ASP.Net MVC framework is an alternative to the WebForms methodology that has been a feature of .Net since the good old days. 

ScottGu has the details of the new preview drop from earlier today.  This falls into that group of things that I'd love to take a deeper look at when I have time :-)

Look for Scott Hanselman talking about MVC at Tech Ed (assuming of course you registered in time).

Link: http://weblogs.asp.net/scottgu/archive/2008/05/27/asp-net-mvc-preview-3-release.aspx

If you are wondering what is cooking in the various tracks at Tech Ed this year (and some have been) then you might want to check out some of these posts by some of the track owners:

Jeff Alexander - Windows Server Track Planning
Rocky Heckman - Security Track Planning
Johann Kruse - Unified Communications Track Planning
Nigel Watson - Architecture Track Planning
Alistair Speirs - Office System Track Planning

As usual we are organising the New Zealand event in conjunction with Microsoft Australia, and the Australians have put together a page to allow attendees of either the New Zealand or the Australian event to contact the track owners and ask any specific questions via IM. 

So if there is something specific you want to see, send an IM via the Tech Ed AU track page.

Here is the output of an actual conversation today.  Good for a laugh:

This took place after I sent an email to someone and CC'd Steve.  At the end of the email I signed off by saying "HTH".  He replied directly to me.

Steve: What does HTH mean (Happy to help?)

Me: Hope that helps

Steve: I like mine better

Me: AFAIK mine is more standard :-)

Steve: I give up, what the heck is AFAIK?

Me: IIRC it stands for As Far As I Know :-)

Steve: And IIRC stands for?

Me: ROTFL - IIRC = If I Recall Correctly

Steve: Here's one for you YDMHI which is "You're doing my head in"  You're making these up......

Nothing like a little humour to lighten up a Monday

Over the last few days I've been trying out a HTC Excalibur rather than the Treo 500v I've been toting around for the last six months (thanks to Andrew from Palm).

Its not really quite as simple to compare as two devices.  The Excalibur I was using was running Windows Mobile 6.1 RTM and the Palm Treo 500v is running Windows Mobile 6.0.

There are a small number of differences between the devices from a user perspective. 

If you are trading one against the other you really want to think about WiFi vs no WiFi and 3G vs no 3G.  The rest are neither here nor there (except perhaps the headphone jack.

The only other thing I'll say about the excalibur is that the touch scroll pad on the right of the device is nice on paper but pretty pointless in reality.  Actually its worse than that as it is also the volume control when you are in a call and given the angle it is on it means changing the volume in a call is really hard (almost requiring two hands).

The difference between Windows Mobile 6.1 and 6.0 are more interesting.

The top three things I like about Windows Mobile 6.1 are:

Push mail for Live mail.
I use live mail for domains and thus use Windows Live to host my mail.  Having push mail to the device for personal mail as well as work mail is very cool

Threaded Text Messaging
The text messaging application has had a long overdue makeover and is now threaded. Much better!

Improved today interface
The today screen is much better with a new interface that allows more information on the screen and provides a better way of getting to it.  However, more can be less, so YMMV.

The Excalibur is nice, but I would rather have 3G and a 2.5mm headphone jack than have to mess with WiFi.  I understand that there may be a replacement to the Excalibur that has 3G support, but I'm probably not going to drop money for that when the Palm is doing a great job.

Yup.  As per previous posts (1, 2, 3, 4) it has sold out fast.

Tech Ed is a couple of weeks later than last year (September 1-3) and we sold out in three weeks!  That is one month earlier than last year!

If we had no size restriction I wonder how many tickets we'd sell...

What can you do if you don't want to miss out next year?  Here is my guide:

1) Subscribe to our blogs to make sure that you know when registration opens next year.  We always blog things first (there are no hoops for us to jump through).  This year the first news letter went out when early bird was already sold out and over a third of the normal tickets were also sold.

2) Get pre-approval from your manager as early as February so that this isn't a problem for you when you find registration has opened

3) If you are not sure if you need a ticket or not, buy one anyway - you can always ask for a refund later.

What do you think we can do next year?  Don't say "use a bigger venue" - while we could hold it at a stadium we can't do multiple concurrent breakouts of any size in a stadium. 

We have some ideas of our own, but if you have a serious suggestion we are keen to hear about it!

A few things on my mind this morning...

As of this morning there are only 150 Tech Ed tickets left.  Major problem.

Twitter is down again - which means I can't tweet that there are only 150 Tech Ed tickets left - nor can I complain about twitter reliability over twitter...

There are a bunch of changes in the Microsoft User Group community that I should follow up.  Kurt is stepping down from the CBD .Net User Group in Auckland (anyone want to take this on?)  Hayley is handing over the Hamilton .Net User Group to Geoff Thornburrow, and it looks like the Christchurch .Net User Group may be changing ownership too.  More on this later.

Waiting to see if a certain manager will let a certain employee come to Tech Ed NZ... more on this if it happens.  Considering sending a bribe :-)

Also, I need to think about IE8 at Tech Ed...

As of today we have sold over 80% of tickets... and we haven't released much information about what is going to be at Tech Ed.  So here goes a quick update of the web track.

Tomorrow is my official day of Tech Ed, so before I go there, I thought I'd let you know where the web track is at

So far we have confirmed Scott Hanselman is coming.  Scott will be doing three sessions which will include (at this stage) Astoria, Dynamic Data and the MVC framework.

We also have confirmed Hank Janssen.  Hank is in the Open Source labs and will be doing a session on managing IIS, PHP on IIS and hopefully also a Open Source and Microsoft session (which will be interesting).

Harry Pierson will also be rejoining us for Tech Ed this year.  Harry was in the architecture team, and has recently moved to the CLR team where he works with Dynamic languages.  Harry will be doing a session on Dynamic languages and Silverlight as well as something in the architecture track (TBC).

One of my main jobs tomorrow is to sort out the glaring holes in the web track - namely around Silverlight and IE...

The other thing I'm working on is a Web Futures panel discussion which involves these guys (and hopefully some others) which will give you the opportunity to ask what these guys see the future of the web looking like.  I'm interested in your feedback on this - do you think this would be a good thing to do?  What questions would you ask?

Last week one of my blogs running BlogEngine.Net got hacked.  Never nice.  So, I thought I'd write up what happened, and what I've done about it - and some things you can do if you are running BlogEngine.Net.

Firstly - I love BlogEngine.Net - I love having no database and being able to move the entire site from one host to another with a simple file copy.  Very cool.  I also like that it is built using ASP.Net web forms - very familiar.  Because I love it, I didn't want to change to another engine, I'd rather fix whatever issues I found.

Anyway, the site was defaced, and a bogus blog post was put up.  This indicated that the hacker had somehow logged in using my password.  Looking through the IIS logs shows that indeed - the hacker found the site by doing a search for "Powered By BlogEngine.Net", found my site and proceeded to hack away.  How did they get my password?  Why did they target BlogEngine.Net sites?

Well, last month the BlogEngine.Net team found and patched a security flaw that allowed an attacker to get at protected files.  I had applied the patch, but to me, it looks like this same method was used to get my password and login.   So I suspect my attacker knew about this vulnerability - which is why they searched for BlogEngine.Net.

If you are using or considering using BlogEngine.Net, what can you do to protect yourself?  Here are my recommendations:

1) Replace the default membership provider.

The default XML membership provider that comes with BlogEngine.Net stores passwords in a plain text XML file in the app_data folder.  Not smart.  So consider replacing the default membership provider with one that uses encrypted passwords.  Chris has even documented the (easy) steps for you.

2) Add an SSL certificate to your site.

Adding SSL requires that you purchase a certificate (mine cost US$40 pa) which (when installed and used) ensures that your login details are not sent in plain text (note that live writer doesn't encrypt your credentials when it transmits to http based sites).

I also recommend adding requireSSL="true" to the forms authentication config in the web.config file as follows:

<authentication mode="Forms">
      <forms timeout="129600" name=".AUXBLOGENGINE" protection="All" slidingExpiration="true" loginUrl="~/login.aspx" cookieless="UseCookies" requireSSL="true" />
</authentication>

This means that authentication tokens (stored in a cookie or sent from a login form) will fail if this is set.  If you've been hacked over http and you don't know if the hacker saved the credentials in a cookie (by ticking "remember me"), this will not validate the cookie over http when they next visit.

3) Remove the "Powered By BlogEngine.Net" text at the bottom of the master page.

My site was hacked because a vulnerability in the software package.  If I hadn't had the name of the package in the page content, I would have not been found in the google search that the attacker used and may not have been hacked.  Why do hackers the favour of telling them what engine you are running?

4) Know that you site is improved and more secure - but not perfect

You can never say your site is hacker proof.  You don't know what you don't know.  However, removing clear text passwords is a no brainer, SSL is wise anyway and the less you can do to help the hacker the better.

If you have other suggestions for things I can do, I'm keen to hear about them!