Data compression in .NET

In .NET, developers often have to choose between 2 options for compression/decompression - GZipStream and DeflateStream. What's interesting to note is that GZip uses the same 'deflate' algorithm as DeflateStream; but in addition also supports CRC checks and has additional headers to store metadata such as version nos, original file name, timestamps, etc.

So GZip is actually a data format and multiple files can be compressed into a single archive. You can open a file written to by the GZipStream using a GZip decompression utility such as WinRAR on Windows, gunzip on Linux, etc.

Sample example code can be found at MSDN.  There is also a sample solution that allows working with multiple files using GZip compression. Both these classes only support max 4GB as the stream length.

Interoperability when using datasets in .NET webservices

Datasets are powerful data containers that are very popular in the .NET world. Quite often, a lot of .NET webservices return datasets in their web methods. This is ok, as long as we are sure that all the clients are also on the .NET platform. 

But if we want our services to be interoperable with other platforms (e.g. Java), then passing datasets back to webservice clients would not work. This is because a dataset is a generic container and is populated at runtime with data. Hence at design time, it is not possible to define the dataset datatype with a schema. Also when a dataset is serialized to XML, then the default .NET SOAP serializer adds .NET specific attributes to the XML schema. e.g. isDataset=true, Diffgram, etc.

Typed datasets do have a schema backing them, but here again there is a hack required to make typed dataset accessible to a Java program. The hack is to return a xml string or a XML Node instead of the typed dataset. We would also have to change the autogenerated WSDL and add the typed dataset schema to it. A lot of trouble for using datasets in a heterogenous environment :( 

For hassle free interop, the best option is to go for pure schema driven complex types that can be mapped to any language.

More information is available at the following links:

http://msdn.microsoft.com/en-us/magazine/cc188755.aspx

http://msdn.microsoft.com/en-us/library/ms998428.aspx

http://www.cnblogs.com/rickel/articles/157935.html

XML serialization tips in .NET

Today, my team ran across a strange issue. Some of the properties on a .NET class were not getting serialized to XML when used in webservices. There was no error message or any other warning. 

Closer examination revealed that the properties not getting serialized were 'read-only' properties; i.e. they had getters but no setters. The default XML Serializer in .NET calls the property getters/setters and hence if a read-only property is present, then it is not serialized.

Once we added setters to the properties, XML serialization worked fine.

There is another option. We can implement the IXmlSerializable interface and write custom serialization code. But this could be very tedious. 

Java to .NET conversion tools

Today one of our teams was looking for a Java to .NET conversion tool. They had developed resuable components in Java and the client wanted similar components in their .NET environment.

Microsoft used to ship a module called JLCA (Java Language Conversion Assistant) that enables us to covert Java code to .NET code. This tool was shipped as part of VS 2005, but unfortunately is no longer shipped with VS 2008. Please read Microsoft's statement here regarding JLCA. 

I had a quick look at the tool by launching it from VS 2005 and selecting a few Java util libraries. The results looked good, but we need to understand that 100% conversion is not possible. The tool puts in a lot of comments in the generated .NET code, so all errors and warning are maked in the generated code. Also a cool HTML report is generated that mentions the errors and warnings. I could find tons of errros/warnings, but most of them fell into expected categories such as no direct mapping between Java and .Net classses, etc.

ArtinSoft offers an enhanced version of the JLCA tool called JLCA Companion. I have not evaluated this, but the documentations states interesting features for customization.

To summarize, I believe such migration tools are useful to jumpstart the process and have a foundation ready to work on.

Async calls in Java and .NET webservices

Over the past few weeks, the Architecture Support Group that I head at my organization, received quite a few queries on making asynchronous web service calls in a SOA environment. So decided to blog about the various options at hand.

To make asych webservice calls in .NET, the following programming models are available. Please visit the links for furthur information.

1. Using Asychronous Callback delegates.  

2. Using Event Based Asych methods

3. Fire and Forget mechanism: Here we can decorate the server side webmethod with the 'OneWay' attribute.

On the Java side, the popular Axis-2 framework supports asych web services calls out of the box, by generating call back handlers in the webservice proxy.

The WS-Addressing specification is also trying to bring in a standard for defining different MEP (Message Exchange Patterns).

Smart Client Applications

Just read this blog entry about Smart Client technology and an architect's dilemma to choose an appropriate client UI technology. I had blogged about Smart Clients earlier here. 

In the blog posts, Philip discusses the scenarios where-in a thin web-based client makes sense. For SmartClient, he says that 'offline' applications are the best fit where it makes sense to use a thick client. I feel there is another strong reason why one would want to select Smart Client UI - a rich user experience. Even with cutting edge Ajax solutions, it is impossible to get the same look and feel of a desktop application over a browser.  We also have powerful WinForms/SmartClient third-party controls such as those from Infragistics that enable you to slice-n-dice thousands of records in a grid. Such raw power is not available over a web interface.

Other important point raised by Philip was the security aspect of Smart Client applications. How would we protect the client code and data from being compromised? Possible solutions:

- Encrypt all data
- Obfuscate the dlls

- Resolve data concurrency errors and database replication errors.

Global exception handler in Win Forms and Smart Client

I always wondered if it is possible to add a global exception handler for a Win Form application. This global exception handler would handle all exceptions that have not been caught in the UI forms. In web forms, we have the onError event handler in Global.asax, but I was not sure if Windows forms had a similar functionality. 

I got the answer from Rich Newman's blog here:

http://richnewman.wordpress.com/2007/04/08/top-level-exception-handling-in-windows-forms-applications-part-1/

Another option I had tried out was using the Policy Injection Block to capture all unhandled exceptions. But the caveat here is that all objects need to be proxied, which may be tedious to do.

Priciples of SOA

Was reading "Thomas Erl's book - Priciples of Service Design" over the weekend.

It's an interesting book with a lucid language and simple to understand examples. 

Jotting down some of the design principles for SOA:

• Services should be platform neutral and programming language neutral
  
• Services should have a standard interface contract
  
• Services should be loosely coupled
  
• Design for coarse grained services
  
• Service Abstraction - Hide information that is not required by clients. Hide underlying technology details. Promotes loose coupling.
  
• Service Reusability - Position services as enterprise resources with agnostic functional context; i.e. the service can be used in other functional scenarios too. Always design the service in such a way, that it can be used beyond its original context.
  
• Service Autonomy - Services need to have a high degree of control over their underlying runtime execution environment. The higher up a service is in a typical composition hierarchy, the less autonomy it tends to have due to dependencies on other composed services.
• Service Statelesness - defer or delegate state to databases, rather than in memory.
  
• Service Discovery - services can be discoved using standards such as UDDI.
  

.NET FileHelpers Library

I came across this cool and simple .NET library that I bet would be useful to everyone - FileHelpers Library 2.0

Very often, we have tasks where we need to read comma delimited files or fixed lenth files and load them into the database. Though this talk is very straight forward, the FileHelpers Library actually makes this task a breeze. Also the code looks much more clean and maintanable.

Link: http://filehelpers.sourceforge.net/

API for reading/creating Excel files in Java and .NET

Recently I was trying to find a good library for reading and writing Excel files.

In .NET, there were quite a few alternatives. Given below are 2 blog-links where the author has given a detailed analysis of the libraries.

http://blog.functionalfun.net/2008/06/reading-and-writing-excel-files-with.html

http://blog.functionalfun.net/2008/08/which-net-excel-io-component-should-i.html

For .NET, you also have the option of using the COM Excel library thats available if you have Excel(MS Office) installed on your box. But using the Excel COM Interop assembly has performance issues.

For Java, my friend pointed out that an excellent free open-source library is available at BIRT exchange. This library is called "e.Spreadsheet Excel API" and a cursory glance at the sample examples impressed me. The library is simple to use and completely free to use in your commercial applications too.

Zachman Framework

It's been some while since I attended John Zachman's seminar in Mumbai...

Recently someone asked me what the Zachman framework was? I tried to explain to him in simple terms as follows:

The Zachman framework is a classification structure for expressing the basic elements of an enterprise architecture. It a powerful tool for organizing architectural artifacts (design documents, specs, models, etc.) based on context or perspective.

The Zachman Framework is a matrix formed by the intersection of two classifications.

The columns represent the primitive interrogatives - why, how, when, who, where and why. The rows represent six different prespectives, which relate to stakeholder groups (Planner, Owner, Designer, Builder, Implementer and Worker).

The intersecting cells of the Framework correspond to models which, if documented, can provide a holistic view of the enterprise.

To view the model, please view below links:

http://www.enterpriseunifiedprocess.com/images/zachmanFramework.gif

Updatable views using the 'INSTEAD OF' trigger

All views are not updatable in a database - especially if the underlying query is a complex one. This article gives interesting examples of the challenges faced in updating views.

But latest versions of databases, support a INSTEAD OF trigger, that enables us to make all views updatable. INSTEAD OF triggers fire in place of the triggering action.

The links below show how the 'INSTEAD OF' trigger can be used in different databases:

Oracle: http://www.psoug.org/reference/instead_of_trigger.html

DB: http://www-128.ibm.com/developerworks/db2/library/

techarticle/0210rielau/0210rielau.html

SQLServer: http://msdn.microsoft.com/en-us/magazine/cc164047.aspx 

Cold start Vs Warm start of programs

We often notice that if we start a Windows Forms application the first time after a system reboot, then the start-up time is quite long. But if I close and open the win-form application again, then the application start-up time is reduced drastically. This is true for all programs - Java. .NET, VB... not just WinForms. 

For e.g. open a 5 MB word doc right after reboot and then reopen it again. There would be a difference of 5x-10x in startup times.  This difference between start-up times is called as Cold start and Warm start.

This happens because of 'disk-cache'. The 'disk-cache' is part of RAM that is dedicated to caching disk pages into memory. So the next time, a program is accessed, the disk cache is hit first and if the required program is found there, then it is loaded into the program space. Hence expensive disk access is eliminated and hence the start-up time is much faster. The pages remain in disk cache as long as possible and are removed based on a FIFO principle.

Operating systems have started using this technique to make programs appear faster. 

For example superfetch service on windows vista (xp has prefetch) does this by putting your most frequent used applications into the ram, so when you launch them, they are actually launched not for the first, but second time. 

Disabling startup programs

In Windows XP, if you are getting annoyed by the number of programs that start-up when the OS loads, then there is an easy way to disable the programs we don't need.

Just type "msconfig" in the 'Run' window.  A window titled 'System Configuration Utility' would come up. Navigate to the 'StartUp' tab and uncheck those programs that need not be started at boot time.

MVP Vs MVC pattern

I was recently working on a .NET Smart Client application and came across the 'MVP' (Model View Presenter) design pattern. Having spend years developing applications on the MVC (Model View Controller) pattern (e.g. Struts, Webworks, ROR, etc.), I was intrigued to find out the difference between MVC and MVP (if any)
The core principle behind MVP and MVC remain the same - clean separation of concerns between the presentation tier and the business tier.
Some consider MVP to be a subset of MVC and there are tons of articles on the web giving differences between the two..I found most of the information muggy and more confusing. Finally I came across Phil Haack blog that explains it in simple and lucid words.
Snippets from his blog:

The two patterns are similar in that they both are concerned with separating concerns and they both contain Models and Views. Many consider the MVP pattern to simply be a variant of the MVC pattern. The key difference is suggested by the problem that the MVP pattern sought to solve with the MVC pattern. Who handles the user input?

With MVC, it’s always the controller’s responsibility to handle mouse and keyboard events. With MVP, GUI components themselves initially handle the user’s input, but delegate to the interpretation of that input to the presenter.

In modern GUI systems, GUI components themselves handle user input such as mouse movements and clicks, rather than some central controller. Thus MVP pattern is widely used in WinForms, .NET SmartClient Factory, etc.

In most web architectures, the MVC pattern is used (e.g. Struts, ASP.NET MVC, ROR, Webworks), whereas MVP pattern is mostly used in thick client architectures such as WinForms.

What the hell are all those processes running in the taskbar?

Ever opened the TaskManager on windows and wondered why there are so processes running?
HowTo-Geek gives valuable information on some of the nagging questions:

1. juschedexe
2. ctfmonexe
3. rundll32
4. svchost

Comparison of iBatis, Hibernate and JPA

As architects, we often need to decide on what OR mapping tool to use. I came across this article on JavaLobby that compares iBatis, Hibernate and JPA.

Snippets from the article:

iBATIS is best used when you need complete control of the SQL. It is also useful when the SQL queries need to be fine-tuned. iBATIS should not be used when you have full control over both the application and the database design, because in such cases the application could be modified to suit the database, or vice versa. In such situations, you could build a fully object-relational application, and other ORM tools are preferable. As iBATIS is more SQL-centric, it is generally referred to as inverted -- fully ORM tools generate SQL, whereas iBATIS uses SQL directly. iBATIS is also inappropriate for non-relational databases, because such databases do not support transactions and other key features that iBATIS uses.

Hibernate is best used to leverage end-to-end OR mapping. It provides a complete ORM solution, but leaves you no control over queries. Hibernate is an ideal solution for situations where you have complete control over both the application and the database design. In such cases you may modify the application to suit the database, or vice versa. In these cases you could use Hibernate to build a fully object-relational application. Hibernate is the best option for object-oriented programmers who are less familiar with SQL.

JPA should be used when you need a standard Java-based persistence solution. JPA supports inheritance and polymorphism, both features of object-oriented programming. The downside of JPA is that it requires a provider that implements it. These vendor-specific tools also provide certain other features that are not defined as part of the JPA specification. One such feature is support for caching, which is not clearly defined in JPA but is well supported by Hibernate, one of the most popular frameworks that implements JPA. Also, JPA is defined to work with relational databases only. If your persistence solution needs to be extended to other types of data stores, like XML databases, then JPA is not the answer to your persistence problem.


Conclusion:
iBATIS does not provide a complete ORM solution, and does not provide any direct mapping of objects and relational models. However, iBATIS provides you with complete control over queries. Hibernate provides a complete ORM solution, but offers you no control over the queries. Hibernate is very popular and a large and active community provides support for new users. JPA also provides a complete ORM solution, and provides support for object-oriented programming features like inheritance and polymorphism, but its performance depends on the persistence provider.

iRise visualization software

Recently on request of one of our clients, we were asked to evaluate iRise V (isualization products.
A quick perusal of what the product offered made me smile. There are so many projects that fail because the end-product is not what the business required. Sometimes the business itself is not sure of what it wants or how the end product should look like.
It's estimated that 60% of projects fail because of misunderstanding of requirements.

Using iRise visualization products, business analysis can quickly build UI elements that have the same look-and-feel and navigation as the final end product.
More information at http://www.irise.com

P.S: Just got a mail from Tom Humbarger (iRise Project Manager) that an evaluation copy of iRise Studio PE is now available for free 30-day download from Download.com. Would highly recommend it for a try.

Open Source IDS, Firewall, VPN Gateways

A few years back, if a SMB(small and medium business) shop wanted to install Firewalls, Network Intrusion Detection systems, VPN Gateways, etc. then it needed to shell out hundreds of dollars for commercial software from giants such as Cisco, Juniper etc.

But in the last few years, we have a slew of options available from the open-source world. I have been closely watching 2 products in this space:

1. Snort

Snort is an open source network intrusion prevention system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. Snort has three primary uses. It can be used as a straight packet sniffer like tcpdump, a packet logger (useful for network traffic debugging, etc), or as a full blown network intrusion prevention system.

2. Untangle

Untangle delivers an integrated family of applications that help you simplify and consolidate the network and security products you need, in one place at the network gateway. The most popular applications let businesses block spam, spyware, viruses, and phish, filter out inappropriate web content, control unwanted protocols like instant messaging, and provide remote access and support options to their employees

Today Snort has become the de-factor standard for IDS. Even Untangle uses Snort for its IDS application. I was impressed with the range of applications available on the Untangle Gateway Platform. It includes SPAM blocker, Web Filter, Firewall, IDS based on Snort, VPN Gateway based on OpenVPN, a patented attack blocker, etc. A must try-out product :)

File Watcher programs

During the early years, we often had to write our own component to monitor file changes or changes to a directory. Recently a friend of mine introduced me to the FileSystemWatcher class in .NET. We needed such a solid component and were contemplating writing it ourselves.
I was impressed with the wide range of features available in the FileSystemWatcher class. Not only will it detect changes in files, but it can monitor folders and sub-folders too.
And it can monitor a wide range of attributes - not just whether a file exists or not. For e.g. it can monitor whether the file size has changed, renamed, deleted etc.

I started wondering why there was no equivalent component in the Java SDK. The answer lies in the fact that such kind of event-raising is not available on Unix platforms. So polling is the only option that works cross-platform. When we poll, we cannot detect directory changes like renaming or moving. Also polling for a directory and all sub-directories has a big performance hit!

There a few programs available in Java that a developer can use instead of reinventing the wheel. Here are a few links that provide File watcher programs in Java:
http://jpoller.sourceforge.net/
Java-File-Watcher
Jahia File watcher

VSTS 2008 has a memory profiler

Visual Studio Team System 2005 had a profiler that was useful in obtaining response times and diagnosing time taken by each component/method.

Now in v2008, the Profiler comes equipped to do heap analysis. Information on how to enable heap analysis can be found at this blog
At the end of it, we get a report of the top methods allocating most memory, the types occupying most memory, etc.
This report is not as comprehensive as that provided by Numega DevPartner Studio.

Numega DevPartner Studio

Recently I installed DevPartner Studio and have explored the features provided by the tool. The tool integrates seamlessly into VS.NET and has the following high-level features:

- Static Analysis (Similar to FxCop or Code Analysis in VS Team Studio)

- Error Detection (You actually run the application/program and the tool would give a report of possible errors. This tool is more valuable in case of COM usage through .NET and in C, VC++ projects to detect OutOfBounds errors and dangling pointers, etc)

- Code Coverage (You run the application and at the end of it, a report is generated giving us code paths that were not executed. So helpful in finding dead code.)

- Memory Analysis (Heap analysis, shows object graph till root objects, no of objects created/destroyed etc.)

- Performance Analysis (E.g. U can create snapshots while running the application and the tool would give you the time spend in each method and many other stats. E.g. top 20 methods consuming most time, call graph, etc. Another cool feature is the source code window with time stats for each line on the left side. No more guessing what is taking so much time. )

- In Depth Performance Analyzer (CPU stats, Disk IO, Network IO, etc)

Visual Studio Team System provides us with many similar features. A VS product comparison can be found here.

Interesting features in Web 2.0 feature pack of Websphere v6.1

IBM has recently released a new feature pack for WAS 6.1 that has a host of cool features to build Web 2.0 applications.
AJAX support is provided by the DOJO Toolkit. There are a host of gadgets available (some added by IBM on top of DOJO) for RIA screens. Some features that were of particular interest to me are:

• A javascript SOAP client that will enable web clients to make webservices requests directly.
• Web-remoting RPC component that would enable a JS client to call an EJB method or a POJO method directly.
• Apache Abdera library for manipulating ATOM/RSS feeds
• JSON4J library on the server side to convert between JSON text and Java objects
• AJAX messaging to implement Server side push. This is totally cool. I always wanted to experiment with the CometD functionality available in DOJO and here the interation between the DOJO Message Bus (client) and Websphere Service Integration bus was provided out of the box :)

A good example showing Stock Quote Streaming can be found here.

Finding the geographical location of client web requests

Nowadays, we see many sites that show our geographical location the screen when we hit the page.
So how do the sites find out this information? Well, on the server side, we can obtain the IP address of the client (or the Internet provider proxy) from the request object.

From this IP address, we can query a database(typically csv files) and obtain the location information. The country information is free and available for download here.

For state and city information, U got to stuff out some moolah.. :)
More information can be found out here-
http://www.ip2location.com/faqs-ip-country.aspx

Kernel mode and User mode

In IIS 6.0, the core HTTP engine (HTTP.SYS) runs in kernel mode and all worker processes run in user mode. So what exactly is the difference between kernel mode and user mode programs?

User mode and kernel mode refers to the privilege level a process has to the system hardware. The closer to the hardware the process becomes, the more sensitive the system is to provoking system failure. In any OS, you want to separate applications from OS services because you want the OS to remain functional if an application crashes.

Typical OS architecture has two rings: one ring running in system mode, and a ring running in user mode. The kernel has full control of the
hardware and provides abstractions for the processes running in user mode. A process running in user mode cannot access the hardware, and must use the abstractions provided by the kernel. It can call certain services of the kernel by making "system calls" or kernel calls. The
kernel only offers the basic services. All others are provided by programs running in user mode.

Kernel mode program also run much faster than User mode programs as they are much closer to the hardware.

Overcoming the 2 connection limit in browsers

The HTTP 1.1 protocol dictates that browsers cannot make more than 2 connections per domain name. This limitation can cause slow page loads for pages containing a lot of images or other references to external resources.
To overcome this limitation, we can create sub-domains and serve other static content from these sub-domains, so that the browser can create extra 2 connections for each sub-domain.
This trick is explained in the following links:

http://brainspl.at/articles/2006/12/29/speed-up-page-loads
http://www.die.net/musings/page_load_time/

Actually the above technique is only useful if there are a lot of external resources that need to be loaded by the page. HTTP 1.1 also brought in the concept of HTTP pipelining. This means that over those two connections the browser can send the requests back-to-back before even before receiving a single response. This completely eliminates the dead-time between getting back the last packet of the previous request and then sending the next request. Instead, all the requests are queued at the server, which sends out responses as fast as TCP/IP would allow. If HTTP pipelining is enabled, then the page load speed improves dramatically.

But unfortunately, HTTP pipelining is disabled by default in IE/Firefox- bcoz not all proxies and servers support it still. To enable pipelining in Firefox type "about:config" in Firefox's location bar and enable the "network.http.pipelining" preference.

Oracle RAC and Dataguard

A lot of IT managers get confused between what a Oracle RAC does and what Dataguard does.

Oracle RAC provides us with a cluster of Oracle instances for the same database/datastore. This enables massive scalability and availability. But it does not provide protection against failure of the database or corruption of the data. e.g. natural disaster that resulted in data-loss or data-corruption.

Oracle dataguard enables creation of a standby database at a DR site and thus provides data protection.

ViewState in ASP.NET

There is so much confusion over what ViewState does and why is it required. Finally the following link helped me in understanding a lot of things:
http://weblogs.asp.net/infinitiesloop/archive/2006/08/03/Truly-Understanding-Viewstate.aspx

Snippets from the above article:
Server Controls utilize ViewState as the backing store for most, if not all their properties. That means when you declare an attribute on a server control, that value is usually ultimately stored as an entry in that control's ViewState StateBag.
ASP.NET calls TrackViewState() on the StateBag during the OnInit phase of the page/control lifecycle. This little trick ASP.NET uses to populate properties allows it to easily detect the difference between a declaratively set value and dynamically set value.
When the StateBag is asked to save and return it's state (StateBag.SaveViewState()), it only does so for the items contained within it that are marked as Dirty. That is why StateBag has the tracking feature. In order for data to be serialized, it must be marked as dirty. In order to be marked as dirty, it's value must be set after TrackViewState() is called.

When the page first begins to load during a postback (even prior to initialization), all the properties are set to their declared natural defaults. Then OnInit occurs. During the OnInit phase, ASP.NET calls TrackViewState() on all the StateBags. Then LoadViewState() is called with the deserialized data that was dirty from the previous request. The StateBag calls Add(key, value) for each of those items. Since the StateBag is tracking at this point, the value is marked dirty, so that it may be persisted once again for the next postback.

ViewState is only one way controls maintain values across postbacks. Regular good old HTML FORMS play a role, too. For example, disable viewstate on a textbox, and it will still maintain its value, because it is POSTING the value with the form. Make that TextBox invisible then do a post, and the value is lost. Thats where ViewState helps, which would allow it to maintain the value even if its invisible.

The option to set control properties in the OnPreInit event in order to avoid those values from being entered into the viewstate is a good idea to avoid storing these values in the ViewState. To avoid Datagrids from storing values in the ViewState, rebind the data to the grid on each page load.

Security Principles

Browsing thru the OWASP site, I came across the following security principles that are of interest while designing the security architecture. Every security policy has 3 objectives:
a) Confidentiality b)Integrity c)Availability

Examples of security principles:
1: Securing the weakest link (The chain is only as strong as its weakest link) - e.g. Attackers will not target the firewall, but the applications accessible through the firewall.

2: Minimize Attack Surface Area - design the system such that the potential areas for intrusion are reduced.

3. Principle of Least Privilege - only give those permissions to the user that are required.

4. Principle of Defense in Depth - e.g. Do validations at the front-end using Javascript, in the web-tier using validation logic, in the database using constraints and triggers.

5. Fail securely - If an application/program fails, then it should not leave the system in an insecure state.

6. Separation of Duties - e.g.an administrator should be able to turn the system on or off, set passwordpolicy but shouldn’t be able to log on to the storefront as a super privileged user, such as beingable to buy goods on behalf of other users.

7. Don't just rely on security by obscurity. Use security by design. Use elements of both the strategies.

The following links provide interesting material for reading:
http://www.infoworld.com/article/05/08/19/34OPsecadvise_1.html
http://en.wikipedia.org/wiki/Honeypot_%28computing%29

XSS and CSRF attacks

Of late, I have been doing a lot of study to understand 'Cross-Site Scripting' attacks and 'Cross Sitre Request forging' attacks.
XSS flaws occur whenever an application takes user supplied data and sends it to a web browser without first validating or encoding that content. XSS allows attackers to execute script in the victim's browser which can hijack user sessions, deface web sites, possibly introduce worms, etc. http://www.technicalinfo.net/papers/CSS.html
http://www.shocking.com/~rsnake/xss.html

How to prevent XSS atacks? Tips from the www.owasp.org site
1. Use proper input validation techniques
2. Encoding the output. This includes data read from files and databases.
For input validation, its better to go for a ‘positive’ security policy that specifies what is allowed rather than a ‘Negative’ or attack signature based policies as they are difficult to maintain and are likely to be incomplete.

The following link at MSDN contains some good info about preventing XSS attacks:
http://msdn2.microsoft.com/en-us/library/ms998274.aspx
Microsoft even has a "Anti-Cross Site Scripting Library" available at:
http://msdn2.microsoft.com/en-us/library/aa973813.aspx

The OWASP site defines CSRF as follows:
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into loading a page that contains a malicious request. It is malicious in the sense that it inherits the identity and privileges of the victim to perform an undesired function on the victim's behalf, like change the victim's e-mail address, home address, or password, or purchase something. CSRF attacks generally target functions that cause a state change on the server but can also be used to access sensitive data.

One technique to prevent event CSRF attacks is to use the 'Token Synchronization' pattern. Sample filters for JEE and .NET are available on the OSWAP site at the following links:
http://www.owasp.org/index.php/CSRF_Guard
http://www.owasp.org/index.php/.Net_CSRF_Guard