critical and frequently used modules. 

MAKING INCREMENTAL IMPROVEMENTS 

The highest priority is establishing a baseline for 

protecting legacy code and establishing a system 

to safeguard against new defects entering the code 

base. After the baseline and safeguards are in place, 

you can start thinking about incremental improvements 

on existing code as resources permit. Some 

options are: 

• Review and address exceptions 

reported for legacy code. 

• Extend your unit test suite to 

make tests more realistic, and 

verify the critical functionality 

described in the specification. 

If any classes received less than 

75% coverage, we recommend 

that you customize the automated 

test case generation settings 

(for instance, by modifying 

automatically generated stubs, 

adding realistic objects or stubs, 

or modifying test generation settings) 

so that the automated test 

case generation can cover a larger 

portion of that class during the 

next test run. 

• Phase in more coding standards 

to identify and prevent additional coding problems. 

For instance, start implementing rules that 

improve code maintainability by improving class 

design and code organization, and rules that 

enhance code readability by applying common 

formatting, naming, and other stylistic conventions. 

• Identify critical modules of code that should 

undergo more thorough rule compliance and 

reliability testing. Utility code that’s used from 

many parts of the application is the most sensitive 

to performance problems and unexpected inputs 

because that code is invoked so often in so many 

ways. Front-end code for user interfaces, resource 

loading, or other communication is the most vulnerable 

to security attacks, and it’s an entry point 

into the system for unexpected input. 

Feature 


37

Tools 

Effective Database Change Management 

Versioning, developing concurrently, deploying and upgrading 

By Christoph Wienands 


Christoph Wienands is Software Engineer 

at Siemens Corporate Research, NJ. He 

received his Diplom-Informatiker (FH) at the 

Furtwangen University of Applied Sciences, 

Germany. Furthermore, he is MCSD and his 

expertise is .NET technology. His current research 

activities include Software Factories, 

model-driven development and domain-specifi 

c languages. Due to his research activities 

he is frequent speaker at conferences such 

as UML World or SD West. He is co-Author 

of “Practical Software Factories in .Net” 

(Apress, July 2006). 

christoph@wienands@siemens.com 

Have you ever been on a project where 

software development worked beautifully 

but developing and maintaining 

the database always caused unexpected 

problems and bugs? Do your changes constantly 

get overwritten by other developers, or is only one 

person at a time allowed to make changes? Do 

you find, after two or three major releases, that it’s 

impossible to create upgrade scripts for existing 

production databases? After experiencing these 

frustrations and more, I decided to address them. 

In this article, I will take a close look at the problems 

that many software projects face with database 

development, analyze the cause, and recommend 

best practices to work around them. The good news 

is that with the tools available today, you will be able 

to give a considerable boost to your database development 

process (even though there is still room for 

improvement). The bad news is that the techniques 

described in here are highly addictive! 

Source Control for Databases 

Source control for databases (or version control, 

or revision control) is the management of multiple 

revisions of a database. Each revision represents a 

number of changes that were made by developers, 

which include changes to the database schema, the 

contained data, programmability (stored procedures, 

user-defined functions, triggers), and permissions. 

Just as with source code, it is of utmost 

importance to keep track of these changes as the 

database evolves. 

Some common but suboptimal approaches 

for database version management, often applied 

because of a lack of better alternatives, include: 

• Checking a large binary database backup into 

source control 

• Checking in one huge build script 

• Not checking in the database at all 

The most prominent problem encountered in all 

of these approaches is that traceability of changes 

gets completely lost. Currently I'm not aware of any 

diff tool (a tool that compares two files for differences) 

that can compare two compressed, binary 

backups to determine which tables or stored procedures 

were changed between two revisions. This 

lack of traceability will soon lead to tedious and error-prone 

manual work when it comes to creating 

scripts for upgrading production databases. 

When we compare the above approaches to the 

way we version regular source code (e.g., for a .NET 

assembly), we notice a big difference. The source 

code for a .NET assembly is broken down into 

many small files, each containing only one class 

at a time (by using partial classes, even one class 

could be spread across multiple files). Therefore, 

when developers create new features or fix bugs, 

only a small number of files will actually change. 

Subsequently, source control will pick up only 

these few changed files and check them in. A revision 

log combined with a diff tool will allow anybody 

to pinpoint changes in code within seconds. 

We can accomplish the same for database development 

by increasing the granularity in source 

control. Rather than checking in one big chunk of 

data (e.g., a one-file build script), we need to break 

down the repository representation of the database 

into many small pieces. Clearly we will need 

tool support for this. Ideally, such a tool supports 

round-trip engineering, which means we can build 

a database right from a local checkout folder of 

the repository (working copy), make changes to 

the database using tools such as SQL Management 

Studio, and script out the database to the local 

checkout folder again in order to check in only a 

few modified pieces. 

Figure 1 shows the file-based representation of a 

database as it was created by the DbGhost tool from 

Innovartis. Each entity in a database (such as a table, 

stored procedure, or login, etc.) is scripted to an 

individual file. Furthermore, in this screenshot you 

can see the overlay icons from TortoiseSVN (the UI 

for source control tool Subversion). At a glance, you 

can detect which parts of a database were changed 

(the red exclamation mark) or which parts are new 

(the blue plus). 

38 


Tools 

Such a fine-grained, file-based approach provides 

a number of great benefits: 

• Results in a very detailed trail of changes in 

source control 

• Establishes a direct correlation between source 

code changes and database when you check in 

modifications from both parts at the same time 

• Enables incremental and fast updates of working 

copies/local checkout folders (no need to update 

a binary BLOB of hundreds of megabytes with 

every database change) 

• Allows for all the standard source control operations 

such as branching, merging, or tagging 

Furthermore, proper database source control is 

the foundation of any of the advanced techniques 

that I discuss in the remainder of this article. 

As a side note I'd like to mention that many tools 

provide their own proprietary storage type and 

format, which is not necessarily text-based like the 

one shown above. Rather, they use a proprietary 

format, such as snapshot files or a SQL database 

as source control repository. While this approach 

might be better, e.g., with regards to performance, 

I prefer a purely file-based approach because it 

tightly integrates with the same source control 

system used for the related software project. 

Concurrent Development 

I have seen many software projects rely on 

databases where database development was a 

true bottleneck, unpredictably delaying software 

development. Looking closer into these projects, 

it turns out that in these cases only one developer 

would be allowed to work on a database because 

concurrent development was not be feasible. This 

directly relates to the suboptimal versioning practices 

that I outlined in the beginning of this article 

because none of these projects was able to cope 

with concurrent changes to a database by multiple 

developers. 

What would concurrent database development 

look like when using a fine-grained database 

representation? First of all, there are two major 

approaches, each with its own pros and cons: 

• Shared database: All developers work on the 

same development database and make their 

changes. 

• Sandbox approach: Each developer works on 

a local, isolated copy of the database, created 

directly from the repository. 

In my opinion, the latter approach clearly wins 

because of the complete isolation of development 

environments. Once a developer completes a work 

package, he will script out the database, run tests, 

and check in his changes. 

The interesting part is to see what happens in 

Figure 1: File-based representation of a database 

the case of merge conflicts. First of all, the chances 

that two developers will change the same database 

object are already much lower when using a finegrained 

representation. Second, a good source control 

tool will be able to merge most of the changes 

automatically (e.g., both developers modified a 

different column). But just as when working with 

regular source code, an automatic merge can (and 

will) fail periodically, producing a merge conflict 

that needs to be resolved manually. Figure 2 shows 

how the process to resolve this merge conflict 

works. 

For the most part, such an approach will take 

the guesswork out of merging conflicting changes 

in database development and 

enable concurrent development 

by multiple developers, 

effectively eliminating the 

typical bottleneck encountered 

in linear development. 

UPGRADING 

PRODUCTION SYSTEMS 

The last problem I will write 

about in this article is related 

to upgrading databases in 

production systems. After 

deploying a number of applications 

of, let’s say, version 

1.0, your customers likely start 

busily collecting gigabytes 

of valuable business data. 

Chances are, when version 

2.0 comes out, the underlying 

database schema will have 

gone through quite a number 

Figure 2: Merge conflict upon check-in 


39

Tools 

Figure 3: Creating and applying an upgrade script 

of changes in the following areas: 

1. Programmability: Stored procedures, user-defined 

functions and triggers 

2. Database schema: Tables, columns, constraints, 

primary and foreign keys 

3. Static data: Lookup tables, categorizations, dictionaries, 

etc. 

In the first category, the changes are fairly easy to 

deal with by simply dropping and re-creating these 

programmability objects. The real problem arises 

with changes of type 2 and 3. 

Some changes to the database schema are 

simply additions, such as new columns or tables. 

However, other changes are the result of complex 

refactorings, data normalizations or denormalizations. 

The key to any database upgrade strategy is 

to transform your customers’ live production data 

in such a way that no data gets lost and that the 

transformed data adheres to all constraints and is 

coherent with what your application expects. 

In general, there are two strategies to perform 

such an upgrade: 

• Create an empty database of v2.0 and move all 

v1.0 data over while performing the necessary 

transformations. 

• Perform an on-the-fly upgrade by executing a 

sequence of small schema changes and data 

transformation steps to bring the v1.0 production 

database to v2.0. 

While the first approach can be somewhat easier, 

the drawbacks are obviously the need for twice the 

disk capacity and possibly lengthy upgrades, as 

gigabytes of data need to be moved from one database 

to the other. So let’s see how we can establish 

a predictable and reliable process to develop onthe-fly 

database upgrade scripts. 

Again, the key to success is tool support, this 

time using a database synchronization tool. Such a 

tool takes a source and a target database, compares 

all database objects between the two (schema, 

data, programmability, and security), and then 

upgrades the target database by creating, modifying 

and dropping objects in the target database. 

The result of this synchronization process is two 

exact database copies. During the synchronization, 

the DB sync tool will record a SQL script with all 

executed commands, which will allow replaying 

the upgrade process later. 

Figure 3 outlines the principal process of creating 

an update script: 

1. Build database v1.0 from source control (target 

database). 

2. Build database v2.0 from source control (source 

database). 

3. Synchronize the two databases and record the 

synchronization process as upgrade script. 

4. Generalize the automatically created upgrade 

script by rearranging and enhancing it with data 

transformations to prevent data loss. 

5. Most important: Verify your upgrade script by 

upgrading a new database v1.0 to v2.0. Use the 

database comparison function of your DB sync 

tool to test whether the upgraded DB is truly 

identical to the database v2.0 created straight 

from the repository. 

Steps 1 through 3 can easily be automated 

through scripting and the like. The intermediate 

result of Step 3 is a script specific to upgrading 

your development database from v1.0 to v2.0. 

However, this script is not yet suited to upgrade 

production databases. The following is a simple 

example that explains why. Let’s say you performed 

a database refactoring and renamed a 

table from T1 to T2. A synchronization tool will 

only see a missing table T2 and an obsolete table 

T1 in the target database since it doesn’t know the 

semantics of a rename operation. Therefore, during 

synchronization it will drop the obsolete table 

T1, create the missing table T2, and then populate 

the new table T2 with whatever data your development 

database v2.0 contained. If you applied the 

recorded upgrade script to a production database, 

the result would be data loss, as it drops table T1 

during the upgrade. 

The process of generalizing this specific upgrade 

script through enhancing and correcting will be 

more or less complicated, depending on how much 

guidance the synchronization tool provides. An 

excellent example for such guidance is shown in 

Figure 4, a screenshot taken from DbMaestro by 

Extreme. As you can see, the script is annotated 

with a number of warnings about potential data 

loss. Continuing our table rename example, such an 

annotated script would easily allow you to match 

the CREATE statement for table T2 and the DROP 

statement for table T1, and manually replace them 

with an sp_rename statement. In more complicated 

database changes like (de)normalizations and refactorings, 

you will actually need to create data trans- 

40 


Tools 

formations, e.g., through UPDATEs and INSERTs, 

and place them before any lossy schema changes. 

Unfortunately, I’m not aware of any tool that currently 

recognizes operations, such as renames, and 

automatically creates the corresponding schema 

upgrade and data transformation operations. However, 

there are a number of best practices you can 

use to facilitate the process of creating a generalized 

upgrade script: 

• During database development, check in often, 

preferably after each work item or refactoring 

step (just as when working with source code). 

• Document the operations performed on each 

database revision, such as 'Normalized Table A 

into Table A and B’ or ‘Renamed Table C to D’. 

This will give better clues to the person generating 

the upgrade script. 

• Rather than trying to create one huge upgrade 

script that spans dozens of revisions, create and 

concatenate multiple small upgrade scripts, each 

spanning only a few or even just one revision. 

Summary 

In this article I showed several techniques for addressing 

common problems in database development. 

A proper integration into source control is 

the foundation for any advanced technique such 

as concurrent development, testing, or creating 

upgrade scripts. 

Prerequisite to each of these techniques is tool 

support (see the References section below). Speaking 

for myself, I have yet to find the perfect tool for 

all these tasks as each tool has its own strengths 

and weaknesses. Therefore, it might even make 

sense to work with two individual tools, depending 

on the tasks that you need to perform. 

Lastly, I need to mention that for all the techniques 

described in this article I could only give a 

high-level introduction. Each one of them requires 

a certain amount of practice to use it efficiently, 

such as handling the check-out/check-in process 

confidently, consequently re-testing the build 

script before checking in, and getting an eye for 

manipulating automatically generated upgrade 

scripts. Nevertheless, you now should be on your 

way to establishing a reliable database change 

management process with predictable outcomes 

tailored to your own needs. 

References 

• Ambler, S.W. (2003). Agile Database Techniques. 

Wiley. 

• Appleton, B., Berczuk, S., Konieczka, S. (2004). 

“Applying Agile SCM to Databases.” Crossroads 

News. January. www.cmcrossroads.com/articles/ 

agilejan04.pdf 

• ApexSQL: http://www.apexsql.com/ 

• DbGhost: http://www.dbghost.com 

• DbMaestro: http://www.dbmaestro.com 

• Revision Control: http://en.wikipedia.org/wiki/ 

Revision_control 

• SQL Tools: http://www.redgate.com 

Figure 4: Upgrade script with warnings about lossy schema changes 

Advertiser Index 

ADVERTISER URL PHONE PG 

InterSoft www.intersoftpt.com/webuistudio 2 

IBM IBM.COM/TAKEBACKCONTROL/FLEXIBLE 3 

telerik www.telerik.com/ajaxvideos 4 

ESRI www.esri.com/develop 1-888-288-1277 6 

ActiveEndpoints www.activebpel.org/soa 9 

MapInfo www.mapinfo.com/sdk 11 

Synaptris www.intelliview.com/netj 1-866-99IVIEW 13 

Kapow www.kapowtech.com 23 

Gate.com www.gate.com/supercharge 886-233-0602 31 

CFDynamics www.cfdynamics.com 866-233-9626 33 

Franklins.net www.franklins.net 877-273-4838 43 

Visual Paradigm www.visual-paradigm.com 45 

Hosting.com www.hosting.com 51 

Parasoft www.parasoft.com/JDJmagazine 888-305-0041X3501 52 

General Conditions: The Publisher reserves the right to refuse any advertising not meeting the standards that are set to protect the high editorial 

quality of .Net Developer’s Journal. All advertising is subject to approval by the Publisher. The Publisher assumes no liability for any costs 

or damages incurred if for any reason the Publisher fails to publish an advertisement. In no event shall the Publisher be liable for any costs or 

damages in excess of the cost of the advertisement as a result of a mistake in the advertisement or for any other reason. The Advertiser is fully 

responsible for all financial liability and terms of the contract executed by the agents or agencies who are acting on behalf of the Advertiser. 

Conditions set in this document (except the rates) are subject to change by the Publisher without notice. No conditions other than those set forth 

in this “General Conditions Document” shall be binding upon the Publisher. Advertisers (and their agencies) are fully responsible for the content 

of their advertisements printed in .Net Developer’s Journal. Advertisements are to be printed at the discretion of the Publisher. This discretion 

includes the positioning of the advertisement, except for “preferred positions” described in the rate table. Cancellations and changes to advertisements 

must be made in writing before the closing date. “Publisher” in this “General Conditions Document” refers to SYS-CON Publications, 

Inc. This index is provided as an additional service to our readers. The publisher does not assume any liability for errors or omissions. 


41

Monkey Business 

A Short History of Basic on Mono 

Mono gets new VB compiler and runtime 

By Dennis Hayes 

About the Author... 

Dennis Hayes is an independent 

software consultant in Atlanta, 

GA, and has been involved with 

the Mono project for over four 

years. 

dennisdotnet@yahoo.com 

HThe highlight of this release is the new 

MonoBASIC compiler and runtime. The 

availability of BASIC on Mono has waxed 

and waned over the years. During the early days 

of Mono, BASIC received little or no attention. The 

biggest reason was that all the effort was going 

into the C # compiler. In addition, the early Mono 

adopters were not very interested in VB; in fact at 

the time, there was much debate in the VB community 

in general about upgrading to VB.NET because 

of the complexity of 

VB.NET, and the lack of 

backwards compatibility 

with VB6. Also, unlike C# 

which was released as a 

ECMA and ISO standard, 

VB.NET was, and still is, 

a proprietary product 

with no publicly available 

definition (that has 

the details needed by a 

compiler writer). 

As time went on and 

more programmers 

joined Mono, several 

people started to work 

on a VB.NET compatible 

compiler based on a fork of the C# compiler. Also, 

work began on the Microsoft.VisualBasic and Microsoft.VisualBasic.CompilerServices 

namespaces. 

BASIC on Mono received a big break in 2004 

when Mainsoft donated a complete copy of the 

VB.NET runtime libraries written in Java (see .NDJ 

Vol. 2 Iss. 6). A group of Mono developers, including 

myself, converted the libraries into C#. 

As more people began to use Mono as a Web 

server, BASIC, and the BASIC compiler became 

more important because of the large number of 

Web pages being written in VB. Because they were 

compiled on the fly, they could not be compiled 

using the Microsoft compiler, and then executed 

under Linux like applications could. At this point, 

Novell put a group of programmers on the Mono- 

BASIC compiler project, and for a while, good 

progress was made. With the release of .NET and 

ASP.NET 2.0, ahead of time compilation of VB code 

became possible; BASIC 

for Mono was sent to the 

back burner, and the coders 

working on MonoBA- 

SIC were set to work on 

System.Windows.Forms, 

which is needed for the 

Mono 1.2 release. 

Now, Mainsoft has 

made another major 

contribution to Mono by 

donating a set of VB.NET 

runtime libraries (written 

by Rafael Mizrahi and 

Boris Kitzner) written in 

BASIC with two test suits: 

one to test low level functions 

that is written in C#, and one to test high level 

functions that is written in BASIC. 

Combined with the new VB9 compatible 

MonoBASIC compiler written by Rolf Bjarne as 

part of the Goggle Summer of Code, which can 

now compile itself, Mono is close to having a full 

VB.NET compatible stack. Currently the new BASIC 

runtime is being distributed with the standard 

Mono package, but since the new VB 2005 compat- 

“There is a new way to test drive Mono, along with SUSE 

Enterprise Edition version 10.0; VMWare has a free virtual OS 

“player” that you install as an application” 

42 


ible compiler is just at the point of compiling itself, 

it is being distributed in a separate package until it 

matures a bit more. 

Other Additions to Version 1.1.17 

The big news in System.Windows.Forms (SWF) is 

support for printing; this was one of the last major 

parts of SWF still not implemented. The key to 

implementing printing was upgrading to the new 

version (1.2) of Cairo. 

COM is now beginning to be supported with the 

addition of Runtime Callable Wrappers (RCWs), which 

allow managed code to call unmanaged components. 

The Postgress database classes have been updated 

to support Postgress Release Candidate 3. 

IronPython 1.0 RC2 is now supported, System. 

IO.Ports includes much more functionality, and the 

registry code has been updated to support the .NET 

2.0 API. There were also a number of significant 

improvements made throughout Mono. The complete 

lists can be found at http://www.go-mono. 

com/archive/1.1.17/ and http://www.go-mono. 

com/archive/1.1.17.1/ 

Odds and Ends 

There will be a meeting of the Mono developers 

on October 23rd and 24th in Cambridge Ma. See 

http://www.go-mono.com/meeting/ for details. It is 

open to all, so drop in if you can make it. 

There is a new way to test drive Mono, along 

with SUSE Enterprise Edition version 10.0; VMWare 

has a free virtual OS “player” that you install as an 

application. The application can then play a “disc” 

containing any operating system created by the 

“full” version of VMWare. Novell has released a 

“disc” that can be played by the VMWare “player” 

which contains the full version of SUSE, including 

Mono and many applications, both native and 

Mono based. 

The second Goggle Summer of Code has been 

completed. Portable.NET had a student who 

mostly completed his task of porting Libjit to the 

Alpha processor. There have been a number of 

other improvements in Libjit since the last release.MonoDevelop, 

the .NET integrated development 

environment for .NET on Linux has released 

version 1.2. This IDE is really maturing, so I will 

cover this release in more detail next month, 

but in the mean time, you can read the release 

notes and see some screen shots at http://www. 

monodevelop.com/Release_notes_for_MonoDevelop_0.12. 

Now that Callisto, the simultaneous release of 

10 projects related to the Eclipse IDE, has been released, 

plans are being made for next year’s release, 

tentatively dubbed Europa 

Monkey Business 


43

First Look 

A First Look at Visual 

Studio 2005 Code Snippets 

Why didn’t we get this sooner? 

By Tommy Newcomb 


Tommy Newcomb works for Magenic as an 

IT consultant in the Chicago area. 

His main focus is developing Web application 

and E-commerce work using Microsoft 

technologies. He lives with his wife, Emily, 

and baby daughter, Jaqueline, in the Chicago 

suburbs. 

zoomonkey@gmail.com 

Every now and then a new development tool 

comes along that is so simple and elegant it 

leaves us wondering, why didn’t we get this 

sooner? Introducing Intellisense Code Snippets, it’s 

a new feature available in Visual Studio (VS) 2005 

that makes inserting routine code much faster and 

easier. 

Using snippets is as simple as right-clicking in 

the IDE and left-clicking on the Insert Code Snippet 

pop-up. This opens the Visual Studio Code 

Snippet Picker, similar to Intellisense, which lets 

you insert pre-packaged code statements directly 

into your class. There’s nothing extra to install or 

download so you can start using snippets packaged 

with VS 2005 immediately. 

Visual Basic (VB) and C# both take advantage 

of snippets; however, VB seems to have been the 

target language for the snippet designers while C# 

was more of an afterthought. C# has most of the 

same functionality, but not quite. In this article, I’ll 

use both languages and make sure to point out the 

differences along the way. If you’re attached to a 

certain language you needn’t worry; they both have 

their advantages and disadvantages and behave 

almost identically. 

The benefits that you’ll gain from using snippets 

are twofold. First, they reduce repetitive, time-consuming 

typing. For example, if you intend to write 

something common like a For loop, try…Catch 

block, or an If statement. You needn’t waste time 

typing the code for these simple statements. Your 

snippet will be inserted and you only have to 

modify the parts of the statement specific to your 

code. 

The second and perhaps greater value is that you 

no longer have to remember the exact syntax for a 

particular statement. If, for example, you needed to 

create a task-oriented snippet that’s more complex 

than an If statement, such as code that will create a 

parameterized stored procedure, an inserted snippet 

will give you a perfect example. This eliminates 

that Google-search crapshoot that we do when we 

can’t quite remember the exact syntax. 

Again, to get started you can begin today by 

using the packaged snippets in the IDE, but there’s 

much more to snippets through customization as 

we’ll see. There are dozens of snippets provided 

in VS 2005, and there are many more available for 

download. This article will show you how to create 

your own snippets, modify existing ones, and demonstrate 

how to create your own snippet library to 

improve your productivity, giving you an edge as a 

highly productive developer. 

Inserting Snippets 

We’re ready to insert our first snippet. While in 

the VS 2005 IDE, you can right-click where you’d 

like to place your snippet and select the Insert 

Snippet…command from the Snippet Inserter 

menu. In VB only this same step can be accomplished 

by typing “?” then the Tab key. When you 

do this you’ll notice several sub-categories, such 

as Collections and Arrays, Common Coding Patters, 

etc. When you select a sub-category and then 

select a particular snippet, a tool tip displays both 

a description of the snippet and its shortcut value. 

If you know your snippet’s shortcut value, you 

can skip all of this clicking and simply type in the 

shortcut then hit the Tab key to insert your snippet 

of code. 

For many snippets, the shortcut value is the 

same as the first word in the statement. So, if you 

wanted to throw an exception in your code you 

simply type “throw” then hit the Tab key and it 

appears. If you aren’t quite sure what your snippet 

shortcut is, you can find it by typing a portion 

of the keyword. So when you type “Try” then “?” 

then hit the Tab key, all of the exception-handling 

statements show up in the Snippet Inserter for you 

to choose. If you don’t like your inserted snippet, 

executing a Ctrl-Z will remove it as quickly as it appeared. 

Many times you have existing code that needs 

to be modified. Snippets are intelligent in that they 

44 



45

First Look 

don’t always overwrite existing selected code with 

your insert. If, for example, you have existing code 

and you want it surrounded with an If statement, 

you can highlight the code and insert your snippet. 

Your selected code will remain and your If and End 

If tags will surround it. A big time saver for me is 

when I have to add Region tags to my code. Using 

snippets I select the block of code that I want inside 

my Region and Insert Snippet and – voilà – it’s 

done. It saves scrolling, cursor placement, mouse 

handling, and typing. 

If your snippet code relies on an Imports statement 

or a project reference, VB will add the necessary 

Imports and project references as well. It’s here 

that VB has an advantage over C#. 

We can see that code snippets have more intelligence 

than simply cutting and pasting code. In 

this next VB example, notice how we can insert a 

Generic List item snippet by choosing: Insert Snippet 

| Collections and Arrays | Create a list with items 

of a single Type. 

Names and names from the list. Pretty cool, huh? 

The following code is inserted: 

‘ Backing storage -- a generic list 

Dim names As New List(Of String)() 

‘ Add an item to the Collection 

names.Add(“John”) 

The areas that are specific to your code that require 

a change are highlighted in green. Hitting the 

Tab key will quickly move your cursor over these areas; 

hit shift-tab to reverse. The highlighted linked 

items, such as the names variable in our code, all 

change to the same value when one occurrence 

is changed. It’s smart enough to know that we’re 

naming all the variables in our statement the same. 

When you’re finished making changes to a field, hit 

the Escape key to commit and move on. 

Now, suppose that you want to loop through 

the previously inserted Generic List using a For 

Each…Next statement. Click Insert Snippet | Common 

Coding Patterns | Conditionals and Loops | For 

Each…Next Statement. 

When your cursor is on the first variable name, 

in this case Item, if you hit Ctrl + Space, a list of 

all your declared variables (of the same type as 

the cursor replacement) will pop up. This lets me 

choose from my previously declared variables in 

this selectable list. Notice that I can select my- 

Note that in VB once your snippet has been inserted 

and modified it will remain highlighted until 

you close the file and all its associated files (like a 

Form’s design view). 

Snippets: Inside the Magic 

Let’s take a look inside the Generic List snippet 

that comes with VS 2005. To begin with, a snippet is 

really just an XML file, and the snippetformat.xsd 

schema defines the rules for valid snippets. 

In Listing 1, we use the CreateAStronglyTyped- 

Collection.snippet file located at C:\Program Files\ 

Microsoft Visual Studio 8\VB\Snippets\1033\collections 

and arrays\. These files are easy to modify 

and create, which we’ll get to, but first look at our 

collection-snippet XML. The CodeSnippet element 

defines our entire snippet. The Format attribute in 

the CodeSnippet element is simply the version it’s 

been given. Following that we see the Header, Title, 

and Author tags that are intuitive enough, but notice 

the Shortcut tag. This tag defines the shortcut 

we used earlier when we typed the value and hit 

the Tab key to insert our snippet. 

The Description tag is what you see displayed in 

the Intellisense browser description and does just 

what it says, but you should also note that there 

are three more tags that can be used in the Header 

tag: Keyword, HelpURL, and SnippetTypes. The 

Keyword element(s) provide a standardized way of 

searching through snippets, the HelpURL is simply 

a help file reference link, and the SnippetsTypes are 

a bit more complex – and useful. 

SnippetTypes tell the snippet how to behave on 

insert. There are two types you can use with custom 

code snippets: SurroundsWith and Expansion. 

Expansion simply means to insert the code at the 

cursor. The SurroundsWith tag will actually insert 

46 


the snippet around the code that’s selected. In the 

diagram, I have a couple of lines that are based on 

a condition. 

When I choose Surround With… from the menu 

then the If option, the If code literally surrounds 

my selected text: 

Next, let’s take a closer look at the Snippet element. 

As I mentioned before, only VB supports the 

Reference tag that provides information about the 

necessary references that your snippet requires. 

This is specified under in the snippet element: 

 

System.Windows.Forms.dll 

 

 

 

The Assembly element is the name of the reference 

of course and the URL tag is a link to a more 

detailed description. The Imports is also a potential 

child element of the Snippet element and is 

similar to the Reference element. VS 2005 adds the 

necessary Imports to your code when the snippet is 

inserted: 

 

 

Microsoft.VisualBasic 

 

 

 

To describe the Declarations element, let’s look 

at the following XML taken from VB’s Select…Case 

Snippet in Listing 2. 

Notice that the Declarations element contains 

the Literal and Object elements. These are what 

make automatic code replacement possible. The 

Literal element identifies a replacement placeholder 

for code that’s contained entirely within 

the snippet. Examples of literals might be strings, 

integers, or variable names. The Object element 

identifies a placeholder, required by the snippet, 

which is likely to be outside the snippet itself. ASP. 

NET controls, Windows Forms controls, or an 

instance of an object or type make good candidates 

for this kind of element declaration. 

There’s also an optional element called Function 

that’s only supported in Visual C# and Visual J# the 

details of which are beyond the scope of this article. 

However, I’ll mention that there are only four 

built-in functions (you can’t create your own) that 

essentially specify the function that executes when 

the literal or object receives focus in your code. 

And finally, we come to the code. The code 

element defines the actual code and replacement 

items that will be inserted. Notice the Select…Case 

statement in Listing 2. The code element contains 

the text that’s inserted within the CDATA brackets. 

The $ acts as a delimiter for the replacement literal 

and object. The attributes for the Code element are: 

• Kind – Specifies the type of code the snippet 

has and where the snippet can be inserted. (See 

http://msdn2.microsoft.com/en-us/library/ 

ms171421.aspx for more information). 

• Delimiter – The value that delimits replacement 

variables. The default is: $. 

• Language – Values must be: VB, CSharp, VJSharp, 

or XML 

Building a Snippet From Scratch 

Let’s look at the C# snippet in Listing 3 that I 

created using Notepad. Since C# doesn’t have an 

IsNumeric function, unlike VB, I created one using 

this snippet. It will be the beginning of a snippet 

library that I’ll keep for future use. The file is named 

IsNumeric.snippet. 

The two Literal values in Listing 3 demonstrate 

the use of replacements after the code has been 

inserted. The replacements in the comments section 

are highlighted after the insert is executed. The 

developer then has to change the class name and 

the developer’s values. 

First Look 


47

First Look 

LISTING 1 

Making Your Snippet Available for Use 

Now that we’ve created an XML snippet file, we 

need to make it available to the snippet picker 

using the Code Snippet Manager tool in VS 2005. 

In the VS IDE, select Tools | Code Snippet Manager. 

Here you can browse the snippet folders and gain 

information about the snippets you’ve installed. 

When you select a snippet from your list, you’ll 

see its description, shortcut, snippettype, and author 

information. You’ll only see snippets here because 

the manager filters to only show snippet files. 

The Add button should actually be renamed 

Add Folder, because that’s what it really does. It 

lets you select and add a folder containing snippets, 

not individual snippets themselves. It should 

be noted that when you have a folder selected in 

the manager and you add a new folder it won’t put 

the new folder underneath your selection as you 

might expect. Instead it will be added directly to 

the root. 

The Import button is what you use to add your 

individual snippets. If you choose Import, and select 

your snippet, a new dialog will open up and let 

you place it in your directory structure. I used the 

Import button to add our new IsNumeric.snippet. 

We can see it under the My Code Snippets directory 

in the Code Snippet Manager. 

The remove button removes the folder from the 

manager; it doesn’t, however, remove it from your 

system. Also note that the snippets you see in the 

manager are the ones you’ll be able to insert using 

the Intellisense Snippet Picker. 

And finally, the Search Online button takes you 

to an MSDN search text box where you can search 

for snippets by keyword. However, I’ve had more 

success using Google to find snippets instead. 

Other Tools 

If you’re interested in creating your own snippets, 

and you want to use a tool with more power 

than Notepad, check out the Visual Basic Snippet 

Editor tool located at http://msdn.microsoft. 

com/vbasic/downloads/tools/snippeteditor/. This 

is a shared source initiative project that’s currently 

in RC mode. This tool is essentially a UI application 

that lets you create snippets, add and modify 

parameters like title, author, and description, but in 

a more user-friendly GUI way. It also lets you preview 

your snippet as it will appear in the IDE and 

validates for any compilation errors that may exist. 

A similar tool doesn’t exist yet for C#. Now, there’s a 

project that’s screaming to be developed. 

Security Considerations 

Security considerations are an important issue 

since snippets contain both source code and 

hyperlinks. You needn’t worry about snippets that 

come packaged in VS – unless they’re modified of 

course. However, downloaded snippets have potential 

problems. For one, a file with a .snippet suffix 

doesn’t necessarily mean that it’s plain text XML. 

These files should be scanned with virus protection 

just like any other downloaded file. 

The snippet code itself could be malicious. 

Fortunately, it’s source code and you can read it, 

but if you are unsure of its origin, look it over carefully. 

Another problem that may arise is malicious 

code lurking in collapsed Region tags. You insert 

the snippet, run it, and your system is damaged 

because of code you didn’t see. 

As we discussed above, snippets may contain 

references that are automatically added to your 

project when the snippet is inserted. This may 

reference a file that was downloaded alongside you 

snippet. This could cause damage as well. 

Finally, the HelpURL link in the snippet could 

execute a malicious script on a separate site, or link 

the user to an offensive site. It’s wise to read the 

snippet’s XML before installing it. 

Building a Snippet Library 

I hope that I’ve given you direction in building 

your own personal library, or perhaps, beginning a 

library for your company or organization. Having a 

personalized snippet library helps decrease development 

time and maintain coding standards. My aim 

is to get you started; you can decide how a snippet 

library can help you and your organization. 

48 


introductory 

subscription offer! 

A TRULY INDEPENDENT 

VOICE IN THE WORLD OF .NET 

.NET Developer’s Journal is the leading 

independent monthly publication targeted at .NET 

developers, particularly advanced developers. It brings 

.NET developers everything they need to know in order 

to create great software. 

Published 

monthly, .NET 

Developer’s 

Journal covers 

everything of interest to 

developers working with 

Microsoft .NET technologies 

– all from a 

completely independent 

and nonbiased perspective. 

Articles are carefully 

selected for their prime 

technical content – technical 

details aren’t watered down with 

SUBSCRIBE ONLINE! 

www.sys-con.com/dotnet/ 

or Call 

1 888 303-5282 

Here’s what you’ll find in 

every issue of .netdj: 

Security Watch 

Mobile .NET 

.NET Trends 

Tech Tips 

Standards Watch 

Business Alerts 

.NET News 

Book and Software 

Announcements 

.NET Developer’s Journal is for .NET 

developers of all levels, especially those “in 

the trenches” creating .NET code on a daily 

basis: 

• For beginners: 

Each issue contains step-by-step tutorials. 

• For intermediate developers: 

There are more advanced articles. 

• For advanced .NET developers: 

In-depth technical articles and columns 

written by acknowledged .NET experts. 

Regardless of their experience level, .NET 

Developer’s Journal assumes that everyone 

reading it shares a common desire to understand 

as much about .NET – and the business 

forces shaping it – as possible. Our aim 

is to help bring our reader-developers closer 

and closer to that goal with each and every 

new issue! 

lots of needless opinion and commentary. 

Apart from the technical content, expert analysts 

and software industry commentators keep developers 

and their managers abreast of the business 

forces influencing .NET’s rapid development. 

Wholly independent of both Microsoft Corporation 

and the other main players now shaping the course of 

.NET and Web services, .NET Developer’s Journal 

represents a constant, neutral, expert voice on the 

state of .NET today – the good, the bad, and the 

ugly…no exceptions. 

SAVE16% 

OFF 

THE ANNUAL COVER PRICE 

Get 12 issues of .NETDJ 

for only $ 69 99 ! 

ANNUAL 

COVER PRICE: 

$83.88 

YOU PAY 

$ 

69 99 

YOU SAVE 

$13.89 

OFF THE ANNUAL 

COVER PRICE 

OFFER SUBJECT TO CHANGE WITHOUT NOTICE 


49

First Look 

LISTING 2 

 

 

Variable 

Object 

 

Replace with an expression. 

VariableName 

 

 

Case1 

 

 

Replace with a valid value of the expression. 

 

1 

 

 

Case2 

 

 

Replace with another valid value of the expression. 

 

2 

 

 

 

 

 

 

 

 

classname 

Insert an IsNumeric function 

into your code. 

ClassName 

 

 

developer 

Replace with the developer’s 

name. 

None 

 

 

 

 

/// File: $classname$.cs 

/// Developer: $developer$ 

/// 

/// Description: IsNumeric takes an object 

and returns a true if it’s “numeric” 

/// False if it’s not. 

/// 

/// 

/// 

/// boolean 

internal static bool IsNumeric(object 

anyObject) 

{ 

// IsNumeric tests to see if a passed-in 

object is numeric or not. 

double dOutValue; 

End Select]]> 

 

LISTING 3 ISNUMERIC.SNIPPET 

 

 

 

 

IsNumeric 

Tommy Newcomb 

Inserts an IsNumeric function. 

IsNumeric 

 

Expansion 

return Double.TryParse(Convert. 

ToString(anyObject), System.Globalization.NumberStyles.Any, 

System.Globalization.NumberFormatInfo.InvariantInfo, 

out dOutValue); 

}]]> 

 

 

 

 

50 



51

52 

September 2006 Volume: 4 Issue: 9 

Visit us at www.dontnetdevelopersjournal.com

DNDJ 4-9.indd - sys-con.com's archive of magazines - SYS-CON ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?