Peter Van Dijck asks:

I’ve only worked twice with companies using .NET for web interfaces, and in both cases the UI was a disaster and the usability problems guaranteed lots of consulting hours.. Why is that? Or was that a fluke? (2 cases is hardly proof of anything) I know it’s possible to make usable and elegant web UI with any technology, but does .NET somehow encourage bad UI?

This is a great question and in my opinion – the answer is yes. (Assuming that Peter really means WebForms.)  

This is demonstrated in so many small ways by framework defaults which are totally brain dead (__doPostBack anyone?). Rather than lead dev’s into the pit of success – the framework leads devs to the spiky elephant trap of death. 

 
What’s that – an example? How about the <customErrors> defaults. When an error occurs during processing an ASP.NET request – the default behavior of a new web.config is to redirect the user to another URL. This is what a new web.config looks like in VS2k5. 

        <customErrors mode=”RemoteOnly” defaultRedirect=”GenericErrorPage.htm”>

            <error statusCode=”403″ redirect=”NoAccess.htm” />

            <error statusCode=”404″ redirect=”FileNotFound.htm” />

        </customErrors>

The URL in the browsers address bar is: 

http://devlicio.us/error.htm?aspxerrorpath=/themes/blogs/default/post.aspx

Another example? Linkbutton? Anyone who’s tried to open a link in a new tab/window and got a blank window with a URL like: javascript:__doPostBack(‘ctl00$Masthead1$LocaleManagement$ctl00$ctl05′,”) – knows the pain I’m talking about. 

Go on – right now – go try and open a MSDN library page in different language in a new tab. (It’s the little menu up the top right where it says (e.g.): United States – English). 

In my apps – I fix this by disabling customErrors and writing new error handling code which both maintains the url and returns the correct HTTP statuses – but this is code which I should not have to write. This is code which all web servers/apps need to implement correctly – it should be automatic. We shouldn’t have to write custom code to get a HTTP/404 returned when an app encounters a missing file!

I’m reluctant to get involved in this – but I feel like there’s another side to this story which is worth considering.

Since it was first presented at altnetconf – the decision to require users¹ to have to specify which methods on controllers are available to be routed to ([ControllerAction]) and which view (RenderView()) to render has come in for a lot of criticism.

Lots of the brightest and best minds in the .net world are screaming about this in various forums. Claiming that it violates:

• the DRY principle
• convention over configuration
• best practice in other frameworks
• commonly accepted laws of physics

Not one of the people complaining is going to use this framework vanilla. They are going to add their own layer of behavior over the top. It’s been designed to make it easy (trivial in this case) to extend and change the policy.

Sane defaults are really important for frameworks. Yes they get in the way of power users. Yes it normally takes a power user 10 minutes to work around them and add that piece of code to their toolbox from then on.

I don’t know how many people were following the emergent rails community back in 2005 when the Google Web Accelerator was released – but many of them (including the smartest² ) got a salient lesson in GET idempotence. (i.e. GET Order?id=23&action=delete – should never delete anything).

Here was a situation where the framework (rails) came with not so safe defaults and bad example code which encouraged doing the wrong thing. These days – rails has absorbed this lesson so completely that it could be described as a REST server and in some ways leads developers into following best practices for web apps by default.

I really don’t understand what the huge deal is here? This seems as clear cut to me as the built in RequestValidation in ASP.NET or automatically escaping SqlParameters for SQL injection. Sure – if your a power user it can be a pain – but it takes 10 seconds to turn off and then your responsible when your site get p0wn’d.

It’s not like ControllerBase is sealed.

1. by default – but easily modifiable
2. or is that loudest?

“How can you run multiple instances of memcached on a single machine?”

There’s a couple of reasons why you’d want to do this. The most obvious is that you’ve got multiple clients being serviced on a single machine and you want to absolutely ensure that data is not leaking from one client to another.

If you want to setup multiple instances the once you’ve got the win32 port downloaded and unziped somewhere you need to use the following magic incantation:

sc create memcached2 binPath= “c:\memcached\memcached.exe -p 11111 -d runservice”

You can pass any other params you wish (e.g. amount of memory to use). To run multiple instances just install multiple services with different names/ports.

Note: “sc” is the command line tool for working with the win32 service control manager. It allows you to stop/start/create/delete and more – windows services. Check out it’s command line help by typing “sc” at the command line.

1. In views ScottGu shows how to write views using <%= %> style code. Now that was all good when asp classic was a new and good idea. These days some (lots?) of people think that HtmlEncode’ing by default is a good idea. It makes attacks like XSS and CSRF more difficult and is the default for much of the WebForms controls. It’d be nice to see support for this integrated into the WebForms compiler or maybe a rails like <%h= %> option.
2. Scott demos a new extension method: .UpdateFrom(NameValueCollection) which allows you to update a class from a NameValueCollection. This is super sweet – especially with the built in reflection caching he mentions. I’d like to know if this extension methos has support for whitelist/blacklist of incoming property names/values? (Like the MonoRail DataBindAttribute.Exclude/Allow properties). IMO – this is an important security consideration.
3. Can you configure the routing rules based on HostHeader+Url or is it just Url?)
4. In the example he uses – the Layout is specified by the View (i.e. MasterPage=”") – this is an improper separation of concerns – it should be upto the Controller to specify the “layout” (masterpage).

Anyway – it’s really just a list of things I’ve thought of and am curious about. Overall I’m amazingly excited and really looking forward to getting my hands on some bits.

“But I guess what I’m saying is that the code for inserting that string using just strings may look even worse when you come back to look at it a week later…”

If your thinking that I’m talking about code like:

StringBuilder sb = new StringBuilder();
sb.Append(“xxx – yyy [somevar] zzz”);
Response.Write(sb.ToString().Replace(“[somevar]“,”somevalue”));

Then I’d agree. This is a maintenance nightmare. Solving this is a well known “pattern”. Use a domain specific language (DSL). In this case – we’d use a template language. Imagine a hypothetical template DSL:

TemplateContext context = new TemplateContext(“somevar”,”somevalue”);
Response.Write(Template.Eval(“xxx – yyy <%=somevar %> zzz”,context));

It is possible to write this in a way that is maintainable and still readable a week later. Scott Bellware’s comment still sums this up for me.

Another classic example of WebForms being too complicated for it’s own good.

In other news: Oren and Mats are having a dustup over webforms. I have this remarkible experence when I work with WebForms. Sometimes I get the entire model/life-cycle/event flow etc in my head and fix or work around quite complex scenarios to get some piece of functionality working.

e.g. Writing a control which/removes adds instances of other controls to itself when buttons are presses.

When this happens I experience this strange sense of achievement and even pride. The feeling that I have really done some “hardcore” programming today. Then I remember that I just managed to inject a string into the middle of another string and write the result to a stream.

Then I feel sad.

ASP .NET templated controls did almost nothing to encourage separation of orthogonal concerns. It simply ended up separating concerns that aren’t separate concerns.

Pure Genius – this summarises an entire field of criticism (e.g. [1][2]). The whole issue with the OnRowDataBound/FindControl() style of programming is that things which are fundamentally simple (iteration and string concatenation) are impossibly complex because concerns have been separated which are not orthogonal.

There’s an important caveat to this – which is that WebForms is actually trying to solve a different problem from the one that I and many other developers build web apps are trying to solve. WebForms was intended to allow VB6 windows programmers to build web based apps – without having to understand HTTP, HTML, CSS, Javascript, GET/POST/HEAD etc.

This has actually proven to work pretty well in specific circumstances. e.g. A team of developers building an inhouse (intranet) line of business app. A good friend of mine was tasked to lead a team of 20 or so Oracle Designer developer in building a next gen version of the product they had been working on in ASP.NET 1.1. They were able to pick it up and get productive remarkably quickly because they could continue to work with a Control based, form based model that was familar to them.

Where it’s made life immeasurably harder is for developers who are building public facing web apps. Apps the HTML they’re actually emitting matters, where cross browser compat is something that needs to be deeply understood – not abstracted away (thats a whole ‘nother post).

The reason this is even an issue is because of the Microsoft DevDiv monoculture. If it’s a Microsoft solution then it’s obviously the best. In the Java world – there’s JSP (classic asp using Java) and JSF (roughly webforms) – but there’s a whole boatload of other solutions to problems.

I don’t see anyone arguing that the only right way to build web apps using java is to use JSF. People are free to examine the problems they face, look at the solutions proposed by various other people who have published their work (e.g. Tapestry, Grails, RIFE, Struts, WebWork, Struts 2 etc…) and either use an existing solution or roll their own. Same in the Python (Django, Web.py, Zope), PHP (Zend Framework, Cake, various PEAR libraries), Perl and pretty much any other community you care to examine.

Which tool is right for you depends entirely on your context (the problem, your experience, your team, their experience etc). If Webforms is working for you – then fantastic but it’s not the right solution for everyone.

What I’ve learnt: If you use the convenient (if old school) Server.Transfer method to render a different page to a client then you need to be aware that ASP.NET pipeline events¹ will not run. You know – BeginRequest, AuthenticateRequest – unimportant things like that.

Basically – nothing that happens in Global.asax, HttpModules etc… will happen for this page.

This caused a rather embarrassing scenario for me.

If you requested a page which did not exist – then I Server.Transfer’ed you to a 404.aspx page.

At the time this seemed like good SOC – I can have a whole page which takes care of setting the correct HTTP status code, taking care of common misses etc. without issuing a redirect – which would mean you lost the url in your browser. (Something that asp.net does way to much for my tastes – but thats a whole ‘nother post).

Problem is that – the HttpModule I have which hooks up the correct “skin” for that customer based on the host header didn’t run – which meant that the user got the “default” skin – in this case another customers. Anyway – it’s all fixed now – but I’ve had to duplicate the code to hook up the correct skin in two places. Which is not so hot.

ASP.NET is so cool. I want to have it’s children. NOT. Seriously – who wrote this – what were they thinking?

Oh – we have a special case – well – we’ll re-implement some aspects of the whole fricking pipeline again to take care of this!

ARRRGGG!!!!

1. http://msdn2.microsoft.com/en-us/library/ms178473.aspx

I finally made some time today to sit down and browse through the source code for BackgroundMotion. For those of you who haven’t come across this project – it’s kind of a best practices sample built by the great guys at Mindscape. Background motion is a Web2.0, AJAXified, community driven site for submitting videos for use with Windows Vista Dreamscene (the use a video as your background rather than just an image thingy). It’s pretty buzzword compliant – it’s got tags, AJAX and user generated content. On the backend it uses ASP.NET AJAX, LINQ to SQL, the Web Client Software factory, MVP, Unit testing and all sorts of other goodies.

Unlike lots of the samples and guidance coming from the P&P team – this one is also a real functioning LIVE application. Rather than just completing something to the degree necessary to show the main concepts – this is a pretty finished piece of work. Well – production ready at least – what software is ever “finished”?

It’s also a great resource for looking at structuring a real world application using the full Microsoft .NET 3.5 stack. There are heaps of great ideas in there including:

• Echoes of discussions in Jimmy Nilsson’s book Applying Domain-Driven Design and Patterns: Using .Net
• Implementations of UnitOfWork , Repository<T> + Repository Specialization very similar to Oren’s Exesto sample + Rhino Tools
• A declarative .net DataBinding Extender control similar to the ones in Spring.Net, the MonoRail WebForms View Engine and Rick Strahl’s wwDataBinder

There are also short videos from the guys giving an overview of some of the technology/patterns and choices that they’ve used. I particularly liked the great discussion of MVP with WebForms.

One minor criticism: I remember chatting with Jeremy about the Composite Web Application Block when it was released and complaining that after downloading it, reading the docs and source – I couldn’t figure out how to use it. His answer at the time was: Wait until we release the BackgroundMotion source – then you’ll have a real example. Well – I’ve looked through the code – and I still have no idea how the CWAB really adds value. Even after watching the video and reading the Web Client Software Factory page – I’m clueless. Maybe I’m just not smart enough to get it.

1. Install the Debugging Tools for Windows and thank the good Lord you’ve been reading Tess’s blog.
2. Create a “hang” dump of the process.

   > adplus -hang -p 1680
   

3. Open the dump in windbg.exe

   >windbg.exe -z Hang_Mode__Date_06-28-2007__Time_11-21-2020
   

4. Load sos.dll – the debug helper for the CLR.

   > .load C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sos.dll
   

5. Checkout what’s happening in the CLR thread pool.

   0:000> !threadpool
   CPU utilization 100%
   Worker Thread: Total: 3 Running: 2 Idle: 1 MaxLimit: 200 MinLimit: 2
   Work Request in Queue: 0
   ————————————–
   Number of Timers: 9
   ————————————–
   Completion Port Thread:Total: 2 Free: 1 MaxFree: 4 CurrentLimit: 2 MaxLimit: 200 MinLimit: 2
   

6. There are two CLR threads running. Wonder what they’re doing? Are they GC’ing or in user code? Let’s take a look at what’s happening with the OS threads.

   0:000> !threads
   ThreadCount: 8
   UnstartedThread: 0
   BackgroundThread: 8
   PendingThread: 0
   DeadThread: 0
   Hosted Runtime: no
   PreEmptive GC Alloc Lock
   ID OSID ThreadOBJ State GC Context Domain Count APT Exception
   13 1 90c 000dc6e8 1808220 Enabled 02b64538:02b65458 000d9710 0 Ukn (Threadpool Worker)
   17 2 fdc 000e2fc8 b220 Enabled 00000000:00000000 000d9710 0 MTA (Finalizer)
   18 3 38c 000f7798 80a220 Enabled 00000000:00000000 000d9710 0 MTA (Threadpool Completion Port)
   19 4 84c 000fa800 1220 Enabled 00000000:00000000 000d9710 0 Ukn
   11 5 cd0 00116b30 880a220 Enabled 00000000:00000000 000d9710 0 MTA (Threadpool Completion Port)
   21 6 e94 0ebd6bc8 180b220 Disabled 00000000:00000000 000fb1a0 1 MTA (Threadpool Worker)
   22 8 b70 0ebde1a8 180b220 Disabled 00000000:00000000 000fb1a0 1 MTA (Threadpool Worker)
   23 7 e14 0ec0a378 880b220 Enabled 00000000:00000000 000d9710 0 MTA (Threadpool Completion Port)
   

7. There’s two threads running user code there – are they the ones that are pegging the CPU? Let’s see.

   0:000> !runaway
   User Mode Time
   Thread Time
   21:e94 0 days 0:19:50.296
   22:b70 0 days 0:15:38.625
   13:90c 0 days 0:00:07.062
   15:934 0 days 0:00:00.156
   16:a38 0 days 0:00:00.140
   3:bec 0 days 0:00:00.062
   5:538 0 days 0:00:00.046
   0:2e0 0 days 0:00:00.046
   28:6f0 0 days 0:00:00.000
   27:a3c 0 days 0:00:00.000
   26:530 0 days 0:00:00.000
   25:358 0 days 0:00:00.000
   24:b8c 0 days 0:00:00.000
   23:e14 0 days 0:00:00.000
   20:9e8 0 days 0:00:00.000
   19:84c 0 days 0:00:00.000
   18:38c 0 days 0:00:00.000
   17:fdc 0 days 0:00:00.000
   14:5d4 0 days 0:00:00.000
   12:ab8 0 days 0:00:00.000
   11:cd0 0 days 0:00:00.000
   10:f1c 0 days 0:00:00.000
   9:ac4 0 days 0:00:00.000
   8:a40 0 days 0:00:00.000
   7:a24 0 days 0:00:00.000
   6:c84 0 days 0:00:00.000
   4:f94 0 days 0:00:00.000
   2:bb0 0 days 0:00:00.000
   1:270 0 days 0:00:00.000
   

8. Yep – the two CLR threads are chewing all the CPU. Let’s switch our thread context to the first one. (21).

   0:006> ~21 s
   eax=026bcd88 ebx=026bcd01 ecx=026bcd88 edx=02702a44 esi=026bcd88 edi=026bf064
   eip=0ee0709e esp=0eeff1ec ebp=026bcd88 iopl=0 nv up ei ng nz na pe cy
   cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000287
   Demo!Models.CMSPage.IsSubPage(Models.CMSPage)+0×56:
   0ee0709e 0fb6db movzx ebx,bl
   

9. Let’s take a look at what managed objects are reachable from the current stack.

   0:021> !dso
   OS Thread Id: 0xe94 (21)
   ESP/REG Object Name
   eax 026bcd88 Models.CMSPage
   ecx 026bcd88 Models.CMSPage
   esi 026bcd88 Models.CMSPage
   edi 026bf064 Models.CMSPage
   ebp 026bcd88 Models.CMSPage
   0eeff1f8 026bcd88 Models.CMSPage
   0eeff1fc 026bf064 Models.CMSPage
   0eeff208 06529858 System.String <ul id=”menu-level{0}”>
   0eeff238 026cd1cc System.Object[] (Models.CMSPage[])
   0eeff240 790d6584 System.String
   0eeff244 026b906c ASP.skins_demo_master_master
   0eeff284 026b906c ASP.skins_demo_master_master
   0eeff28c 026bdea4 System.Text.StringBuilder
   0eeff29c 026cd1cc System.Object[] (Models.CMSPage[])
   0eeff2a0 026bdea4 System.Text.StringBuilder
   0eeff2a4 026cd1cc System.Object[] (Models.CMSPage[])
   0eeff2a8 026bcd88 Models.CMSPage
   0eeff2b8 026b906c ASP.skins_demo_master_master
   0eeff2bc 026bdd2c System.Web.UI.HtmlControls.HtmlLink
   0eeff2cc 026df978 System.Object
   0eeff2d0 024af58c System.String class
   0eeff2dc 0651f798 System.String screen.css
   0eeff2f8 026b906c ASP.skins_demo_master_master
   0eeff310 024a793c System.EventArgs
   0eeff33c 026b906c ASP.skins_demo_master_master
   0eeff350 026b4bdc ASP.default_aspx
   0eeff374 790d6584 System.String
   0eeff37c 026afcf4 System.Web.HttpContext
   0eeff380 026b4bdc ASP.default_aspx
   0eeff514 026b4bdc ASP.default_aspx
   0eeff528 026b4bdc ASP.default_aspx
   0eeff558 02464340 System.Globalization.CultureInfo
   0eeff55c 02464110 System.Globalization.CultureInfo
   0eeff560 025beff0 System.Threading.Thread
   0eeff564 026b4bdc ASP.default_aspx
   0eeff59c 026afcf4 System.Web.HttpContext
   0eeff5a0 026b4bdc ASP.default_aspx
   0eeff5bc 026afcf4 System.Web.HttpContext
   0eeff5c0 025d1084 System.Web.HttpApplication+CallHandlerExecutionStep
   0eeff5f8 025d1084 System.Web.HttpApplication+CallHandlerExecutionStep
   0eeff5fc 025beeb0 ASP.global_asax
   0eeff62c 025beeb0 ASP.global_asax
   0eeff630 026affb4 System.Web.HttpApplication+ThreadContext
   0eeff634 025e54a0 System.Web.AspNetSynchronizationContext
   0eeff63c 025beeb0 ASP.global_asax
   0eeff668 026aff98 System.Web.HttpAsyncResult
   0eeff690 026afcf4 System.Web.HttpContext
   0eeff694 026af6ac System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6
   0eeff698 02477fb0 System.Web.HttpRuntime
   0eeff6e0 0247b8e4 System.Web.Caching.CacheSingle
   0eeff700 0248e4a4 System.Web.Hosting.ISAPIRuntime
   

10. Himmm.. we have the same instance (026bcd88) of that CMSPage object floating around in a bunch of places. I wonder if we have some bad data in the database. This class has a parent/child relationship with itself. Could it be causing an infinite loop?

    0:021> !do 026bcd88
    Name: Models.CMSPage
    MethodTable: 0e941234
    EEClass: 0244cc60
    Size: 92(0x5c) bytes
    (C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\root\5bf6c3da\19d72350\assembly\dl3\36150507\00d93296_9ca7c701\Demo.DLL)
    Fields:
    MT Field Offset Type VT Attr Value Name
    0e942118 4000140 40 …sionFactoryHolder 0 static 024c4e34 holder
    791036b0 4000147 4 …ections.ArrayList 0 instance 026bcde4 __validators
    79113dfc 4000148 8 …tions.IDictionary 0 instance 00000000 __failedProperties
    79124228 4000149 c System.Object[] 0 instance 00000000 _errorMessages
    790fed1c 40000f7 40 System.Int32 0 instance 102 _id
    790fa3e0 40000f8 18 System.String 0 instance 026bc668 _name
    790fa3e0 40000f9 1c System.String 0 instance 00000000 _url
    790fa3e0 40000fa 20 System.String 0 instance 026bc6a0 _title
    790fa3e0 40000fb 24 System.String 0 instance 026bc768 _content
    790fa3e0 40000fc 28 System.String 0 instance 026bc6c8 _heading
    790fa3e0 40000fd 2c System.String 0 instance 026bc6e4 _metaDescription
    790fa3e0 40000fe 30 System.String 0 instance 026bc71c _metaKeyWords
    0e941174 40000ff 44 System.Int32 0 instance 2 _status
    791059c0 4000100 10 System.Double 0 instance 1.000000 _displayOrder
    0e941234 4000101 34 Models.CMSPage 0 instance 026bcd88 _parent
    7910e274 4000102 38 …Collections.IList 0 instance 026bcef0 _children
    79105ef0 4000103 48 System.DateTime 1 instance 026bcdd0 _dateUpdatedAt
    79105ef0 4000104 50 System.DateTime 1 instance 026bcdd8 _dateCreatedAt
    0e94337c 4000105 3c Models.Site 0 instance 026b8e30 _Site
    

11. 11. Yep – check that – the _parent field of instance 026bcd88 is pointing at itself (026bcd88). Log into the database and manually patch up the data. Next job – write some more defensive code around how that works.

Well – I hope you enjoyed that. Production debugging is always fun!