I installed Desktop Google an hour or so ago. It's just completed indexing my entire hard drive and it's search speed blows everything else out of the water (bye bye Lookout). It indexes cpp and header files, but for some reason SQL and CS sources aren't. Shame, it would mean I don't have to use grep.

My friend Brad on why you should (or not) "blog like no-one's reading".

As promised previously, I want to dig a little deeper into the requirements and discuss some solutions. This post is going to be about the security and membership. The relevant requirements are:

1. There system will only allow access to members, i.e. no public access
2. The system should be simple and that includes registration
3. Registration and security should be self maintaining wherever possible
4. Lost password handling must be automatic

There are standard patterns for login and registration and you really want the users to feel in familiar territory whilst starting out with your application in otherwise they are likely to give up and never return. Also I want new users to be up and running as soon as possible.

First I have some choices to make so lets start with login id. Personally I find it difficult to remember my user names, particularly if registered with lots of web sites. I tend to try and pick the same one but obviously if someone else is using it then I have to pick a different one or a variation. I think using an e-mail address as a login is much more memorable and the chances of a clash are near zero. We will need the e-mail address as part of the registration process anyway so using it as a login id removes the need for choosing an additional login name or providing additional registration pages dedicated to telling the user to pick another name because it already exists.

Next the password. This is usually a weak point in any security system and I believe the best approach is to make it easy and secure for users retrieve a forgotten password. This way you can urge them to pick a more complicated pass phrase without them worrying about forgetting it. I need to allow for long passwords so there should be at least 100 characters available. Whilst we are on the subject of passwords, I intend to only store a salted hash so retrieving a password will be impossible. Lost passwords mean that the user will have to recreate a new one. There are two ways I could do this: either by generating a new password and e-mailing the result to the user or sending a special "one time" link instead which, when clicked on, allows the user to set a new password. As e-mail will travel unencrypted I prefer the second approach because the user is forced to select a new password and the link will only work once.

Finally, the registration process. This one is a little more complicated because I know Laura already has a list of contact details she wishes upload to the site. This means that contacts may already exist before the relevant user registers. I'm not sure if Laura intends the users to edit any contact or only their own details (I must remember to ask). If it's the latter then I'll need some mechanism for tying up the user to the contact. I could get the user to type in their address at registration and match that to an existing contact but there too much room for error when you consider things like "street" can be written as "st." etc. What I shall probably do is some sort of fuzzy match based on the post code and any other digits in the address. More on that at a later date. One benefit of matching the user to an existing contact is I can automatically validate a registration request saving Laura from a manual step. Any non-matches will have to manually verified unless I can think of some cunning way around the problem.

Thats all for tonight. As it's my birthday I'm going for dinner with friends tomorrow so the next installment will be at the weekend.

My step mother asked for a favour this weekend. She has a rather large Word document of unsorted contact details and pictures that she wants to publish on the web. She wants me to see if I can provide a solution. I should start by saying this is a classic request of a programmer similar to "will you help fix my computer" and "I can't read my e-mail". I'm happy to do this, particularly as it's a fun little project, but it can turn into a bit of a commitment.

So what is this application supposed to do? Lets review some of the requirements from Laura:

• The application will support a membership of a virtual golf club; they meet up for social reasons and to play different courses in the US and UK
• Manage contact details for golf club members
• Each contact has name, address, phone, e-mail and a picture
• Members should be able to update their own details
• Members can search for other member's details
• The system will only allow access to members, i.e. no public access
• The members can add descriptions of what they are up to

After thinking about this for a while I can see that there are some additional unwritten requirements. It's usual for the customer to not fully understand what they want and as an analyst you have to use your experience and fill in the gaps. You do need to go back to the customer and check your assumptions are correct though. So what are mine?

• Simplicity - the users of this application are in their 40's, 50's and 60's so I'm going to make a sweeping generalisation and say they aren't too comfortable around computers.
• Manageability - Laura is a busy person with better things to do than continually login and manage the system
• Registration - to ease the management burden on Laura, this should be as automated as possible
• Lost passwords - this is not an every day application so the large gaps between logins will increase the chance that the members have forgotten their passwords. It also needs to be automated so Laura doesn't have to do anything.
• Meet-ups. This was not in the original list from Laura but it's the primary reason the club exists. Would it be worth placing on the product backlog?
• Notifications - do the members want to be notified if anything has been updated? This will save them from the burden of logging in frequently.
• Logging - this one is for me because if anything goes wrong then I'm the one getting the call to fix it
• Hosting - I'll need to find somewhere appropriate to host the application. Luckily we checked and a suitable domain name is free.
• Data Storage - I don't have experience of using databases on web hosts, though I know it's possible, so I want to try and use a file based data storage mechanism

Next time I'll discuss some of the requirements in more detail with respect to some possible solutions.

Last night was excellent. We were at The Fire House, a private members club just opposite the Natural History Museum. There was a good mix of people, mainly from public relations and fashion which makes a change from the computer and telecoms people I'm normally with. I had a very interesting conversion about crisis management with a PR guy. The principals are similar to software management - know the facts and act early.

Sometime later I was also talking to an IT teacher about the problems getting kids interested in computers (not games). We discussed blogging and how it could provide the kids with a chance to create their own online content. This would get them involved with something they could own and have a reason for wanting to do; certainly more interesting than home work. They would also be practising their writing skills at the same time.

Many drinks later, we left at about 3am and grabbed some food to soak up the alcohol. Head was a bit sore this morning but a late lunch at The Wolseley on Piccadilly helped a lot.

Just a quick one before I go. I'm off to London today because a friend is emigrating to La la Land (Los Angeles) and she's having a party. Good luck in your new job Yasmine. It's also my birthday next week so a visit to my folks is in order.

A quick shot with my new camera of where I spend a lot of time. Somewhere I can go and geek out in peace and as you might expect it's full of things I've collected over the years. In fact, I never take anything off the pin-board, just put new stuff over the top. The most used item is well within reach - my MSDN discs (top shelf, blue case). I'm a big fan of O'Reilly books (third shelf) and the Addison Wesley "Object Technology Series" (second shelf). There are loads more - I have piles of books all over the house as you can see to the left of the laptop. There are also thousands of records (bottom shelf) mainly from the 90s when I was into mixing. On the wall to the left (out of shot) there is a huge map of the world which is great for getting some perspective and yes, that is a giant poster of Sarah Michelle Gellar - it was a leaving gift from Sony. The FHM calendar is replaced with whatever I get given each year. There is more to the right which you can see in the panorama.

Maybe this could start a new meme (assuming someone like Robert Scoble is kind enough to pass on the thought) - where do you blog from? (Send me a trackback so I can find you).

[Edit: I was about to post and remembered that there are two passwords and a couple of addresses on the pin-board so I've edited them from the picture here and in the gallery. Thats what the smudges are.]

So I haven't had time to blog much. There are, however, a number of links on my desktop that I've collected and meant to take a look at. So I can tidy up I'll list them here instead.

• The Fallacy of Cheap Programmers
• Skinning Gmail with a Custom Stylesheet via Nick Bradbury
• Mount St. Helens Volcano Cam
• Moving Past Fear via Heather
• Creating multilingual web sites
• The Daily Database Build
• Microsoft ASP.NET ValidatePath Module (to fix this)
• Hacker Handle Generator via Gnome-Girl (James Snape = Zen Dead, I might even use it)
• NASA's WorldWind (free download) via Steve Makofsky
• UI Patterns and Techniques via Duncan Mackenzie
• Cooking for Engineers via Raymond Chen

Plus some useful articles on MSDN:

• CRUD, Only When You Can Afford It
• Using HTTP Modules and Handlers to Create Pluggable ASP.NET Components
• Windows Forms Development Series of Webcasts

(*) The title is based on a quote by Jesse from the Fast Show. Spoken in a West Country accent.

My old digital camera was starting to lose the technology race so I've bought a new Canon Digital Ixus 500:

 

Sorry for the poor quality image; had to use my phone camera to take a picture of it!

I bought it at Amazon because I didn't have to leave my seat and they delivered it in 2 days. The only problem I have is the "Customers who bought this item also bought:" part of the page - it's too easy... So in addition I now have:

• 1 of: Tamrac TA5688 Sub-Compact Digital Camera Pouch
• 1 of: Canon NB1LH Spare Li-Ion rechargeable battery
• 1 of: ByteStor 1GB USB2.0 Flash Pen drive
• 1 of: ByteStor Compact Flash Card USB Reader
• 1 of: ByteStor 1GB High speed Compact flash

Ryan Stevens (aka Solidstore) has started blogging. He is a developer right to the core and has a particular talent with networking and security (and FarCry). He even runs a hosting service from his house!

With Ryan that makes four Exony bloggers including our CEO and as we only have 30 or so employees, I make that a better ratio than Microsoft...

I've been getting a lot of referral spam recently particularly since Robert Scoble put his new blog-roll (which includes this site) up on blog-lines. In response I've coded up some changes to the way things work here. There is now a blacklist of url keywords and if your referrer url matches any of the items in it you won't be displayed on any web page. Check this post at the end of the referral list for an example. Finally, if you think I've added your site to the blacklist by mistake then please contact me.

Good news for those like me who lamented the demise of the database diagramming tool in Visual Studio. It's going to make a return in the near future. We just need to get it added back into the SQL Server Management/BI Studio.

Due to popular demand, starting in the October CTP you will be able to create database diagrams using Whidbey with Yukon databases. There are a few changes that have been made to the Whidbey database diagramming capability:

• Diagrams are now assigned a database user as an owner. Individual database users can only see their own diagrams unless they’re a member of the db_owner role. Members of the db_owner role can see any diagram in the database.
• Only SQL Server Yukon is supported for Whidbey diagramming.
• Many minor UI enhancements, additional shortcut keys, and better IAccessibility support.

(via The Return of Database Diagramming!)