XAML Part 2.

Ok, what is XAML and what does it look like?

XAML defines an application's UI, with tags representing standard Windows controls and attributes representing their properties. Nothing revolutionary there! Here's a simple XAML page:


<Canvas xmlns="http://schemas.microsoft.com/2003/XAML" ID="sample">
     <Label ID="exampleLabel1" FontFamily="verdana" FontSize="8" Canvas.Top="10" Canvas.Left="10">This is a label's text!</Label>
     <TextBox ID="exampleTextBox1" FontSize="8" Canvas.Top="8" Canvas.Left="75">This is some text in a TextBox!</TextBox>
     <Label ID="exampleLabel2" FontFamily="verdana" FontSize="8" Canvas.Top="35" Canvas.Left="10">Another Label control</Label>
     <TextBox ID="exampleTextBox2" FontSize="8" Canvas.Top="33" Canvas.Left="75"></TextBox>
     <Button ID="exampleButton" Width="50" Canvas.Top="60" Canvas.Left="155">OK</Button>
</Canvas>


Note that the example above is based on the original "Avalon" preview - I haven't had chance to check out the latest bits, but note that the schema namespace is http://schemas.microsoft.com/winfx/avalon/2005 in the latest release.

Each XAML page consists of a root panel element (a Canvas in this case) that contains nested controls, such as Labels, TextBoxes, and Buttons. "Avalon" deserializes these elements into live object instances of strongly-typed controls, using the attribute values (such as ID or Width) to set the object property values. Note that positioning is handled by the strange Canvas.Left, Canvas.Top construct; these are known as "extended attributes", and elements inherit these because they are nested within a Canvas element. This is strikingly similar to the way "expando" properties work in IE (you may have used them when using DHTML Behaviors); but that's no coincidence - the IE team members are heavily involved with "Avalon".

Each XAML element corresponds to a class in the "WinFx" release of the .NET framework. When the application runs the XAML markup is deserialized into objects by the runtime; markup elements become object instances, and properties are set according to the values defined in the XAML elements' attributes. The concepts involved are exactly the same as how you serialise and deserialize objects to and from XML using .NET 1.x today.

The root element of all XAML documents is one of the subclasses that inherit from the Longhorn Panel class. There are several different panels that provide positioning and layout services. If you create a XAML Application with the Visual Studio.NET "Whidbey" alpha on the "Longhorn" preview, it creates a default Canvas panel, which provides something similar to absolute positioning in Web pages or the standard positioning model in Windows Forms.

Just like a web app, a XAML application is made up of pages. A .proj file groups the pages together into an application, and in addition to containing information about each XAML page, also specifies compiler settings, such as version info. It also controls whether the app will run in the browser (i.e. run from the server, like a web app), or be displayed in a window (i.e. installed to the client, like a thick client). An application definition file defines the application's navigation model and application-level events. If you're familiar with .NET, then you should be seeing shades of ASP.NET and Win Forms development by now... but a subtle combination of the two...

More soon... inlcuding some info on "rival" application markup initiatives... and some products that allow you to create XAML applications that run on .NET 1.x...

If you need more info on any of the above (keep in mind that "Avalon" is still under development, and anything can change until it ships!), please see the MS "Longhorn" SDK site, which contains all the publicly available info on "Longhorn", "Avalon" and XAML.

XAML / Avalon Part 1.

Over the next few posts I'm going to cover what XAML is, how it fits in with current UI toolkits / web standards, and what the implications are for app development on Windows in the future.

Most devs are probably already aware that "Longhorn" is the codename for the next version of Windows, and that "Avalon" is the codename for the user services layer. "Avalon" is essentially a vector graphics engine which will allow for extremely rich GUIs that, when released, will make today's applications look like something from the stone age. Originally, MS declared that "Avalon" (& "Indigo", the comms layer that combines next generation web services with .net remoting-esque services) would only be available with "Longhorn". They've since backtracked, and downlevel versions both "Avalon" and "Indigo" will also be available on WinXP.

XAML (Extensible Application Markup Language, pronounced "zammel") is an XML dialect that developers will use to author applications for Longhorn. Currently, if you want to create an app, you have to decide on which platform to support - are you going thin or thick client? If thin, will you target devices as well, and which browsers will you support? XAML lets you define a single set of markup pages and code which can run as a standard installed desktop app, or run from a server; the platform choice you make now will essentially become a deployment choice. Your application source will remain the same, the UI if run through "Avalon" will be the same rich UI regardless. I've not gotten to the bottom of it yet, but I'm assuming that XAML will also render as HTML on downlevel browsers, in a similar way that ASP.NET mobile controls render different output based on the nature of the requesting device.

This is a big step change from the current model, where thick and thin clients run on different platforms and require mastery of completely different technologies and development techniques.

Next: more on XAML; what it looks like; XAML pages; the "Avalon" object model.

Firefox, Malware, and a False Sense of Security

Firefox users are always crowing about insecure IE is; Firefox, they say, is impregnable - it doesn't suffer from spyware or other malware. The same goes for the Linux & Apple crowd (OSX is built on top of Linux).

Apparently, Firefox sypware is on the way, either this year or next, depending on which security expert you talk to. The reason for this is, apparently Firefox is just as vulnerable to malware as IE, it's just that IE is more popular than other browsers, so it's not worth the malware-writers' time to create exploits... yet.

Meanwhile, Apple has had to issue patches to OSX... some for vulnerabilites that have been in Linux for some time; and some researchers are claiming that Windows is more secure than Linux:

Their criteria included the number of reported vulnerabilities and their severity, as well as the number of patches issued and days of risk — the period from when a vulnerability is first reported to when a patch is issued. On average, the Windows setup had just over 30 days of risk versus 71 days for the Red Hat setup, their study found.

Unfortunately, a myth has been created that only MS platforms are insecure and that everything else is invulnerable. The truth of the matter is, MS products are more popular, and so the virus writers tend to be on MS platforms, or are looking to get their virus on as many desktops as possible. Users of other platforms may well be labouring under a false sense of security...

Another MS AV Acquisition

MS have gone and bought Sybari, an anti-virus company that specialises in AV for e-mail (including anti-spam) and IM; along with their acquisition of GeCad last year, and along with their statement about creating multi-layered protection against threats, looks like another link in the chain of their imminent AV product suite, with the Sybari software protecting MS Exchange and Live Communication Server.

MS Fingerprint Reader

This is really cool... no more having to remember loads of different passwords! The software hooks into the Windows shell, so once you're registered your fingerprints you can log in just by scanning a finger.

What's really cool is that you can also use it with any application or web page that has a login form. You load up the page in IE, scan your finger, and up pops the password manager dialog where you specify the required input for each field (id, password, etc), which button or action to take to submit the page, and that's it! Whenever you load the page in future, you just scan your finger and you're logged in! The software is really well written and it works a treat, and also saves each login page as a "quick link", on a menu that pops from the tray icon when you scan your finger (scanning is context sensitive, so if you're at a login page it knows about, it will log you in, prompt you for credentials if it doesn't know about it, or otherwise pops the tray menu). Saves loads of tedious typing...

One niggle: I had a problem during installation which lead to the installer program hanging; it was failing to start or stop the Biometric Authenication service (which it installs for you), and cancelling the setup didn't roll this back, so I had to manually clean this up before attempting the installation again; disabling my firewall during installation seemed to do the trick (I also downloaded the latest software from the MS site), but not exactly ideal...

More Info on IE7...

... kind of. Not so much what's in it, but MS have admitted there will be a third service pack for Windows XP... my guess is that this will be the one containing the XP-compatible bits for "Avalon" and "Indigo" (which will find their apotheosis under "Longhorn").

According to Microsoft's Mike Nash:

"We'll be updating Windows on a regular basis," he said. "How the browser gets
packaged--whether it's with a service pack--has not been nailed down. There is
going to be a Service Pack 3 (of Windows XP). That's not a surprise. How that
relates to (IE 7's release), we haven't figured out yet."

IE will need an update to handle "Avalon", so it makes sense to release this new version at the same time, or perhaps slightly ahead of the pre-"Longhorn" XP release (which will no doubt form the bulk of XP sp3). It all seems a little bit vague, as if MS are on the backfoot with IE - they had a long-term plan to update IE at some point on "Longhorn" (which is why they dismantled the IE team and put them all on the "Avalon" team), but now the success of Firefox, and the constant niggling security and web standards compatibility issues nibbling away at the IE market share has forced them to think again. Can they pull this off?

Meanwhile, Firefox downloads reach the 25 million mark.

MS Anti-Spyware Refresh

Talk of the devil, and he shall appear! A refresh build of the Anti-Spyware tool has just been released within the last couple of hours. This is version 1.0.509, and can be downloaded from http://www.microsoft.com/downloads/details.aspx?FamilyId=321CD7A2-6A57-4C57-A8BD-DBF62EDA9671&displaylang=en

Note that the auto-update functionality available within the tool will not download this version, so it's a manual download & install, I'm afraid.

MS Security Products

Bill Gates has made the MS policy on their upcoming security products a little bit clearer:

• Anti-Spyware will be available in consumer and enterprise editions; the consumer edition will be free, and there will be another beta release within the next few months;
• They're also planning to deliver what they call "the ultimate mail virus protection" by the end of this year;
• The anti-virus software will be based on the GeCAD engine, which MS acquired when it bought up GeCAD (A Romanian AV company) last year;
• There're rumours of an anti-spyware / anti-virus / firewall bundle of products being released on a subscription basis (presumably to enterprise customers), which is currently codenamed "A1";

In one fell swoop, it looks as if MS are planning to kill the idea that its OS is insecure, and is vulnerable to viruses and spyware... or is it placing a sticking-plaster on a nasty wound?

I think it's a step in the right direction for them, but I wonder what the AV vendors think of this news?

IE7 Announced

There have been rumours floating around for a while about a new version of IE, planned for release later this year. Bill Gates has gone and officially announced it (no release date yet), along with a statement that the anti spyware software (currently in beta) will be provided free to existing Windows customers.

So what will it include? You can scour the IE feature request wiki for an idea of what might be included; my money's on the antispyware being bundled with IE in some way (i.e. as part of a service pack to XP that would include IE7, anti spyware, and maybe "Avalon" & "Indigo", though depends what kind of release schedule we're looking at).

In any case, they're touting security as the number 1 concern for IE7, but they're going to have to give us something big and interesting to tempt people back from Firefox. At the end of the day, security's important, but highly boring.

You'll find lots of references to "tabbed browsing" on the wiki - it seems that's the main feature request; personally, I think this is a red herring. Tabs have become a symbol of a stagnating IE - while other browsers have continued to evolve, IE has just had continuous security patches released. Firefox is liked so much because it's open source, anyone can contribute, and new features are based on what people really want; it's also easily extensible, so any old geek can write an extension or plug-in and show it off.

Personally, I tried Firefox, and, yeah, it's ok; but it wasn't good enough for me to make it my default browser (note to Firefox zealots - I'm not an MS-zombie - if their products suck I'm happy to say so). What I like about Firefox is not the product, but the spirit in which it was created - it's an open platform (it's extensible in a way IE isn't), it has good support for open web standards, and is (apparently) secure. Yet, I'm not going to go with it just because it's not MS, or as a protest at IE being left to stagnate.

So, I'll be very interested to see what's going to appear in the beta, due some time this year. In the meantime, you may be interested in the following: http://bertc.com/billgates.htm

Visual Studio Paranoia Lasts a Long Time...

As an aside to my recent rant about VS.NET, I just realised today a lingering paranoia resulting from my use of the early betas over four years ago...

Basically, I hit ctl+s after I type every line of code; it's automatic - I don't even know I'm doing it. I'm obviously paranoid about leaving any unsaved changes, as I still remember the utter horror and heartbreak of having my work swallowed up by a VS.NET crash. VS doesn't even crash that much these days, but I still do it. Sometimes I hit ctl+s two or three times in succession, just in case...

Turns out I also do it when I'm using MS Word.

I can understand the jibes of the Linux crowd about MS products; while they're a lot more stable these days than they used to be, and a lot more secure, there's still that lingering paranoia that won't go away, justified or not.

Tired, Tired, Tired of Visual Studio.NET

Yep, you heard me say it. I'm tired of VS.NET. It's full of annoying bugs, it's slow, fat, and generally annoying; but there's more to it for me, because of my history of using it.

I've used VS.NET since December 2000, when I first got my hands on beta1. Prior to that, I'd used the old Visual Studio since 1997, although it wasn't really a composite entity back then, each language had its own IDE. The tools back then were fairly stable, and MS would release regular service packs for each version. You wouldn't have to live with major bugs for long. Things weren't perfect, obviously; MTS and DLL Hell were real problems, but once you knew the rules you could bypass or ease most of the pain. Also, Visual InterDev, the ASP development environment, sucked (users of InterDev fall into two camps - those that used it because it was the only tool available for the job, and those that thought it was the greatest thing in the world & wouldn't hear anything said against it. Personally, I thought that a) the debugger was notoriously difficult to set up, usually wouldn't work, and also prevented anyone else from working while one person was debugging, and b) the only editing features it offered was to colour your server-side code yellow).

Then the company I was with at the time decided to embark on the re-engineering of their systems using .NET; we had an MS consultant in at the time reviewing our systems, and he convinced my bosses that .NET was just what we needed. He did such a good job, they decided they would grab the first public beta as soon as it was relased (the .NET Early Adopters Program, where regular non-public releases are used, was too pricey).

We were all pretty excited about it. We were going to get our mitts on the brand new technology and tools before anyone else! At the time, I was leading the internet development team for the company, and the prospect of jettisoning InterDev was great. So, I eagerly attempted to download the beta1 bits, again and again (everyone in the world was trying to download it at the same time, apparently) until finally I had gone through the painfully long install (still with us, even in beta1 of VS 2005) and was sitting in front of .NET beta1.

At first, it was cool. We all learned the new features, and started picking through the .NET framework. Then the playing had to stop. We had a project to deliver, with all the usual deadlines, meetings, problems and politics of any other project; but the one critical difference was: we were using beta development tools.

Man, that was hard. The software, as you can expect, crashed often. It chewed up your code without warning, crashed and lost your work (I was having probably about 4 - 5 crashes a day, some people had more); sometimes, when it crashed, it wouldn't reopen your solution, so you had to manually edit files using trial and error to see what had gone wrong before loading VS again. SourceSafe integration wasn't there, so we had to introduce some rules to ensure we had proper source control. On top of this, people didn't have time to learn the new technology properly; there were no training courses; the MS consultants in the UK didn't have the information (when we had questions, they had to go to the product teams in the US), and they probably learned a lot about .NET from us. Little problems would take weeks to sort out, and in the end we had to put in place hacky workarounds (for instance, there was no URLBehavior property on web references in beta1, so once you entered a URL for your web reference, which in our case was always localhost, it was "burned" into the resulting DLL, with no way to configure it on release - took us a while to realise this, i.e. we were well down the dev path with release deadlines burning us, and I had to write code to dynamically reassign the url using config.web - oh, yeah, they reversed this name to web.config with beta2...).

Beta2 brought significant changes - it was like a new product; beta1 turned out to be un-installable, so new dev builds had to be imaged, and all our machines rebuilt. Upgrading to the new beta was a major undertaking, and I had to do a lot of research into this; I took a copy of our code base and upgraded it to beta2, documenting every change I made, while development continued on the code (we had deadlines, and absolutely could not stop dev to do the upgrade). Once I had the upgrade notes, we took a weekend out to migrate the code. Beta2 brought its own bugs; it had source control integrated, but it wasn't perfect. VS continued to mangle and delete code - in particular, it would delete ASP.NET control declarations, so you'd have to manually re-enter them again (or, copy and paste them to a text file, then paste them back when it happened); we stopped using the form designer, because it would just completely mangle and destroy your page.

That's another thing, and excuse me while I digress into a sub-rant - I've been using MS products to create web pages since 1996, when FrontPage was released; this tool was notorious for reformatting your carefully prepared HTML; InterDev did it, as does VS.NET; now, finally, with the VS 2005 release we're told this is fixed. Only took 9 years!

Right, rant over. I still see VS as that bloated, slow, buggy beta app I first saw back in December 2000; I don't see much different in VS 1.x - it still contains bugs that cause me to lose code (esp. in Windows Forms); more infuriating, MS still doesn't release service packs for all those annoying bugs! When you're developing software to tight deadlines, the last thing you need is a buggy dev env.

Please let VS 2005 be the cool, fast RAD development environment we were promised back in 2000!

More Comments on the Anti-OO Article

Some quite vehement comments on Mansfield's DevX editorial, OOP Is Much Better in Theory Than in Practice, as you would expect from readers of theserverside.com.

Some quotes from the various folks who commented (I haven't included their names, but you can see these & all the rest by following the link to the postings):

This one easily takes the cake as Stupidest Article of 2005... so far. With just eleven months left, it will be tough to find something more misguided, based on even less actual knowledge and logical thinking.

I think anyone who’s worked at large company has run across this type of developer. They normally come from a COBOL background and find all those objects confusing. They definitely don’t see any problem with cut and pasting code.

Would've been a lovely article if it were posted in the 80s as part of the OOP war.

Whoehahahahaha what a joke. Just get it off, i wasted time reading this.

The author is a VB guy. Look at his books on Amazon: 2-star rated VB book. If you look at his other books, they are all VB-related.

I guess this fellow is just like a lot of old guys, they kept stucked in the past, geez look at this guy he was editor and jatti jatta blah blah blah, but at 80's. I know a lot of people in the industry have a lot of experience and all that, but the experience is nothing when you don't evolve with the industry.

This is such a 1970s attitude! Much of the original OOP development was done in Smalltalk in the 70s, and then they concentrated on using OOP for GUI code. This was a short-lived phase, as OOP soon researchers realised that object-orientation was a general technique that could be more widely applied. It pains me to see people stating ideas that are 30 years out of date!

what happens when an error occurs on the code which is copied and pasted at 10 different locations on the code-base ?? didn't author think about that ???

I don't think he is a real person.

UIP & Updater Blocks / Enterprise Library Update

Tom Hollander replied to a posting I made on Ron Jacob's blog re. the blocks missing from the EL. Apparently:

Smart Client blocks and UIP: Yes, we're working on it. We had to limit the scope of Enterprise Library v1 to get it out the door sooner, but we're working on new blocks that will be given the same treatment

DevX Readers Response to the Anti-OO Article

Some feedback from readers on Richard Mansfield's (apparently not tongue-in-cheek) article: Riled Readers Respond to Restive OOP Rejection