John Sonmez from SimpleProgrammer.com published yesterday a huge list of developer PodCasts.

The list is organized by categories such as:

• General Interest to Software Developers
• .Net and Microsoft Related
• Mobile Development
• Javascript and Web
• Game Development
• Freelancing
• Entrepreneurial / Bootstrapped
• Python
• PHP
• Ruby
• C++
• Java and JVM Languages
• Miscellaneous Languages
• Data and Machine Learning
• Agile / Scrum
• DevOps
• Cloud
• SQL and Databases

A pretty impressive list John!

The list can be found at The ultimate list of developer PodCasts

This video gives a brief introduction to PowerShell. It provides a (hopefully) valuable set of advices and commands that can be used by every developers while performing their day 2 day development activities on windows with PowerShell.

I’m currently following the Pluralsight training Full Stack Node.js. The course was release more than a year ago and it is based on express.js 2.x.
I have chosen to build the course sample on express 3.x and because of this some features described on the course are no more applicable.
The purpose of this blog post is to actually demonstrate how to migrate properly one of the them: “The Flashing”.

Simply put, the flashing consist of displaying a status message once an operation executed on a post has completed.
The Flashing is particularly useful when using the Post/Redirect/Get Pattern. The all scenario can be described as:

1. The user submit a form with a POST action
2. The user form is process and a result status is generated such as “Error” or “Success”
3. The Post action completes with a redirect that will tell the client browser to GET another page.
4. The rendering of the get result should display the processing status

I found several questions on stackexchange explaining how to do that but none of them was clear enough for me to understand…
So I digged a bit and I decide to share my findings here.

The original solution was using app.dynamicHelpers which is not applicable anymore.
The migration document from express 2.x to 3.x just says replace with:

middleware and res.locals…

Fine… How am I suppose to do that? Well I believe the answer is incomplete.

You will use the middleware to add processing into the handling of your request and its response.
After all this is why the middleware is there for. Then in the middleware you will attach a function that can be used in the route handler.
This function will use res.locals to attach something to your response that can be used on the rendering of the view. This is incomplete…
or at least this how I understood it and it felt incomplete.

Our problem here is that we are using the Post/Redirect/Pattern and this means that all data attach to the res.locals vanish as soon as you do a redirect.
The redirect will instruct the browser to perform a GET and this will start the request from the processing of the HTTP request from the beginning.
There is no way to solve our issue just with a middleware and res.locals!!! We need a way to pass information from the POST and REDIRECT to the following GET.
The only to do this is via a cookie or in the session. But those will then need to be cleaned once the status message has been displayed.

This is how I have achieved this. First I have implemented the middleware and it looks like this:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

"use strict";
 
var currentRes;
var currentReq;
module.exports = function(){
    return function(req, res, next) {
        //We save the response and request reference has we will need it later
        currentRes = res;
        currentReq = req;
        //We attach the flash function to be used from the route handler
        req.flash = _flash;
        //We read the status from the session if it is there and we remove it
        _flash();
        next();
    };
};
 
var _flash = function(type,message){
    //We need a session if there is none... Then we raise an exception
    if (currentReq.session === undefined) {
        throw Error('req.flash() requires sessions');
    }
    //This the usage from the route handler. This will store the status message in the POST processing
    if(type && message){
        currentReq.session.flash = {flashType:type,flashMessage:message};
    } else {
        //If no parameter are passed then we read the eventual value saved on the session and we attach it to res.locals for the rendering
        if (currentReq.session.flash){
            var flashObj = currentReq.session.flash;
            currentRes.locals.flashTypes = ['info','error'];
            currentRes.locals.flash = {};
            currentRes.locals.flash[flashObj.flashType] =flashObj.flashMessage;
            delete currentReq.session['flash'];
        }
    }
};

The middleware will need to be added to your app express instance as usual.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

var flash = require('./middleware/flash');
 
var app = module.exports= express();
 
app.configure(function(){
    app.set('port', process.env.PORT || 3000);
    app.set('views', path.join(__dirname, 'views'));
    app.set('view engine', 'jade');
    app.use(express.favicon());
    app.use(express.logger('dev'));
    app.use(express.json());
    app.use(express.urlencoded());
    app.use(express.methodOverride());
    app.use(express.cookieParser());
    app.use(express.session({
        secret:"mysupersecrethash",
        store: new RedisStore()
    }));
    app.use(flash());
    app.use(app.router);
    app.use(express.static(path.join(__dirname, 'public')));
 
    if('test' === app.get('env')){
        app.set('port',3001);
    }
 
    // development only
    if ('development' === app.get('env')) {
      app.use(express.errorHandler());
    }
});

Then from the route handler of the POST processing we have the following implementation.
This is basically where we set the status of the processing.

1
2
3
4
5
6
7
8
9
10

app.post('/sessions',function(req,res){
    if(('admin' === req.body.user) && '12345'===req.body.password){
        req.session.currentUser = req.body.user;
        req.flash('info',"You are logged in as "+req.session.currentUser);
        res.redirect('/login');
        return;
    }
    req.flash('error',"Those credentials were incorrect. Try Again");
    res.redirect('/login');
});

And finally we can use the status information that will have been attached to the res.locals from the jade template

1
2
3
4

if (typeof(flash) !=='undefined')
    each flashType in flashTypes
        if flash[flashType]
            p.flash(class=flashType) #{flash[flashType]}

I had recently a discussion with a younger developper in C# that was asking question about the usage of the yield keyword.
He was saying he never used and though it was useless. He then confessed me it didn’t really understood wath the keyword was exactly about.
I tryed to explain him what it does and this the material I would have used it if I had it at that time.
I will try with this post to explain what “yield” is all about with simple but concrete examples.

First thing first. Where can we use it?

It should be used in a function that returns an instance that implement IEnumerable or and IEnumerable<> interfaces.
The function must return explicitely one onf those interfaces like the two following functions:

1
2
3
4
5
6
7
8
9
10
11
12
13
14

public IEnumerable GetIntegers1()
{
    yield return 1;
    yield return 2;
    yield return 3;
}
 
public IEnumerable<int> GetIntegers2()
{
    yield return 1;
    yield return 2;
    yield return 3;
}

By returning the IEnumerable interfaces those functions become iteratable and can now be used directly from the foreach loop like:

1
2
3
4
5
6
7
8
9
10

foreach (var i in GetIntegers1())
{
    Console.WriteLine(i.ToString());
}
 
foreach (int i in GetIntegers2())
{
    Console.WriteLine(i.ToString());
}

Ok but why using it?

What is the difference between those two functions and this one?

1
2
3
4
5

public IEnumerable GetIntegers1()
{
    return new List{1,2,3}
}

It might not be obvious at first sight as the result is identical but the execution flow is different.
Basically if you debug the program execution you will see the following for the returned list

1. Enter the foreach loop
2. Call the GetIntegers ONCE
3. Write the first number
4. Write the second number
5. Write the third line

And you will see the following when using the yield return

1. Enter the foreach loop
2. Call the GetIntegers but leave at the first return
3. Write the first number
4. Call the GetIntegers but start at the second return and leave just after
5. Write the second number
6. Call the GetIntegers but start at the third return and leave just after
7. Write the third line

That is all. It simply changes the execution flow and allow you to handle each element of the list one by one before the next element is called.

Fantastic! but is this magic?

No it is not. You could have achieve the same result by having implemented yourself the iterator pattern using the interface IEnumerable and IEnumerator and building a dedicated class to handle this like the following code (for simplicity I will only implement IEnumerable but IEnumerable<> could have been implemented as well):

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

public class IterableList : IEnumerable, IEnumerator
{
    public List numbers;
    public int index;
 
    public IterableList()
    {
        numbers = new List();
        int index = 0;
    }
 
    public IterableList(IEnumerable inputlist): this()
    {
        foreach (var i in inputlist)
        numbers.Add(i);
    }
 
    public IEnumerator GetEnumerator()
    {
        return this;
    }
 
    public bool MoveNext()
    {
        index++;
        if (index > numbers.Count)
            return false;
        return true;
    }
 
    public void Reset()
    {
        index = 0;
    }
 
    public object Current
    {
        get
        {
            if (index == 0)
                return 0;
            return numbers[index - 1];
        }
    }
}

And then define a function:

1
2
3
4
5

public static IterableList GetIntegers3()
{
    return new IterableList(new List{1,2,3});
}

Both of the code generated by the compiler will look very similar.
This can be confirmed by looking at the IL code generated by both of our implementation.
We can see that when using yield an extra class is generated for us that implements IEnumerable and IEnumerator (and their generic version).

The Iterable class we have written will look mostly the same (But for the generic versions that we have not implemented)

To summarize!

Basically using the yield will allow us to have the control over the way the items in our IEnumerable result items and their processing happens. And no magic behind.
It is simply an helper that will generate the code for you.

In one of my assignment I had to investigate different ways to publish utility libraries to different projects and development team. The first idea that came to my mind was to build a Nuget package and to configure an internal Nuget Feed where I could publish my package. This sound like a good idea and I was going to close the analysis phase and settle down for the implementation when someone came to me and asked a question about how I was going to manage the Security patch deployment. Let me clarify what is a security patch.

A Security patch is a patch that needs to be deploy to production no matter of the risk for the production application to gets into trouble. It is a patch that does not contain any API or interface change but contains only internal corrections. Those patch are not deployed in the scope of a particular application but are deployed on any machine a specific component is used. In my situation, as I’m only delivering Libraries, I need to be able to tell to the ops team “Please deploy this on all machine the library is in use”. And this is my major problem. I don’t know. My library get used through Nuget and only the client applications know the package they are using. I also cannot guarantee that a fix on one package with the publication of a new Nuget package version will be picked up right away by the client application development team and included in their next deployment.

What option do I have here? Nuget package do not cover this scenario by design. My first reaction was to challenge the requirement? What kind of library might require a security patch? Not so many. You know what they say: “Show me a dragon and then I will show you excalibur”. This did not convince. I had to find a specific way to deploy those security sensible libraries.

This when I started investigating GAC deployment. How do I achieve GAC deployment? Well I build my library and I make it available through an MSI. This MSI will register that library in the GAC. The MSI being deploy on machine as a unit of deployment, it can be tracked and inventoried by the OPS team. I can find the list of machine where I will have to deploy my security patch.

The GAC deployment provides me with the possibility to deploy a new version version of a library on a machine and make sure any client application using the old version of the component will pick up the new version right away. I tested this and this is how I achieved this:

I wrote two libraries with the following code:

Version 1.0.0.0

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

using System.IO;
 
namespace CommonLibrary
{
    public class Library
    {
        public void Function()
        {
            var file = new StreamWriter("D:\\VersionLog.txt",true);
            file.WriteLine("This is version 1.0.0.0 of the library's function");
            file.Close();
        }
    }
}

Version 2.0.0.0

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

using System.IO;
 
namespace CommonLibrary
{
    public class Library
    {
        public void Function()
        {
            var file = new StreamWriter("D:\\VersionLog.txt",true);
            file.WriteLine("This is version 2.0.0.0 of the library's function");
            file.Close();
        }
    }
}

Both of them where compiled and strongly signed with the same key.

I wrote a small client app that was using the library It looked like that:

1
2
3
4
5
6
7
8
9
10
11
12

namespace ClientApplication
{
    class Program
    {
        static void Main(string[] args)
        {
            var lib = new Library();
            lib.Function();
        }
    }
}

I built those components on .NET framework 4.5 meaning I’m using the GAC of the .NET framework 4.0.

I deploy the version 1.0.0.0 to the GAC using the following .NET framework 4.0 gacutil command from a visual studio 2012 command dos prompt:

1
2

gacutil /i CommonLibrary.dll

I could then use the following command to check the proper installation of my component in the GAC

1
2

gacutil /l CommonLibrary

And the result was:

1
2
3
4
5
6
7
8

Microsoft (R) .NET Global Assembly Cache Utility.  Version 4.0.30319.17929
Copyright (c) Microsoft Corporation.  All rights reserved.
 
The Global Assembly Cache contains the following assemblies:
  CommonLibrary, Version=1.0.0.0, Culture=neutral, PublicKeyToken=b523b0464e4856a6, processorArchitecture=MSIL
 
Number of items = 1

Then I ran the client application application exe file and I could check in my output file the following line

1
2

This is version 1.0.0.0 of the library's function

Then I deployed the version 2.0.0.0 of the library using the same method as previously mentioned.
I then run the the following command to check the content of my GAC

1
2
3
4
5
6
7
8
9
10

D:\dev\GacVersionning\libraries\V2>gacutil /l CommonLibrary
Microsoft (R) .NET Global Assembly Cache Utility.  Version 4.0.30319.17929
Copyright (c) Microsoft Corporation.  All rights reserved.
 
The Global Assembly Cache contains the following assemblies:
  CommonLibrary, Version=1.0.0.0, Culture=neutral, PublicKeyToken=b523b0464e4856a6, processorArchitecture=MSIL
  CommonLibrary, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b523b0464e4856a6, processorArchitecture=MSIL
 
Number of items = 2

This clearly shown the multiple version of my deployed library.
After running the client application I could see my client application was still using the version 1.0.0.0.
In order for my client application to use the version 2.0.0.0 of the library I have to deploy a policy file.
A policy file is a config file (XML) that gets compiled into a dll in order to be deployed to the gac.
This will tell the GAC to redirect all calls for a given version to a another version.

This is the content of my policy config file that I named RedirectPolicyFile.config.

1
2
3
4
5
6
7
8
9
10
11

<configuration>
    <runtime>
        <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
            <dependentAssembly>
                <assemblyIdentity name="CommonLibrary" publicKeyToken="b523b0464e4856a6" culture="neutral" />
                    <bindingRedirect oldVersion="1.0.0.0" newVersion="2.0.0.0"/>
            </dependentAssembly>
        </assemblyBinding>
    </runtime>
</configuration>

I compiled it using the following command

1
2

al /link:RedirectPolicyFile.config /out:policy.1.0.CommonLibrary.dll /keyf:StrongName.snk

Then i registered the policy “policy.1.0.CommonLibrary.dll” to the gac using the same command as usual

1
2

gacutil /i policy.1.0.CommonLibrary.dll

We can then run the client application and check the output file. It should contain the following line:

1
2

This is version 2.0.0.0 of the library's function

You have been security patched.