A year or two ago, trusted Micro ISV‘er Andy Brice posted an article entitled The Great Digital Certificate Ripoff? It’s well worth a read as it underlines some of the apparent anticompetitive aspects of this particular market.

I’m very happy to say that the ground is shifting – something interesting is happening. Internet Explorer is pretty much universally despised by tech-savvy users, but its sheer market slice means that only a fool would ignore it. As of now, Internet Explorer (and by extension, Windows) will have a new root certificate installed. The root certificate will be that of StartCom Ltd. Why is this important?

StartCom is the only public certification authority providing digital certificates for free!

The implications for security on Windows are profound. No longer will SSL and code signing certificates be expensive commodities for the little guy. Firefox and Apple have supported StartCom for some time, but thankfully us Windows developers can now get in on it.

The SLL certificates are free and provide:

• Web server certificates (SSL/TLS)
• Client and mail certificates (S/MIME)
• 128/256-bit encryption
• US $ 10,000 insurance guaranteed
• Valid 365 days (1 year)

The code signing certificates require a verified account, but still cost a measley $39, and boast:

Web server certificates (SSL/TLS)

Wild cards (*.domain.com)

Multiple domains (DNS Alt Names)

128/256-bit encryption

Object Code Signing (beta)

Client and mail certificates (S/MIME)

US $ 10,000 insurance guaranteed

2 Years validity (730 days)

Well done to StartCom, and well done to Microsoft. Check out the certificates on offer here.

Related articles by Zemanta

• Long Zheng: Microsoft adds free root certificate authority to Windows (istartedsomething.com)
• EV SSL Certificates — Not Just for Major Organizations (newswire.ca)

…I’ve just added one to Home Document Manager.

.Net isn’t renowned for it’s cold startup times, and WPF
apps start like standard .Net app after a horse tranquilizer. Home
Document Manager has an ever increasing list of assemblies that it
needs to import at startup and that takes time. This is on top of the
whole WPF stack.

.Net 3.5 SP1 introduced a new SplashScreen
class. You can set the SplashScreen by adding an image to your project
and setting its build properties, or you can use the class directly. I
find this new class a little flaky, as it can throw exceptions under
certain circumstances if it loses focus.

It does raise the question of what to show on a splash screen. Just a fancy graphic/logo? Version info? Website info?

Image via Wikipedia

My
previous problems with the “Incorrect Function” error message when
running the bootstrapper turned out to be a corrupt VM. My current
issues revolve aroung trying to get one of Home Document Manager’s
components to find its resources when deployed.

In ClickOnce, each assembly
is deployed to its own folder, and you have no control over that
folder’s name. Since I have to manually load the resources, this
presented issues. Tonight I’m going to try adding the resources as
‘Data’ and having them copied to the ClickOnce app’s data directory.
This folder I can locate on disk so hopefully, security issues aside, I
should be able to load in the assemblies.

Image by cocoate.com via Flickr

It had been working fine, until I remembered to try it on a Vista install with UAC
enabled, which is the default setting. Now, everyone I’ve ever met
disables UAC as soon as Vista is installed, but your average home user
will probably not know it can be turned off and just accept the
insanely irritating thing.

With UAC enabled, the bootstrapper
doesn’t give you a message on launch saying “Hello, we don’t have the
right permissions), no. It gets half way through the installation,
then throws an “Incorrect Function” error, leaving developers pouring
through install logs to try and guess the problem. Needless to say, end
users must not be exposed to this utter lameness.

I’m currently conversing with various MSFT boffins
to see if a resolution can be found, although I’m not hopeful. There’s
a fair bit of ducking and diving going on, which usually indicates
you’ve hit on a shortcoming

If no resolution can be found, the stark truth is that if you need to use the bootstrapper, ClickOnce is entirely incompatible with an out-of-the-box Vista setup.

Edit: I’m wrong. So very wrong. The problem was caused by a corrupt VM. Not ClickOnce.

Benefits for Vendor

• Alleviates the need for writing an installer.
• Alleviates the need for writing auto update code.
• Alleviates the need for notifying customers of minor updates.

Benefits for Customer

• No need to keep abreast of updates.
• Applications auto update, but with the option to roll back to previous versions.

Click Once is not only easy for customers, it’s also very easy to deploy for developers too. In Visual Studio, the Click Once publish dialog look like this:

Clicking ‘Publish Now’ generates all the necessary files, and sends them to either local IIS, a remote IIS server, and FTP site, or a file location.

Click Once will handle installing the most common prerequisites for you, and will also let you define update behaviour.

One thing to note – there is a common misconception that Click Once
can only be deployed from IIS hosted sites, requiring often quite
costly hosting. This isn’t correct. After a bit of digging and tweaking, I found out that you can host Click Once apps quite happily on Apache. All that is required is to add the following to your .htaccess file:

AddType application/x-ms-application application
AddType application/x-ms-manifest manifest
AddType application/octet-stream deploy

Thanks to Paul Clement for that gem.

Having said all this, there are a few caveats. If you’re releasing
.Net apps, chances are you’re going to be obfuscating them using
something like .Net Reactor.
This, unfortunately, precludes you from using Visual Studio for
deploying them. It just means that you’ve got to script is using the
Mage tool. There’s a good walkthough here.

It’s also not a substitute for InstallAware in all circumstances. If
your installer needs to do much more than private deployment to a
folder and an entry in the start menu, then you’re going to either
implement more initialisation code in your app, or revert to a full
blown installer. I think it’s fair to say the majority of .Net apps are
privately deployed, and so could benefit from Click Once.

If you’re a micro ISV writing .Net apps, have you used Click Once? What were your experiences?

By popular request, I’ve created a support forum for .Net Reactor.

       

Subscribe to .Net Reactor Support

Email:

Visit this group

I heard from the chap who develops Reactor a few months ago, and it
seems he has some health issues that mean he has to spend some time in
hospital. As such, I’m sure I speak for all Reactor users when I wish
him a speedy recovery. Being a micro ISV is tough, especially when
you’re ill. So hopefully this forum will alleviate some of the support
burden.

Search

Ergo currently aggregates search from 8 sources;

• Local Machine
• Live Search
• Yahoo!
• Google
• Wikipedia
• Flickr
• You Tube
• RSS Feeds

The local machine search uses Microsoft’s Windows Desktop Search
technology to perform really fast searches of your machine. It is the
Desktop Search technology that is probably responsible for hard drive
activity when you’re not doing anything. You can configure what parts
of your system WDS indexes using a little known part of Windows, if you
press the Windows button, type “Indexing Options” and run it, you can
add whichever locations you would like to index.  With the arrival
of Vista SP1, Google will almost certainly write their own search
protocol for Windows, so you should be able to use any Google offering in place of WDS.

The RSS feeds search uses the RSS feeds that you have subscribed to
in Windows Explorer. I suspect this might be expanded to use other
methods of RSS aggregation, Google Reader, for example.

Visualisation

Once the search is complete, we use a custom clustering engine to
organise the results, and we offer numerous different ways to visualise
the results. For example, here are some of the ways I can visualise the
search results for the search term “Physics” on my local machine:

The Network View.

The Galaxy View

The Treemap View

I can then view the documents/web pages in any given cluster, along
with information about a particular document. I can then choose to
preview a document in a lightweight viewer/reader, or open the document
in the associated reader, Adobe Reader or Firefox for example.

There
is also support for collaboration and annotation built in to Ergo. Some
of the functionality, like the Ink support is targetted at the Tablet
PC market, but for instance, if I want to annotate a particular web
page, I can  store these annotations and send them to colleagues
using the XPS file format.

There’s a lot more to the application of course, but that’s the top and bottom of it. Feedback welcome.

—–
EXTENDED

Its key features, include:

- Intellectual property protection through obfuscation, IL modification and sophisticated native code wall techniques.

- A powerful and configurable licensing system, including trial-ware settings, trial to full conversion, SaaS etc.

- An SDK to integrate and automate licensing activities with your system.

So, what do I think of it?

I’ve been using .Net Reactor over the last week or two to protect a sizable WPF application that will be hitting public beta in the next couple of days. I’ve found a couple of wrinkles with Reactor;

1) It doesn’t play nicely with WPF applications. Obfuscation seems
to break resource locating, so most of our assemblies have only minimal
protection (decompilation protection). Merging the assemblies into one
also seems to break resource location.

2) Speed is an issue. As soon as you enable an option that requires
the binary (NAT) file to be generated, you’re hitting big startup
delays. We initially found that if all assemblies in the application
had binaries generated by Reactor, it would take around 20 seconds to
start. To get around this, we enabled only minimal protection on all
but the main exe. For the main exe, we enabled the trial lockout, thus
requiring the binary files to be generated.

The application itself is pretty solid, but there are problems:

1) The help file is mediocre at best. Perhaps not a problem, since
developers usually understand what it is happening,  and I
certainly managed to do pretty much everything I wanted to do without
even opening the help file.

2) Technical support is, as far as I can tell, non-existent. Both
myself and colleagues have emailed asking questions and reporting
problems, all appear to have been ignored. Maybe he’s on holiday, maybe
he’s dead, who knows. To compound the problem, there is no user forum.

So all in all, it is a pretty solid, regularly updated and completely unsupported product. Would I use it again? Yes.

The issues surrounding support I’m sure must be harming product
sales. They seem to be missing part of the equation in the Micro ISV
world:

Is it enough that your application does what it says it
does? No. Customers want to believe in you, in what you do. They want
to love your process as well as your product.

Joe Ocampo has spearheaded
the integration, and I’m happy to confirm that the integration is
complete, and NSpec itself will soon cease to be. Long live NBehave.

It’s new home is here.

Microsoft have also offered to sponsor the project, which is mighty nice of them.