Password Management for Mortals

3

This is a quick post aimed at my non-technical friends and family which I’ve been meaning to publish for some time. I am reminded of my intentions every time I hear someone lament that they have too many passwords to remember, or reveal that they use the same handful of passwords for all sites that they frequent (usually incorporating the names and birthdates of their nearest and dearest).

Do I need to recap why password reuse is a very bad thing?

xkcd792

(and it’s not just the black-hats you have to worry about, it’s the incompetent service providers too, as the recent well-publicised hacks of Gawker and the PlayStation Network have shown).

So, what is my suggested solution to this problem of the modern age?

I have long since given up trying to memorise passwords, or indeed racking my brain devising suitably strong passwords for each site I visit. There are many fine password management applications out there which excel at both these tasks – I use and endorse KeePass Password Safe, a free and open-source application which is available for many platforms, including Windows, Linux and Mac OS.

keepass

By saving my KeePass password file to my DropBox, I have all my credentials easily available from all the machines I use at home and on client sites. Both DropBox and KeePass have apps available on Android (and iPhone), so my credential management solution neatly extends into my mobile life (and means I always have a copy of my passwords to hand – useful for when evil clients choose to block DropBox).

Yes, I still need to memorise at least one password (to protect the actual KeePass file) – this is a lengthy pass phrase chosen using techniques similar to those described in this XKCD comic.

If you’re still relying on your grey matter to retain an ever-expanding list of passwords, I strongly recommend you consider offloading the burden to some dedicated software such as KeePass. Then take the time to visit all the sites you frequent and change your weak, oft-used passwords for unique high-entropy ones.

Amazon Recommendation Of The Day

1

I’m not saying that I wouldn’t enjoy watching Birdy the Mighty: Decode 2, you understand; it’s just that I’m uncertain how Amazon came to this conclusion based solely on my choice of secondary input device.

Of course, now that I’ve clicked on the DVD out of curiosity, Amazon’s homepage has me pegged as a veritable manga fiend…

See also – Amazon’s Uncannilly Accurate Recommendation Algorithm

Schoolboy Error Of The Day

4

This dumb mistake just cost me an hour spelunking around in the debugger:

var status = source.Substring(source.LastIndexOf("/" + 1));

(where source is e.g. “http://foo.com/status/all-is-good”)

Fortunately the ramifications were picked up in the acceptance tests, but the root cause wasn’t at all obvious from such a high level.

Lesson for the day – code is never too trivial to warrant unit testing.

Google+ – By Jove, I Do Believe They’ve Got It!

1

So last week Google, in keeping with their modus operandi when launching major new properties, started trickling out public invitations for Google + – their latest attempt at capturing some of the lucrative social-networking market share from the likes of Twitter and Facebook.

Yes, yes, I know what you’re thinking – another social networking site? Another place to maintain a social graph? Another URL to check during my lunch hour?Another profile demanding upkeep with details of my top 10 favourite episodes of Buffy and frequent whimsical status updates? Do I really have the time and inclination for this? Can I, to put it bluntly, be arsed?

If this is your reaction to the G+ launch then I understand where you’re coming from. I felt the same way back in April 2007 when I blogged about experiencing social networking fatigue. And having seen the piss-poor attempts at networking that were Buzz and Wave, I too adopted a sneering, sceptical demeanour when confronted with my first view of Google+.

And yet, and yet… despite all those misgivings, I have to say that Google+ is really rather magnificent.

There’s obviously no first-mover advantage here, and while some of the peripheral functionality (huddles, hangouts, background uploading of photos from smartphones) is innovative, much of the core of the site is evidently influenced by the standard FaceBook layout. This is simply social networking done well. Really well. All the best ideas from Facebook and Twitter, implemented beautifully, without the downsides. Let me stop rambling and try to enumerate some concrete examples.

As a consumer of information, one of things I love about Twitter is the asymmetrical relationship model – I am free to follow the public thoughts of Paul Daniels, Bill Gates, The Queen and (of course) Stephen Fry without (fortunately) requiring them to reciprocate. But as a creator of information, sometimes I wish to post status updates which are shared only with close friends and family, which is where Facebook comes into its own.

But this is an imperfect separation of concerns – Twitter posts from genuine friends can get lost amidst the chaff, the 140-character restriction on Tweets can stifle debate or lead to misinterpretations, whilst posting to Facebook can feel like pointlessly cultivating a walled garden with no chance of one’s musings reaching a wider audience.

G+ succeeds in squaring this circle by introducing the concept of, well, circles! That is, people can be grouped into arbitrary sets – friends, family, acquaintances, crushes, colleagues, folks from your badminton club, people to diligently ignore, whatever. People are told that you’re now following them in some way, but are not told the name of the circle(s) into which you’ve chosen to place them.

From a consumption point of view this is admittedly similar to Twitter’s Lists. But G+ Circles also have a bearing when posting – you can specify which of your Circles may view each post (or indeed choose to make the post public). Crucially, the maintenance of Circles is simplicity itself, executed through an impressive UI that is a joy to use. You’re also prompted to add people to Circles when first choosing to follow them – privacy by default.

On the face of it, G+ might appear to be Yet Another site to check, but the enhanced Google Bar now adorning the top of sites I already check habitually (GMail, Google Reader, Google News, Google Finance…) means I’m unlikely to ever stray far from rich G+ notifications or indeed a way of sharing and publishing posts to G+. I’ve already disabled the majority of the email and mobile G+ notifications as I find them redundant given the amount of time I spend in front of a web browser.

There is no app platform on G+, which means that streams are, for now, mercifully free of incessant and vacuous messages along the lines of “Bob just fed his goat in Farmville!”. The downside is that neither is there an API, which limits the integration possibilities. I’m led to believe this is currently under development.

It’s too early yet to predict whether G+ will reach a sufficiently critical mass to be a "FaceBook killer". I suspect that whilst G+ might instinctively appeal to geeks, the migration of the broader population could take some time. But I hope that happens, and I look forward to logging onto FaceBook less frequently in the future.

Two of My Earliest “Blog Posts”

0

Unfortunately the author is not cited, but I’m almost certain that I wrote these two entries for the BBC’s 1986 Domesday Project:

Happy memories.

For some background see The Story of Domesday.

Yes, That Can Be My Next Tweet!

0

This site cracks me up!

http://yes.thatcan.be/my/next/tweet/

ytcbmnt

It’s a Small World

3

It’s been a long time since I posted a blog entry tagged with “genealogy” (over three years, in fact). I find it to be a hobby that I pursue in fits and starts – periods of all-encompassing obsession followed by long periods of total inactivity. But the old Family Tree has been fleshed out nicely since I last updated you, dear reader. It has also acquired a most surprising and welcome addition.

My Dad and his Granny, Isabella BirrellI’ve continued to concentrate on improving the quality and depth of the records and sources that I hold for more recent generations, rather than attempting to trace lines far into the dim and distant past. As more and more contemporary records are released into the public domain (and increasingly placed online as a matter of course), this task becomes easier, and throws up the possibility of making the kind of startling discovery that I encountered last Wednesday evening.

Those of you living in the U.K. will be aware that every household was required by law to complete a decennial census return last month. A few days later, under the 100 year rule, the 1911 census of Scotland was made available online at the Scotland’s People website. I had been eagerly anticipating this event since developing an interest in my family history, so I wasted no time in scouring the records for additional details of my relatives from north of the border.

It wasn’t long before this new trove of data revealed that my great-grandmother, Isabella Birrell, had an additional sibling that I wasn’t previously aware of, named on the 1911 census as “Annie”, aged 5.

A quick cross-reference with the birth records and I learned that the full name of my newly-found great-great-aunt was Ann Cunningham Birrell, born 1905.

I then searched the marriage records to see if Ann had ever wed, which was when things started to take an unexpected twist:

Marriage_JohnConners_AnnBirrell_1933

John Conners from Dundee? Now why does that ring a bell?

jc

Oh yeah! That’ll be it Winking smile I have a very good friend named John Conners who I met when we worked together at Marshalls for a little over two years, and he hails from Dundee too! Coincidence? I dropped him a quick email containing details of Ann and his namesake. Thirty minutes later I received his reply:

jcemail

Well, it looks like this. John’s grandmother is the younger sister (by almost 20 years) of my great-grandmother Isabella. Which makes John and I second cousins once removed!

JamesBirrell

To be honest this news is still sinking in, and I’m not sure what comments to make or conclusions to draw. Except to say that it truly is a small world, and when embarking on seemingly prosaic family tree investigations, you just never know what you might discover. After five years of “bone-digging” and adding the names of often ancient and obscure relatives into my family tree, it’s a very strange feeling to be adding the details of a good friend and erstwhile colleague to that same database.

Oh, and John – welcome to the family, cousin!

Entity Framework Week Part 5: Concluding Thoughts

0

This is the fifth in a series of five posts recounting my experiences using Entity Framework Code-First to replace ADO.NET and stored procedures in a client’s existing application. The introductory post in the series is here.


I am lucky to have had the opportunity to spend a time-boxed period playing with Entity Framework Code-First in a real-world scenario, and to get paid for the privilege! I now have a clearer understanding of how it has progressed during the last few years, what its strong points are, and where it still has shortcomings compared to the much more mature NHibernate framework.

The Positives

I have to say that after a week of getting through the pain barrier and the initial denial of working with an unfamiliar ORM, I have reached a level of understanding and acceptance with Entity Framework. It really isn’t all that bad (at least the Code-First flavour), and if you don’t stray too far from its rigid way of thinking it will help you to get a solution up and running quickly and reliably. It’s certainly a far preferable option than mucking about with ADO.NET and stored bloody procedures, that’s for sure.

The whole process of configuration and initialization is straightforward and pain-free, with the derived DbContext providing a out-of-the-box implementation of Unit of Work already to be referenced from your consuming code. Easy.

Querying the model is 99% unadulterated LINQ, with the occasional call to Include to perform some eager fetching – what could be simpler?

I’m also unashamedly impressed with how easily EF can be used to power ASP.NET Dynamic Data sites, and RESTful WCF Data Services. Nice.

The Negatives

I found that the real pain of working with Entity Framework only surfaces when you wish to start tuning its behaviour in any way – you find that it’s a big black box with few extensibility points. It performs cunning tricks effortlessly, but wields its power in a largely indiscriminate manner. By comparison, NHibernate can achieve even greater things, but requires you to explicitly invoke these powers.

I am reminded of a response Ayende gave when asked why NH Futures was not the default behaviour – “NHibernate tries hard not to make too much magic”. I thought it sounded glib at the time, but having lived with EF for a while, I now understand why this is preferable.

Most of the NHibernate features that are missing from Entity Framework are related to performance – such as the ability to configure query batching, write batching, bulk operations, extra-lazy properties, and second-level caching. These are the features you’ll miss the most when you’re some way into a project, perhaps not until it’s in production and scalability issues arise.

I also feel the CTP5 of EF code-first is a little way off offering true support for persistence ignorance and POCO, having experienced a number of issues that required me to change my domain model, database schema, and application code.

Additional Resources

Here are a few of the resources that I found particularly useful during my EF week:

Entity Framework Week Part 4: Features and Further Investigations

0

This is the fourth in a series of five posts recounting my experiences using Entity Framework Code-First to replace ADO.NET and stored procedures in a client’s existing application. The introductory post in the series is here.


I didn’t want this series of posts to descend into a point-scoring NHibernate-versus-Entity Framework comparison, but…

I now have a basic proof-of-concept up and running, with my client’s nascent application now being powered by Entity Framework Code-First CTP5 rather than a hand-rolled DAL. So, I had some time to consider future functional and non-functional requirements that the team would be asked to develop and support, and investigate how EF would meet the challenge.

Caching

I was genuinely surprised to learn that Entity Framework still doesn’t include any out-of-the-box support for integrating second-level caching, for example to cache reference data. It seems there is a body of opinion stating that caching should not be the responsibility of the data access layer. I disagree, and I think this is one of the major benefits NHibernate still has over Entity Framework, with its multiple flexible and configurable second-level cache providers.

Targeting Alternative Providers (SQLite)

When working with NHibernate, I often target SQLite for fast integration tests against an in-memory database, rather than maintaining a testing version of the MSSQL/Oracle databases that my applications usually use for their bitbucket. I was pleased to see the discussions on the System.Data.SQLite page suggesting that this approach is possible with Entity Framework too, but I didn’t spend any time attempting to get this working.

Auditing Functionality

Entity Framework does not appear to support the rich events and listeners model that is offered by NHibernate and frequently used to develop application auditing functionality. The recommended solution to achieve this scenario is to override the virtual SaveChanges method on DbContext and add validation and auditing logic there. For more details, see page 261 of Programming Entity Framework.

Bulk Operations

I have not yet encountered any Entity Framework support for bulk update/delete operations akin to NHibernate’s Executable DML functionality. Such requirements are usually relatively rare, but it’s a shame to have to fall back to writing stored procedures for relatively simple operations which can be described in terms of the domain model.

Query Batching

There does not appear to be any way to do query batching in Entity Framework, as per NHibernate Futures. Multiple queries result in multiple network trips to the database, sadly. Similarly, there’s no support for write batching and batched collection loads.

Concurrency and Versioning

Entity framework supports optimistic concurrency. Chapter 23 of Programming Entity Framework explains in detail how this can be configured and utilised by your application. Entity Framework also supports rowversion fields for concurrency checks.

Extra-Lazy Properties

Unlike NHibernate, Entity Framework currently has no notion of “extra-lazy” properties. Requesting the Count of a child collection (e.g. Order.Lines.Count) will therefore trigger the loading of all entities (Lines) in the child collection. Not nice. Yes, we can work around this by making the appropriate count query at a higher level but it’s much nicer to be able to traverse the domain model relationships and let persistence ignorance work it’s magic.

Integration with the Wider .NET Stack

To my mind, one of the key selling points of Entity Framework over NHibernate is its out-of-the-box integration with other areas of the .NET stack – notably the ability to power ASP.NET Dynamic Data sites (which are great for simple pages to maintain reference data) and WCF Data Services.

Query Techniques

NHibernate offers a world of choice when it comes to methods for querying the model: HQL, Criteria, QueryOver, LINQ, Named Queries, etc. These each offer a plethora of possible options and tweaks including query caching, batching and futures. By comparison, Entity Framework offers a comprehensive LINQ provider (with decent extensions to specify eager-loading of child entities), or Entity SQL. And that’s your lot.


By the end of my fourth day, I had a working proof-of-concept using Entity Framework Code First to power my client’s application, and I had a good idea of how suitable it was to meet future requirements lurking in the product backlog.

In the fifth and final part of this series of posts, I’ll write some concluding thoughts on my overall experiences spending a week with Entity Framework.

Entity Framework Week Part 3: Runtime Issues Encountered

0

This is the third in a series of five posts recounting my experiences using Entity Framework Code-First to replace ADO.NET and stored procedures in a client’s existing application. The introductory post in the series is here.


Having configured and initialized Entity Framework, and tweaked the mappings, by Day 3 I was all set to start consuming my shiny new DbContext implementation from the application code, and actually get some CRUD work done. Not unexpectedly, I hit a few issues along the way…

Proxy Generation

As a long-term NHibernate user, I habitually mark all members on my domain classes as virtual, since this is a requirement for entities to be replace at runtime by proxies. Remember that NHibernate is a port from the Java world, where all instance methods are virtual by default.

Now, this habit led to some unexpected behaviour when I attempted to use Entity Framework to persist the same domain objects, namely exception messages such as:

The property ‘Foo’ on type ‘Bar_B6089AE40D178593955F1328A70EAA3D8F0F01DDE9F9FBD615F60A34F9178B94’ cannot be set because the collection is already set to an EntityCollection.

Clear as mud, eh? A little Googling eventually unearthed the following posts from other people experiencing this issue:

This latter post on the MSDN forums includes the following explanation from one of the guys on the Entity Framework team:

“If you make all your properties virtual then EF will generate proxy classes at runtime that derives from your POCO classed, these proxies allow EF to find out about changes in real-time rather than having to capture the original values of your object and then scan for changes when you save (this is obviously has performance and memory usage benefits but the difference will be negligible unless you have a large number of entities loaded into memory). These are known as ‘change tracking proxies’, if you make your navigation properties virtual then a proxy is still generated but it is much simpler and just includes some logic to perform lazy loading when you access a navigation property.

Because your original code was generating change tracking proxies, EF was replacing your collection property with a special collection type to help it find out about changes. Because you try and set the collection back to a simple list in the constructor you are getting the exception.

Unless you are seeing performance issues I would follow Terrence’s suggestion and just remove ‘virtual’ from your non-navigation properties.”

This feels a little bit strange, and I’m not convinced that we are really getting persistence ignorance if we experience differing behaviour depending on whether or not we have chosen to make all our members virtual. I haven’t invested much time looking into the benefits of these “Change-Tracking Proxies”, or how it is possible to utilise these without causing the “collection is already set to an EntityCollection” exception. I just did what the man said and removed the virtual keyword from most non-navigation properties.

A Runtime Exception When Lazy-Loading

At one point I experienced an exception message along the lines of:

“Entities in ‘CodeFirstContainer_Sessions’ participate in the ‘Session_Season’ relationship. 0 related ‘Session_Season_Target’ were found. 1 ‘Session_Season_Target’ is expected.”

This was caused by my navigation property (Session.Season) not having been set as virtual, so no proxy was being created.

Incidentally, it is worth highlighting that lazy-loading must occur within the scope of an open DbContext (i.e. within the Unit of Work). It is not reasonable to expect to transparently load the navigation property after the database connection has been closed (this is analogous to attempting to lazy-load in NHibernate after closing the Session).

Cascades

In NHibernate, cascading saves/updates/deletes have to be specified manually on all foreign key relationships – the default behaviour is not to cascade any changes when committing changes, which often leads to newcomers experiencing an error message “not-null property references a null or transient value”.

Entity Framework takes a more convention-based approach and assumes that all saves and updates should cascade. So, if you save a shiny new Order with an associated Address and a handful of Lines, Entity Framework will determine that it should first insert the Address row, then the Order row, and then each Line row. Sweet. Updates similarly cascade. Assuming you are happy with this behaviour (which seems sensible), then all should be well.

Deletes, on the other hand, are a bit strange. Entity Framework will not take responsibility for cascading a delete in the database – it expects that you will achieve this by setting a cascading delete on the foreign key relationship in the RDBMS.

Having said this, if you delete a parent entity in Entity Framework, it will attempt to issue delete statements for any child entities which have been loaded into the current DbContext, but it will not initialize any child entities which have not yet been loaded. This may lead to the RDBMS throwing foreign key constraint violation exceptions if a cascading delete has not been specified. For more details about how cascade delete “works” in Entity Framework, see this blog post.

Personally, I think this behaviour is pretty shoddy, but there you have it! Forewarned is forearmed.

In light of this behaviour I had to make modifications to the database schema to set cascading deletes on all the appropriate foreign key relationships. For many line-of-business applications, deletes are actually pretty rare events, and in the short term I suspect this issue is more likely to be encountered when clearing down data in integration tests than in actual application use.

Initializing Child Objects on Domain Entities

I habitually add code to the constructors of domain entities to initialise child entities to sensible defaults – I find it helps to ensure that objects are always in a valid state, and reduces the likelihood of encountering an unhandled NullReferenceException. So, for example, I would usually have something like this:

public class Order
{
    public Order()
    {
        this.Address = new Address();
    }

    public virtual Address Address { get; set; }
}

Unfortunately, when using this approach with Entity Framework, I found that when loading an existing Order which has an associated Address, the Order.Address object was always reset to its default.

Now, I realise that making calls to virtual members in a constructor is not really a good idea (heaven knows Resharper and Coderush have both nagged me about it often enough), but NHibernate never had a problem with this approach. Nevertheless, I tried to do things properly and replaced the automatic properties with backing fields….

public class Order
{
    public Order()
    {
        this._address = new Address();
    }

    private Address _address;

    public virtual Address Address
    {
        get { return _address; }
        set { _address = value; }
    }
}

But still no dice. I then tried putting initialization logic in the property’s getter….

public class Order
{
    public Order()
    {
        this._address = new Address();
    }

    private Address _address;

    public virtual Address Address
    {
        get { return _address ?? (_address = new Address()); }
        set { _address = value; }
    }
}

But nothing worked. Every time I loaded an Order, the Order.Address object was reset back to its default instead of containing the data loaded from the database.

This is quite frustrating and as yet I haven’t been able to find a workaround, other than to abandon my plans to perform object initialization in the domain model and instead handle it in the service layer, with all the resultant null-checking code that will ensue.

While trying to find a solution, I did stumble across this comment from Rowan Miller that “More flexibility in how we interact with classes is a common ask for EF and our team is looking at how we can support this at the moment.”
Are we asking for flexibility? I thought we were just asking for the persistence ignorance that had long been promised.


Despite these issues, in three short days I had gone from knowing next to nothing about Entity Framework 4 Code first, to using it to perform almost all of the data access required by a small application. In the fourth part of this series I’ll consider some of the additional features and application requirements that I would expect an ORM to handle, and see how EF meets the challenge.

Page 2 of 86«12345»102030...Last »