MVC Tech Blog

The UK Education System Is Still Victorian ... Time for a Rewrite?

Joshua Holden — Thu, 14 Apr 2022 17:22:49 GMT

Walk into most classrooms in the UK today, and you wouldn’t be far off imagining yourself in the 1800s.

Rows of desks. Standardised tests. A rigid curriculum designed more around memory than meaning.
We’re trying to prepare kids for a fast-moving, digital world using a system built during the industrial revolution.

Something’s not right.

The System Wasn’t Designed for This World

In actuality, I believe... the structure of our education system hasn’t changed much in over a century. It was originally built to train factory workers: keep time, follow orders, don’t rock the boat, one fits all And it served that purpose, for a while.

But today, we’re dealing with a completely different landscape.

Children today are neurodiverse. They’re growing up with tech, instant feedback loops, and access to more information in a week than their great-grandparents had in a lifetime. They learn in all sorts of different ways — visually, kinaesthetically, socially, independently — and yet we’re still delivering education as if they all think, process and behave the same way.

And guess what, they dont!!!

The Curriculum Doesn’t Fit Everyone

We now understand that learning styles vary massively from child to child. But the system doesn’t really reflect that. It’s still built around standardised syllabuses and timed exams as if that’s the only way to measure intelligence or progress.

What about the kid who’s brilliant with their hands but can’t sit still through a textbook?
Or the one who’s building games or coding at 12 but struggles with handwriting?
Or the child who needs quiet and calm, but is sat in a noisy classroom trying to concentrate?

It’s not that these kids are failing. It’s that the system is failing them, education supports the future of our world.. why are we not using modern tools to greater effect?!

AI Could Help Us Rethink the Whole Model

Here’s where things get interesting.

AI and adaptive learning tools could completely change how we approach education. Not by replacing teachers — but by giving them better tools. Tools that actually understand how each child learns.

Imagine a learning platform that:

Adjusts the way content is delivered depending on how a pupil best absorbs it — visual, audio, hands-on, etc.
Tracks their strengths and struggles automatically, offering targeted support where it’s actually needed.
Lets pupils move at their own pace, mastering one concept before being pushed onto the next.
Gives teachers live insight into each child’s learning profile — not just their marks, but their actual progress.

Same subjects. Same end goals. But the journey there looks different for every learner.

That’s not just smarter. It’s fairer.

This Isn’t About “Soft” Education — It’s About Efficiency

There’s a myth that tailoring education makes things “easier” for pupils. That it’s too soft. But in reality, it’s efficient, so much so it's exaclty how nature works with structure... think ant colonies assigning jobs from early on!

You don’t treat every athlete the same in training. You work on their weak spots, nurture their strengths, and build around their natural style. Education should be no different.

If we know a pupil processes information better through conversation, why are we only testing them with written exams?
If a child can show deep understanding through a project or a game they built, why limit their value to a multiple-choice test?

Let’s stop pretending there’s only one way to be “clever”, think of all of the world chaging individuals, how many of them excelled at school?

So What Could a Modern Education System Look Like?

Picture this: a modern, cloud-based learning environment. One where AI and teachers work together. It could look something like:

Pupil profiles that adapt as they learn — highlighting trends, challenges, preferences.
Modular lessons that can be explored through different mediums (video, simulation, reading, group work).
Progress paths, not just timetables — pupils move forward as they’re ready, not just because the calendar says so.
Built-in AI tutors for personalised guidance, available at home or in school.
Dashboards for teachers to spot patterns and tailor support in real time.
Informed parents, who can finally understand more than just “maths: 5/10”.

This isn’t fantasy. The technology’s already here. We’re just not using it properly, the sky is the limit with AI/ML guided learning paths.

So How Do We Get There Without Blowing Everything Up?

However... you can’t just tear the whole system down overnight. But we can evolve it.

Here’s how:

Start small – Use AI tools to support revision, reading assessments, or homework feedback.
Pilot smart schools – Create “learning labs” in partnership with tech companies and educators.
Empower teachers – Give them proper training in using AI tools as assistants, not replacements.
Update what we measure – Focus on skills like problem-solving, creativity and collaboration — not just memory under pressure.
Open up the system – Build education platforms that are flexible, customisable and modular — like a tech stack, not a monolith.

Final Thoughts

The UK’s education system doesn’t need a refresh. It needs a rethink.

We’re teaching kids using a model designed for a world that doesn’t exist anymore. And yet, right now, we’ve got all the tools to build something that works better — not just for some pupils, but for all of them.

This isn’t about making things easier. It’s about making things smarter.

Let’s stop patching a Victorian engine.
Let’s start build something that actually fits the future our kids are growing into, why is something so important so vastly underfunded!

Thoughts?

—mvc

SQL Injection, pwning a machine

Joshua Holden — Wed, 06 Apr 2022 13:36:02 GMT

[youtube:-JxxNyeEvJw]

OWASP top 10 considerations for secure C# applications

Joshua Holden — Tue, 05 Jan 2021 19:24:37 GMT

When developing an application, the integrity of infrastructure and data is paramount, as part of the development process, all developers should be (at the very least) aware of the OWASP top 10 and code defensively against the items included.
It’s also extremely important to ensure an application is penetration tested before and after deployment to a production environment, ideally by means of an integrated into CI/CD solution.
The following text covers at a high level some of the steps you as a developer should take to ensure your application is as secure as possible.

1:Injection

SQL injection occurs when user input is not sanitised and is processed by the server resulting in unintended SQL commands being executed on the SQL server, this can allow the attacking actor to obtain data not intended to be seen such as user information and password data it could also allow an attacker to drop tables and cause damage to applications, as a developer there are a number of actions we can take to help mitigate the effectivity of injection attacks as enumerated below

SQL access permissions

Run the application under a service account or SQL account and ensure that objects are granted access on a per-item basis for example:

GRANT EXEC on USP_MyProcedure TO SQLUserAccount
Grant SELECT on dbo.MyTable to SQLUserAccount

Although it may seem tempting to give the SQL user account DB owner or another global access scope to avoid having to set permissions on a granular level it is always far more secure to take the extra effort and ensure the application can only access the objects it needs and with the minimum action grants permissible, for example, if the application will only ever read from a table, only give the account select access, delete update etc should not be given.

Parameterisation of SQL queries

A common cause of SQL injection flaws in applications is simply down to laziness when developing, often to save time a developer may pass raw string SQL into a command, if this is constructed using client-side user input then the query can be manipulated to run any SQL commands, this is partially mitigated by ensuring granular permissions as per the previous paragraph but can be fully mitigated by ensuring parameterisation of input an example of vulnerable SQL code is shown below:

public List<User> GetUser(string firstName)
{
  return context.Users
  .FromSqlRaw("SELECT * FROM dbo.users where firstname = ‘{firstName}’")
  .ToList();
}

As you can see, this method, if provided a specially constructed string such as “bob’ or ‘1’ = ‘1” would result in the query below query being ran which would return every user in the database:

SELECT * FROM dbo.users where firstname = ‘bob’ or ‘1’ = ‘1’

To mitigate this, we can use parameterisation, using the same code as above it could made safe by adding the following code instead:

public List<User> GetUser(string firstName)
{           
  return context.Users.FromSqlRaw("SELECT * FROM dbo.users where firstname = @fn",
  new SqlParameter("@fn", firstName)).ToList();
}

To summarise, never should you ever write code that allows SQL to be constructed and run without parameterising any variable input.

2: Broken Authentication and session management

Bad authentication and session management code design can lead to insecure applications that may allow an attacker accessing other users accounts and information or being able to use an administrative account to cause damage, thankfully with a bit of due care and thought this kind of issue can be mostly mitigated quite easily by addressing the following concerns:

Ensure all passwords are salted and encrypted, ideally use ASP.Net membership and roles.
Ensure sessions are properly destroyed on logout
Avoid using cookieless state (the state is stored in the URL and can easily be hijacked or the user could copy and paste the url to a friend to show them something inadvertently giving their friend a session logged in as themselves)
Flag all cookies as “HTTPOnly” so client-side script cannot access them and read session information.
Set realistic session expiry times in the web.config, ideally as little as possible for example 10 minutes.
Use SSL where possible and transmit all data over HTTPS.
Enforce password strength rules, eg must be at least 8 characters and include non-alpha-numeric characters.
Enforce password strength rules, eg must be at least 8 characters and include non-alpha-numeric characters.
Turn off autocomplete on user authentication forms.

The above list is not exhaustive but does give a general idea of the sort of things you will need to check to ensure authentication and session management is as safe as possible.

3: Sensitive data exposure

A lot of web applications now use API’s to access information for the client-side and a good percentage of these applications furthermore do not have adequate protection on endpoints allowing attackers to steal personal identifying information and credit card details etc, an example of this would be a GET request on /API/Users which would then return the application user accounts.
When designing an application, the following precautions need to be implemented:

Ensure API's are tied down

Make sure that any sensitive information that can be accessed by API calls such as /API/User/UserID or /API/User has a layer of security against it so that only accounts with the correct roles can access the endpoints.

Don't use insecure cryptographic hashes

Do not use MD5 or SHA1 for sensitive information, instead opt for a more secure hashing algorithm such as RSA,3DES or AES hashes with a length of at least 1024 bits.

Ensure cookie security

Ensure any cookies have the following properties “HttpOnly”, ”Secure” (sent over HTTP/SSL), “PATH” (ensure the path matches expectations so as to prevent external web-applications from using it)

4: XXE (External XML Entities)

XXE attacks allow attackers to upload XML with requests for additional data included, an example of this is shown below:

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
  <!ELEMENT file ANY >
  <!ENTITY fle SYSTEM "file:///c:/passwordfile.txt" >]>
<file>&fle;</file>

This would return the file contents of the passwordfile.txt file on the server assuming it existed.

Fortunately the .Net parser for XML as standard disables such functionality by default, however, if you are using external libraries such as wrappers for calling API’s and deserialising data then it is worth checking it does not allow XXE attacks by attempting to use the library to parse an example such as the one shown above.

5: Broken access control

Broken access control, not to be confused with broken authorisation is a method of exploiting an application to access data or functionality they otherwise should not be able to access, this can be done by a number of methods detailed below:

Webserver directory listing

Ensure that directory browsing is disabled to prevent attackers from being able to see filenames and directories on the server.

Prevent efficiency of URL tampering

Oftentimes an application URL is formatted as follows: Http://xx.com/user/1/AccountInformation but let’s assume the user logged in has an ID of 1, what would happen if the user altered the URL and changed the id of 1 to 2 for example… does it return data?
This vulnerability can be solved easily in .Net usually by the inclusion of an [Authorize] attribute on the endpoint or performing a contextual check on the HTTP request user identity.

Misconfigured CORS configuration

Ensure the correct access control headers are included in the HTTP headers and are not too broad so as to allow untrusted external origins (do not use wildcards)

6: Security misconfiguration

Security misconfigurations on a server are easily missed and can easily allow an otherwise well coded and secure application to have vulnerabilities, ensuring configuration is updated and checked for production servers is incredibly important, some things you may want to ensure are:

Update default configuration

Key to good security is making sure that any third-party libraries are not left with default configurations and passwords, for example when using ELMAH for error logging make sure the logs cannot be accessed externally by setting the configuration to only show logs on the application server and configure filtering to not log sensitive information.
Further to this, always make sure routers and software etc are not configured with the default passwords.

IIS/Apache/NGINX (webserver) hardening

Make sure your web server is security-hardened, details for how to do this can be found on Google quite easily, for example, securing IIS.

7: XSS (Cross-site scripting)

XSS (Cross-site scripting is a vulnerability that allows attackers to place javascript into client-side pages that for example could capture the user's details and forward them to another server when the page is loaded containing the attacker's code.
In order to mitigate such attacks, the following steps need to be adhered to:

Sanitise user input

Whenever a page has a control that allows data to be input into a form and then later displayed in the page mark-up, always ensure that the data is HTML encoded.

Html encode URL parameters

If any data is to be added into a URL string as a URL parameter, first make sure it is HTML encoded.

Validate user input

While you should never rely on validation alone to prevent XSS attacks, some basic validation can be performed on user input to check for script tags etc albeit, you should always encode any stored input before output no matter how much sanitisation has been performed.

8: Insecure deserialisation

When using JSON.Net with type handling set to TypeNameHandling.All, it is possible to pass in a serialised System.Diagnostics.Process, this could be a command to POST a copy of a file on your server to an endpoint specified by the attacker when deserialised.
As a rule, to avoid this type of issue, where possible you should not use generic or dynamic types for deserialisation in JSON.net, and only cast to known types, if you can’t avoid using TypeNameHandling.All then make sure you add custom validation and never trust external data being deserialised no matter what you are using to deserialise.

9: Using components with known vulnerabilities

You should always where possible ensure you are using the latest version of all libraries being used, for example keeping bootstrap up to date, where possible when working on an application ensure you go into NUGET and update to the latest version of all libraries and scripts each time you have to make changes to it or are aware of an update to a library your applications uses.
Furthermore, you can use mitre’s CVE list to search for versions of libraries and if they have vulnerabilities here.

10: Insufficient logging and monitoring

No matter what attack prevention you have in place, attackers are still going to try which is why it's essential to surface errors and events as visibly, and as quickly as possible, studies have shown that the average time to detect a breech is over 200 days, in-depth and detailed monitoring is extremely important in all applications and where possible everything should be logged and monitored as most attackers rely on not being detected so they can come back and try again multiple times until successful.

Hopefully, the above post provides at least a little information to help you as a developer produce more secure applications, thanks for reading and happy coding adventures!

Cloud security, a battle of titans.

Joshua Holden — Thu, 17 Dec 2020 01:45:48 GMT

Preamble

Amazon web services, Google Cloud and Microsoft Azure are all luminary actors in the field of cloud resourcing, all have their own approaches to tackling today's needs for small and large organizations requiring scalable, secure, and cost-effective platforms and resources.

Moving an organizations infrastructure into the cloud has never been easier or cheaper than it is now, hundreds of the largest names have now permanently turned their backs to on-premises data-centres owing to the cost reductions in hardware that quickly depreciates as well as reducing the risk of data loss and time/money losses attributed to failed infrastructure in an environment where a website being unavailable can incur monetary losses of millions of pounds per day.

The reputation of a company rests on the security of the data controlled by the organization, a simple data leak, or hacked server caused by bad security or incorrectly configured infrastructure can irreparably damage the reputation of a company and invite huge fines, thankfully when dealing with the cloud, security is only a click or two away, this blog post takes a high level look into the methodologies and approaches taken by the 3 leading cloud service providers, examining ease-of-use and effectiveness.

This post is only to serve as a high-level summary of my experiences and I invite you all to read further into the subject by visiting each vendor's websites as the topic is so vast I cannot begin to cover it in the detail it deserves.

The Providers

“Are you well-architected”, good question, and it’s a question the Amazon web-services marketing team want us to ask ourselves, when it comes to cloud security Amazon have a “5 pillars” framework, the elements (or pillars) of the framework are:

1: Operational Excellence (How you operate your workload/groups of business applications that deliver business value)
2:Security
3:Reliability
4: Performance efficiency
5: Cost optimization

The well-architected framework was created by Amazon in 2012 after speaking to some software and infrastructure architects and putting together a framework of best practices to allow architects and solution/infrastructure designers to build and deploy faster, lower risks, make informed decisions and learn AWS best practices, but how does it achieve this?

Using the Amazon console you can run the Amazon well-architected tool which provides free architectural guidance on your infrastructure providing a list of high/medium/low issues that need to be addressed.

One of the biggest challenges and strengths of AWS is the approach to isolation by default in that every new service and account you provision is created with no access to other services or account group without first enabling the access specifically, granting access policies with IAM is of itself not a straight forward task especially as a lot of it is best done in the console using JSON strings with the specific grants and claims although the documentation showing the available configuration is excellent.

Overall AWS is the most complex cloud provider to manage from an IAM perspective and as the services and accounts scale up this becomes even more complex to juggle all of the required access to services and accounts especially when trying to talk to services in other accounts as there is no single place to manage access across groups.

Compliance

AWS supports more security standards and compliance certifications than any other offering, including PCI-DSS, HIPAA/HITECH, FedRAMP, GDPR, FIPS 140-2, and NIST 800-171, satisfying compliance requirements for virtually every regulatory agency around the globe, you can read more and view the whitepaper on compliance frim AWS by clicking here.

Most common AWS security controls

Guard Duty
Guard duty is a continuous monitor that automatically consumes and analyses data from sources such as Vpc flow logs, Cloud trail management event logs, s3 data event logs, DNS logs and provides alerts and logging for data and infrastructure issues such as automatic bitcoin miner detection

WAF
WAF is an aptly named web-application firewall that protects applications against common exploits such as SQL injection and XSS attacks.

MACIE
Macie is a data security/privacy tool that uses machine learning and pattern matching to scan/discover and protect sensitive data stored in AWS such as credit card numbers and text strings with personally identifiable data.

AWS Inspector
Inspector is an automated security assessment tool, Amazon inspector allows you to automate security assessments based on best practice and common vulnerabilities, sort of a built-in penetration testing tool for checking for vulnerabilities and can provide alerts.

Cloudwatch
Amazon Cloudwatch is a monitoring service that provides actionable insights and gives an overview of operational health, Cloudwatch can be used to detect anomalous behaviour, set alarms, and provide logs and metrics to keep applications running smoothly.

Shield
Aws Shield is a distributed denial-of-service (DDoS) tool, Shield protects against all common DDoS attacks but when used in conjunction with AWS Route55 and CloudFront then full protection for all known attack kinds across layer 3 (network) and layer 4 (transport)

Security groups
Security groups AKA virtual firewalls control inbound and outbound traffic, security groups are stateful and are intelligent enough to allow responses back in regardless of inbound rules.
As with all amazon controls, when created no access will be allowed and grant rules have to be explicitly added, denial rules are implicit by absence and work on an instance level allowing subnets to be assigned, different security groups.

KMS (Key management server)
AWS KMS allows you to securely store and create cryptographic keys and control usage and access across a large swathe of AWS services and in your applications with access logging ensuring keys can be consumed and accessed only by entities that require them.

AWS secret manager
Much like KMS, but for secret strings of data such as OAUTH tokens, database connection strings, and API keys, KMS allows for granular control of who and what can access sensitive strings of data.

Microsoft Azure’s ease of use and excellent UI design makes this provider my favourite, but just because it is my subjective favourite provider this doesn’t mean they have the best approach to security, in-fact if the Motto of AWS was to be “Isolation as standard” then Azure’s motto would be “Isolation by configuration”.. what I mean by this is that most of Azure’s controls as standard start off wide open, take for example creating a new virtual machine, once created all ports are open then it’s up to you to make sure the correct controls are put into place to close any access not required.

I don’t think this approach is bad per-Se, just different but actually, I prefer it as both AWS and Google cloud take a by default deny standpoint meaning that with Azure you can be up and running much quicker than start locking down access once a solution has been designed.

Further to this, as I mentioned previously it’s extremely time-consuming and complex setting up access groups in AWS since AWS dictates that users are set up for every account and there is no single place to configure the access, instead of in Azure there is a single point of truth “Azure Active Directory” which allows users to be created and managed from a single point.

Azure also has a great security centre for monitoring and reporting on security issues

The main negative point from my perspective and experience with Azure is the lack of documentation, meaning sometimes it can be trial and error to configure some things such as security groups, this may be due-in-part to the fact that Azure is much younger than AWS and has not had the full length of time to mature documentation wise.

In summary, I feel Azure is the best provider for me but requires extra care when testing as it’s much easier to let security holes slip in due to the less secure as a standard approach which when tested and configured properly can be just as secure as any other provider assuming the extra attention is given to testing before an environment/configuration being declared production-ready.

Compliance

AZURE have the best CSTAR rating across all 3 options and also support a massive array of security standards such as CIS Benchmark, FEDRamp, ISO27001, and much more, you can see all Azure offerings and read more by clicking here.

Most common AZURE security controls

Defender for Identity
Much like AWS guard duty, Defender for Identity (formerly known as advanced threat protection) is a cloud-based security solution that works in line with your on-premise active directory and monitors for compromised accounts, insider attacks, and malicious actions as well as to detect lateral movement and other key smells emitted by would-be-hackers trying to attack your platform by using machine learning and artificial intelligence.

Defender
Azure defender is an active monitor that scans for vulnerabilities, protects against common attacks, and provides exceptional threat protection across all cloud resources using AI.

Network security groups
Used to filter network traffic to and from Azure resources using rules specifying the port, destinations, and protocols.

Web application firewall
Prevents common attack such as XSS and SQL-Injection

Firewall
Same as an NSG (security group) but more robust and provides SNAT (source network address translation), threat intelligence filtering, and FQDN tags (tags that group-specific services such as windows updates)

Security Center
Provides a dashboard overview showing the security state of cloud resources, works closely with Azure defender.

App Service Certificates
Allows purchase and management of SSL certificates from the Azure portal.

DDoS protection service
Always-on monitoring and automatic network protection service providing rapid response to the denial of service attacks preventing possible downtime.

Azure Active Directory
Access management, grant roles groups, and permissions to users from a single page.

Application Insights
Application Insights, a feature of Azure Monitor, is an extensible Application Performance Management (APM) service for developers and DevOps professionals. Use it to monitor your live applications. It will automatically detect performance anomalies and provide analytics to assist resolution.

Monitor
Collects and analyzes telemetry from the cloud and on-prem infrastructure allowing you to act and report as well as providing alerts.

Key Vault
Secures secrets such as API keys, database connection strings and much more so you don’t have to include sensitive data in application configuration files and provide access only to entities that should have access.

Google cloud platform, of the 3 providers listed here is definitely the least mature but owing to the very nature of Google/Alphabet it is still a very strong candidate due to the experience and knowledge the company has garnered over time building their own world-class infrastructures.
As previously mentioned GCP has a default-deny approach much like AWS but it is slightly easier to manage as there is less isolation between accounts/projects and IAM can be managed from a single place.
Google also has over 15 years of experience in security and applies the same security Model to GCP as in their own applications, thing such as encryption of data in transit as standard as well as all data is encrypted on disk.
GCP also are world leaders in AI and ML so if that’s your game then it makes sense to consider GCP as your platform of choice, however like Azure and more so, owing to the age of the service experts and documentation is harder to come by than competitors, however undoubtedly in time, this will change.

Compliance

GCP support ISO/IEC 27001, HIPPA, FEDRAMP, and SOC 1, and all products are undergoing independent verification of their security, privacy, and compliance controls, achieving certifications, attestations of compliance, or audit reports against standards around the world. and also create resource documents and mappings against frameworks and laws where formal certifications or attestations may not be required or applied, more can be read by clicking here.

Most common Google Cloud Platform security controls

Google identities
A unified identity, access, app, and endpoint management (IAM/EMM) platform allowing administrators to quickly give users access to controls, endpoints, and applications with a single click.

Google cloud armour
Google cloud armour is both a WAF (web application firewall) and advanced DDOS protection, with cloud armour you can protect your web applications against OWASP top 10 risks and denial of service attacks.

Context-aware access
With context-aware access, you can enforce granular access controls to web apps, VMs, GCP APIs, and Google Workspace apps based on a user’s identity and context of the request without the need for a traditional VPN.

Secret manager
Secret Manager is a secure and convenient storage system for API keys, passwords, certificates, and other sensitive data. Secret Manager provides a central place and a single source of truth to manage, access, and audit secrets across Google Cloud,

The secret manager operates on a least privilege model meaning it's easy to keep tags on who and what is consuming "secrets".

Cloud key management
A cloud-hosted key management service that lets you manage symmetric and asymmetric cryptographic keys for your cloud services the same way you do on-premises. You can generate, use, rotate, and destroy AES256, RSA 2048, RSA 3072, RSA 4096, EC P256, and EC P384 cryptographic keys.

Chronicle
Detect everything, Google's strapline for this control, Chronicle is a petabyte-scale telemetry threat detection rules engine offering real-time threat detection that scales infinitely ingesting logs from endpoint detection and response logs, cross-layered detection logs and DNS/Proxies, etc which can then link logs together to give clear signals on threats happening, as they happen with Google level speed of search.

Policy intelligence
Policy intelligence allows you to run reports on security such as "who has access to x resource" as well as viewing logs of access attempts and quickly removing or adding access to the specific data for entity access attempts.

Policy Intelligence is also able to scan your data and configuration providing recommendations and guidance for recommended access levels and highlighting potentially over-permissive access.

Security command centre
Security command centre provides a central location in which to monitor compliance across projects and infrastructure as well as allowing you to discover misconfigurations and vulnerabilities, reporting and detecting threats on Google cloud assets.

Access transparency and access approval
Access transparency allows you to protect sensitive information such as PII by granting access only to approved entities as well as providing Access Approval requests, when combined with Access Transparency logs, can be used to audit an end-to-end chain from support ticket to access request to approval, to eventual access ensuring you have an end to end data access audits.

Google cloud firewalls
compared to AWS and Azure, GCP has a lot fewer options for firewalls and security groups, however, Google does offer a single type of firewall which supports all of the good stuff such as server tagging and hierarchial rules as well as full audibility and logging.

Web risk
Web Risk is a Google Cloud service that lets client applications check URLs against Google's constantly updated lists of unsafe web resources. Unsafe web resources include social engineering sites—such as phishing and deceptive sites—and sites that host malware or unwanted software. With the Web Risk, you can quickly identify known bad sites, warn users before they click infected links, and prevent users from posting links to known infected pages from your site. Web Risk includes data on more than a million unsafe URLs and stays up to date by examining billions of URLs each day.

Binary Authorisation
Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed on Google Kubernetes Engine (GKE). With Binary Authorization, you can require images to be signed by trusted authorities during the development process and then enforce signature validation when deploying allowing you to keep tighter control over container images running on your network.

Summary

It’s hard to pick a real winner out here, really all, 3 providers are excellent when it comes to security and with the right expert behind the wheel can all be equally secure so generally, I would say it's down to you to do the research and find the provider that fits closest to your organization's current architecture, for example, I will always err towards Azure working with the Microsoft stack due to the ease of integration with AZURE DevOps and Visual studio.

If I had to pick a few pros and cons for each provider then the first things that spring to mind are as follows:

Provider	Biggest Pros	Biggest Cons
AWS	Most mature, great documentation, secure out of the box	More time consuming to configure sometimes, UI can be a little confusing.
Azure	Quickest to configure, Great UI, Good community	More effort needs expending on security checks to make sure all holes are closed due to allowing as the default policy.
GCP	Best out of the box for free security with encryption on disk and transit as standard, years of expertise in providing fast infrastructure and security.	Due to a lack of maturity, finding security experts and documentation for GCP can be a little tricky sometimes.

I hope this post was useful and whets your appetite for exploring further into cloud security, thanks for reading!

Test driven development on BLAZOR applications

Joshua Holden — Tue, 08 Dec 2020 02:07:57 GMT

Summary

If you are reading this you probably already know what TDD is, but for the uninitiated, test-driven development is a development approach where you first start with a bunch of test cases such as: "If I click Add post button then a post is saved to the database", then taking a test case you then wire up a test, once it has failed, which it will because no code will have been written to perform the action to be tested, you then add in the code to make the test case pass and refactor it until you are happy with it.

This approach firstly saves money and time in the long run as code will be less bug-prone owing to the fact that most test cases have already been accounted for and it allows you to approach writing code in a more methodical and planned fashion and encourages loosely coupled code to be written which is great for solid code, secondly, if down the line further code is added which could potentially break existing functionality (introduce regression issues) then the unit tests will fail instantly alerting the developer the change they have made causes issues which need address. There are many more reasons to use TDD when working on a software solution but the aforementioned cases are probably the most useful.

In this blog post, I will cover bunit testing on a BLAZOR application, you can also watch a video below, covering setup and usage of this library.

[youtube:hM5awdh7mJM]

Setup

Once you have fired up visual studio and have a BLAZOR application set up and ready to go the first thing to do is to add a new xUnit testing project to your solution, to do this right-click on your solution, click "Add" then "New solution", choose "xUnit Test Project"

Now you have added the xUnit project to your solution you will need to reference your main Blazor application from the test project, to do this right click on "Dependencies" on the unit test solution then click add project reference:

You will then need to reference the main BLAZOR project by ticking the checkbox then clicking OK:

Finally, you need to add the Nuget packages, bunit,bunit.xunit and MOQ

And you are now done, it's time to start writing some tests.

Writing tests

In order to better explain what bUnit allows you to do, I'm going to post below the page markup for the Counter page and the tests that run against it then break down beneath the individual tests and what's happening:

Counter razor page

@page "/counter"

<h1>Counter</h1>

<p>Current count: @currentCount</p>

<button class="btn btn-primary" @onclick="IncrementCount">Click me</button>
<p>You are @(IsAuthorised == true ? "Authorised" : "Unauthorised") </p>

@code {
    [CascadingParameter]
    private Task<AuthenticationState> AuthState { get; set; }
    private System.Security.Claims.ClaimsPrincipal User;
    private bool IsAuthorised;

    protected override async Task OnInitializedAsync()
    {
        User = (await AuthState).User;
        if (User.Identity.IsAuthenticated)
        {
            IsAuthorised = true;
        }
    }

    private int currentCount = 0;

    private void IncrementCount()
    {
        currentCount++;
    }
}

Counter test code

public class CounterTests : TestContext
    {
        TestContext tc = new TestContext();
        TestAuthorizationContext AuthContext;

        public CounterTests()
        {
            AuthContext = tc.AddTestAuthorization();
        }
        [Fact]
        public void AssertOnLoadPageCountIs0()
        {
           var page = tc.RenderComponent<CascadingAuthenticationState>(x=>x.AddChildContent<Counter>());
            page.Find("p").MarkupMatches("<p>Current count: 0</p>");
        }
        [Fact]
        public void ConfirmSingleClickIncrements()
        {
            var page = tc.RenderComponent<CascadingAuthenticationState>(x => x.AddChildContent<Counter>());
            page.Find("button").Click();
            page.Find("p").MarkupMatches("<p>Current count: 1</p>");
        }
        [Fact]
        public void LoggedIn()
        {
            AuthContext.SetAuthorized("sss.xxs@dss.xom", AuthorizationState.Authorized);
            var page = tc.RenderComponent<CascadingAuthenticationState>(x => x.AddChildContent<Counter>());

            page.FindAll("p")[1].MarkupMatches("<p>You are Authorised</p>");
        }
    }

Now you have had a chance to scan the code and get a feel for how it all hangs together, I will now attempt to break down each test and give a summary of how it works, starting with the first test to verify when the counter page loads it displays 0 for the amount of times clicked:

[Fact]
        public void ConfirmZeroClicksOnLoad()
        { 
           var page =  tc.RenderComponent<CascadingAuthenticationState>(x=> x.AddChildContent<Counter>());
            page.Find("p").MarkupMatches("<p>Current count: 0</p>");
        }

The first thing to note is the [Fact] attribute, this is to flag to xunit that the test is parameterless for testing invariants in your code, if your methods contain parameters then you would need to use the [Theory] attribute with inline data for the parameters, an example of this is shown below:

[Theory]
[InlineData(1, 2,3)]
[InlineData(8,10,18)]
public void DoesAddCorrectly(int val1, int val2, int output)
{
    var Addition = Adder()
    var ret= Adder.Add(value1, value2);
    Assert.Equal(output, ret);
}

The theory attribute is therefore great for testing methods that take parameters to ensure output is as expected.
The second thing to note is the counter page is using cascading parameters for authorisation, if the page did not have authorisation then you could load a page instead using the following code:

var page =  tc.RenderComponent<Counter>();

The RendererComponent method takes the component name for example here the "Counter.Razor" component and loads it as a browser would, exposing the rendered HTML, below I show a screenshot showing the output of a rendered page:

The results contain a list of all of the nodes on the page as well as the raw markup and provide a range of methods for working with objects on the page and verifying markup meets expectations.

The final line of this test, first of all calls the Find method which takes CSS selectors to locate the first p element, then verifies the markup matches expected, in this instance:

<p>Current count: 0</p>

The next test is pretty much the same but in this one, the button is found on the page and clicked, the HTML is then checked to verify the count is now at 1:

[Fact]
        public void ConfirmOneClickGivesOneCount()
        {
            var page = tc.RenderComponent<CascadingAuthenticationState>(x => x.AddChildContent<Counter>());
            page.Find("button").Click();
            page.Find("p").MarkupMatches("<p>Current count: 1</p>");
        }

This is done by finding the button and using the Click() method shown above.

The final test on this page is slightly more complicated as it involves creating a test double for the user principle and injecting the authorisation context into the page render flow, this is useful for verifying users can only see components and areas they should.

 [Fact]
        public void LoggedInCheck()
        {
            TestContext tc = new TestContext();
            TestAuthorizationContext AuthContext = tc.AddTestAuthorization();
            AuthContext.SetAuthorized("sffsdf.fsffe.com", AuthorizationState.Authorized);
            var page = tc.RenderComponent<CascadingAuthenticationState>(x => x.AddChildContent<Counter>());

            page.FindAll("p")[1].MarkupMatches("<p>You are authorised</p>");
        }

If you have a more complex application that utilises user roles then the TestAuthorisationContext can also deal with roles as shown below:

AuthContext.SetRoles("Moderator");

The final part of unit I want to discuss in this post is mocking and injecting services into a page, take for example the below FetchData page:

@page "/fetchdata"

@using BlazorTDDDemo.Data
@inject IWeatherForecastService ForecastService

<h1>Weather forecast</h1>

<p>This component demonstrates fetching data from a service.</p>

@if (forecasts == null)
{
    <p><em>Loading...</em></p>
}
else
{
    <table class="table">
        <thead>
            <tr>
                <th>Date</th>
                <th>Temp. (C)</th>
                <th>Temp. (F)</th>
                <th>Summary</th>
            </tr>
        </thead>
        <tbody>
            @foreach (var forecast in forecasts)
            {
                <tr>
                    <td>@forecast.Date.ToShortDateString()</td>
                    <td>@forecast.TemperatureC</td>
                    <td>@forecast.TemperatureF</td>
                    <td>@forecast.Summary</td>
                </tr>
            }
        </tbody>
    </table>
}

@code {
    private WeatherForecast[] forecasts;

    protected override async Task OnInitializedAsync()
    {
        forecasts = await ForecastService.GetForecastAsync();
    }
}

Looking at the Razor markup for this page, you can see at the top it injects in a service and then furtherdown uses that service to retrieve weather forecasts, we can also handle this in unit using MOQ to mock up a fake service then inject it into the page, an example of doing this is shown below:

public class FetchTests : TestContext
    {
        TestContext tc = new TestContext();

        [Fact]
        public void ConfirmServiceLoadsAndDisplaysAResult()
        {
            var service = new Mock<IWeatherForecastService>();
            service.Setup(s => s.GetForecastAsync()).Returns(Task.FromResult(new[] { new WeatherForecast { Date = DateTime.Now, Summary = "Bracing", TemperatureC = 12 } }));
            tc.Services.AddSingleton<IWeatherForecastService>(service.Object);
            var page = tc.RenderComponent<FetchData>();
            page.Find("p").MarkupMatches("<p>Current count: 0</p>");
        }


    }

bunit shown here allows the TestContext to take a version of the mocked WeatherForecastService and add it into the dependency container so it can be injected into the component and render time.

While this post covers the majority of use cases for bunit there is much more to it but currently, as the library is still in beta status there is not a great amount of documentation, however its definitely worth your time to take a look at the bunit page to get a greater feel for what it is capable of by clicking here.

Thanks for taking the time to read this and happy coding!

Learning software development, an existential guide to success with Kierkegaard

Joshua Holden — Tue, 01 Dec 2020 12:30:15 GMT

This post is primarily aimed at people looking to change careers or start a new one in software development and is somewhat a summary of what worked for me with the help of my favourite philosopher, it is in no way about teaching the skills required but more of a framework of suggestions.

Someone recently asked me, "What do I need to learn at the very basics to be a junior software developer", I thought about it for a while and the following list of knowledge I would consider pre-requisite:

Knowledge of OOP (object-oriented programming concepts, especially SOLID theory)
A backend language such as C#, Java, C++ or even JavaScript (Node) obviously I would recommend C# being my favourite language of choice.
SQL/NoSQL database knowledge, how to query databases, create indexes and writing procedures
Version control mastery, be it TFS or GIT, ideally, if you are looking for a job in development then it makes sense making pull requests on open source projects to practice and gain experience fixing bugs and using version control.
Basic knowledge of Javascript, HTML and CSS to aid understanding front end development
Knowledge of how to debug and step through code.
Ability to create API's and the usage of the different HTTP verbs such as: PUT, GET, PATCH, DELETE etc
Knowledge of basic algorithms.
Knowledge of the different programming design patterns such as Factory patterns, dependency injection, singleton, builder etc.
The knowledge that no matter how much you learn there will always be more to learn.
Data structures such as XML and JSON especially around transformations, schemas and parsing.

This list doesn't even begin to touch on all of the things you will learn in time but is merely a starting point to give some structure on areas to research. many would-be programmers, when learning, feel overwhelmed at the metaphorical blank sheet of paper they have before them when looking to start down this path, however, one has a lot of resource and knowledge available, so what are you waiting for, as the great philosopher Kierkegaard once wrote:

"During the first period of a man's life the greatest danger is not to take the risk."

As a young (or even not so young) person looking to get into development, perhaps straight out of school, there are a number of options such as going to college/university and learning computer science or getting an apprenticeship as a software developer or perhaps even just self-teaching using the internet and books/videos whilst working a day job (ideally in IT), no one way is better than the other (although apprenticeships are probably the fastest way to get real-life experience and learn at the same time).

What is important though, is when you decide this is the path, you take the risk, drop everything else and fully commit yourself to this decision.

"Passion is the quality of striving to become. Without passion, there is no movement.

One of the key factors in learning software development is passion, a passion for code and computer science.
Since I was a wee lad I had this passion, I would spend many hundreds of hours of my time just reading up on programming languages and paradigms, poking at other peoples code on the internet, chatting with likeminded folk on IRC (old school form of internet chat room) and working on projects of my own simply to throw away once I was finished just for the pure enjoyment I gained from it, without this passion, it's hard to keep motivated and movement/progress will always be slow or non-existent.

"Most men pursue pleasure with such breathless haste that they hurry past it."

It's often easy to focus on the end-game, pushing constantly to learn more, letting the pressure of learning suck the joy and passion from you, enjoy what you are doing, make learning fun, keep the passion, this is something you are doing because it is your passion, enjoy the journey.

"Patience is necessary, and one cannot reap immediately where one has sown."

This leads on from the previous quote, in that, it's easy to lose the passion and feel frustrated when things feel hard, every failure is another lesson learnt.

If something doesn't feel enjoyable, step back and approach the problem from another angle, or come back to it later.
Nothing worth doing is ever easy but the benefits will come in time and will repay many times the effort put in, consider for example planting corn, with nurture and water the corn seed will grow and repay many times the initial single seed even if for the first few weeks nothing shows, externally, under the ground roots are forming to support the growth of the plant to come.

Learning is much the same, even if it looks like no progress is happening, beneath the surface new thought patterns are forming and neural pathways are strengthening in your brain to support the visible growth to come.

"It is better to try something and fail than to try nothing and succeed. The result may be the same, but you won't be. We always grow more through defeats than victories."

Again to further compound my last statement because I believe it to be so very important, failure is a normal part of your growth as a person and a professional and should be embraced, there is much to be learnt from failure.

"Life can only be understood backwards, but it must be lived forwards."

Key to any project or endeavour in life and business is the concept of being retrospective (Huge part of the AGILE development theory), looking back and making notes and memories of lessons learnt, what works well, analyse the past and you can learn so much more about yourself and you capabilities, strengths and weaknesses.

"It seems essential, in relationships and all tasks, that we concentrate only on what is most significant and important."

In combination with regression and looking back on past successes and failures finding one's weaknesses become apparent, it's essential to focus on building up in these areas and not straying too far from your goals, always ask yourself when learning something new, "Do I need to know this now, is it important to my growth, is there anything more Important I can focus on?"

"Letting a child explore the world and develop its own powers gives the child an "inner sustainment," a self-confidence in the face of experience."

While it's important to stay on track with your learning path don't be afraid to explore, if one only follows a pre-trod path then one will emerge with the same experiences as those who trod the path before, while this is not of itself bad, take your time and enjoy the views on the path, perhaps even wonder off slightly to view things from another angle, we are the sum of our experiences maximise those experiences.

"If someone who wanted to learn to dance were to say: For centuries, one generation after the other has learned the positions, and it is high time that I take advantage of this and promptly begin with the quadrille--people would presumably laugh a little at him, but in the world of spirit this is very plausible. What, then, is education? I believed it is the course the individual goes through in order to catch up with himself, and the person who will not go through this course is not much helped by being born in the most enlightened age."

There is no better time than now to learn whatever you want, the internet is awash with tutorials, blogs and even structured learning video sites such as Cloud Academy, YouTube and Pluralsight, use these to your advantage, become familiar with Stack Overflow, don't be afraid of asking questions, we are in an enlightened age, we stand on the shoulders of giants, many who have come before have done so much groundwork that we do not need to start at basics, learn from the mistakes and knowledge of others, there is no need to make the same mistakes as other people have, copying and pasting someone else's code is not cheating it's saving time, just take some time to understand the knowledge so easily ingestible.

Therefore, to summarise, If you don't take advantage of the resources available then your task is an order of magnitude more complex.

"There is nothing with which every man is so afraid as getting to know how enormously much he is capable of doing and becoming."

This quote hits quite hard with me, a lot of people are happy to just sit by letting time pass them by, coasting on a path of, "I'll do it tomorrow", but guess what... tomorrow never comes, the person with this mentality will never reach full potential, the ENORMOUS full potential each and every one of us has because they are fearful as to what they will find out about themselves or just simply don't care.
People and things can help you reach that potential but ultimately only you are the owner of your destiny, are you ready and willing to do the work required to see what you are capable of becoming?

Managing Code quality in enterprise software with nDepend static analysis

Joshua Holden — Thu, 26 Nov 2020 15:32:39 GMT

Preamble

Not so long ago whilst working on a large monolithic mission-critical web application renowned for being a pain to work with I was asked by the organisation's CTO, and I paraphrase:

"We are going to be depending on the functionality of this software a lot more going forwards, do you think It needs a total rewrite or can we get by with using the existing codebase and improving it"

This is a common scenario which could be avoided by adding static analysis into the build pipeline to detect and block changes with "code smells" preventing the growth of issues into the codebase until the point it becomes unmaintainable.
Often many developers work on a single application stack and it ends up growing arms and legs, becoming unmaintainable, but the question is, "How do I work out if it's going to be more cost-effective to rewrite the application or try and fix it?", fortunately, there is a way of working this out by calculating technical-debt and annual-interest.

Technical-debt is an abstract term and quite hard to explain without using a metaphorical scenario, so I will do exactly that, let's imagine you own an old house in the country which you bought for £400,000, you notice it is creaking a bit and wood is flaking from the ceiling so you call in an expert to look at the house which he examines and comes back to you with the following report:

"I have examined the house, it has a serious termite infestation and it will fall down in about 4 years, but the cost to sure up the wood and remove the termites will be in the region of £50,000".
In this scenario, the termites are the bugs in the software and the house is the software, after speaking to the expert we can now make the following assertions:

1: If we let the house fall in 4 years it has a £100,000 a year annual-interest, and as with monetary debt will get more expensive to repair the longer is left unaddressed.

2: If you repair it now, it will cost £50,000 but will increase the habitability and resale value of the house by at least the time and money costs, furthermore it will save you having to completely rebuild or abandon it in the long term.

Using NDepend to calculate technical debt

When managing software and development teams the expert here could be a solutions architect or a lead-developer etc using a tool such as static analysis to help them examine the code base and calculate the technical debt.

Below is an example of NDepend static analysis on the aforementioned solution:

Here, you can see that to rebuild the entire application of 13,704 lines it would take 365 days, and to fix all of the issues (technical debt) addressed by static analysis it would take 28 days (28.908 but NDepend floors the number), therefore the debt level is 7.92% (Days to rebuild / debt days * 100).

This can be further reported on showing monetary costs as well, however, obviously, to make these calculations NDepend needs to be aware of how many hours per day a developer works, and that can be set as shown below:

You can see from this, calculating the debt-level is highly configurable depending on developer velocity, hours worked per day and cost per hour, furthermore you can set a threshold on the SQALE debt rating, this can be especially useful in a CI/CD pipeline failing a build if the debt-level crosses the threshold to maintain quality software deployments without slippage.

Okay, I get it technical debt can be managed, but what else can nDepend do?

Quite a lot more actually, to calculate technical debt NDepend also needs to be aware of issues in your code and classify them accordingly in a ranking from low to critical (and blockers which need immediate address), to do this NDepend has a huge list of common and not so common errors it uses its static analysis engine to detect, furthermore other checks can be easily added, and existing rules can be modified if they do not suit your development shop by using C# LINQ queries.

I'm not going to go into to much detail because the rules are discussed in detail here, instead, I will discuss at a high level below:

Built-in issue rules

Hotspots
Hot spot rules allow you to quickly identify issues with the most technical debt allowing you to address them first and cut down the code debt quicker.

Code smells
Covered under code smells are 9 rules detecting common code smells such as a lack of comments, overly complex methods, too many local variables in methods and much more.

Code smells regression
Regression rules only fire when a baseline has already been done (previously ran the analysis on an older version), these rules check if the number of code smells has increased/decreased since the previous analysis (diff checks).

Object orientated design
Rules specifically focusing around SOLID and OOP paradigms, for example: avoid empty interfaces and classes with no descendants should be sealed.

Design
This ruleset addresses design flaws which increase technical debt such as usage of obsoleted methods and detecting classes that should be structs.

Architecture
The ruleset for detecting architectural issues such as accessing database types within a UI layer and not using view models preventing overposting.

API breaking changes
The ruleset is dependant on a previously ran analysis, does a diff check and makes sure nothing has been introduced which could cause breaking changes for anyone or anything consuming the API.

Code coverage
The ruleset for the detection of code not covered by unit tests, a number of the tests here depend on code coverage files being imported from software such as visual studio's own code coverage report or ReSharper dotCover.

Dead code
Detects if a class, method or field is never used anywhere and flags it for removal.

Security
Possibly my favourite test ruleset detects security flaws such as code vulnerable to SQL injection, usage of weaker cyphers such as DES and 3DES and disabling certificate validation.

Visibility
Detection for classes and fields with higher accessibility modifiers than required.

Immutability
Checks such as not marking structs as immutable and arrays marked as read-only.

Naming conventions
Enforces naming conventions such as ensuring types are always capitalised and preventing multiple types with the same name which happens and is extremely annoying.

Source file organisation
Several checks to ensure source code is well organised such as declaring namespaces that do not match the solution structure.

.Net framework utilisation
A huge set of rules making sure when using .net framework classes and functionality such as not throwing generic ApplicationErrors when a more explicit exception type could be used.

NDepend can be run separately to visual studio as a stand-alone app, however, I prefer to run it with the Visual Studio plugin as it detects issues as you code in realtime:

Above you can see on the far left, the different rulesets, in the middle it displays a count of violations of each rule within the ruleset, clicking a rule shows all areas in the application which violate the rule which can be clicked on to jump to the area with the issue for address.

Creation of new rules is extremely simple, take for example the below rule that enforces namespaces start with company name, in this case, ACME Ltd:

warnif count > 0 from n in Application.Namespaces where
!n.NameLike (@"^AcmeLTD")
select new {
n,
n.NbLinesOfCode,
Debt = 10.ToMinutes().ToDebt(),
Severity = Severity.High
}

the above rule asserts that namespaces must start with AcmeLtd and any that do not add 10 minutes to the technical dept and flag as a high priority issue.

Reporting

One of the strongest points of Resharper is the reports it can kick out as standard, as such, below i'm going to go into a little detail of the reporting functionality.

The dependency graph and matrix offer 2 different dimensions of the same data and allow you to take a closer look at how the solution code is actually structured and highlights coding flaws such as large dependency cycles as well as helping with refactoring analysis as you can see at a glance if you alter a specific dependency what impact it will have on other components within the code, shown below is an example of a dependency matrix:

This is just a slice of my application focusing on the controllers only but you can clearly see that GetPostById method is called by many of the controller methods and making changes to it could be considered risky but it also helps with regression testing should you make a change as you know exactly what controllers will need to be checked extra carefully during the testing cycle.

Taking another view on the same data using the dependency graph shown below allows you to visualise the couplings and relations between classes and structures within your application.

Each node in this dependency chart can be double-clicked into to zoom into it and view at an even finer level for example shown below double-clicking on the user services node within the lager Core.Services namespace

As you can see this is an extremely powerful tool for visualising large applications, how they work and the impacts of any changes if you don't have the original UML documents to hand (or more likely they were never created).

We also get a treemap report which by default looks at cyclomatic complexity of methods, wherein the larger (in lines of code) a method is the larger the tree, and the more complex a method the more it will move towards the red scale, shown below is an example showing the cyclomatic complexity dimension:

Nothing here is showing as red, but I can see at a glance the SaveFilesToDisk() method is starting to move towards being overly complex, furthermore, the chart is interactive and highlighting an individual tree shows me some additional metadata on the class such as LOC (lines of code) and the signature or the method

The treemap offers a whole host of other dimensions that can be reported on by selecting a dropdown at the top of the treemap view:

furthermore, you can slice the data in another dimension, instead of showing trees as individual methods you can switch to specific assemblies, types, fields and namespaces

The final report I feel worth mentioning is the abstractness vs instability report, at a glance, it looks quite complex but once you understand the concept it's quite easy to use the report to get useful information.
Abstractness is the measure of rigidity in a codebase, the more abstract an object is the more flexible it is and easier to change, this is represented by the Y-axis, on the X-axis we have instability, not instability as in "oh no my application is really unstable and crashes all the time", but stability in the context means the more a class/method is consumed and depended upon the more stable it is and the more likely you are to steer clear of making modifications to it.... enough rambling now, take a look:

For the sake of simplicity I have only analysed a single assembly here, but you can quickly see that the code is within the green area, erring towards instability, that is to say, that this specific assembly is unstable (few dependencies upstream) and it could be modified without too much worry of breaking, however, it's pretty concrete and as such not very extensible.

The general idea is to stay out of the zone of pain, painful because to get into this zone you need to have a lot of references/dependencies on the object but it's not very extensible and very rigid, and also avoiding the zone of uselessness wherein the architecture is very abstract and extensible but nothing is using it.

Using this graph you can quickly see areas where you are depending on libraries and code that would be hard to extend or replace should you need to do so.

Finally, NDepend allows you to kick out an HTML interactive report showing the 4 reports illustrated below, this is great for taking into meetings if you need to discuss with your team/boss problems areas in code and how you are progressing.

It also summarises the application metrics such as count of issues and technical debt score (woo I got an A!)

Summary

I only meant to write quite a short review on NDepend but fell in love with the power and visibility it offers which kept me coming back for more.
In summary, I have to admit NDepend is a fantastic suite of tools that make a developers job a lot easier when having to make architectural decisions on both new applications during the development process and understanding how to refactor and work with older software you are picking up to work with, it also looks to be a great tool to use within CI/CD to help maintain great code quality in the development pipeline but have yet to test this in anger.

At around £350 a year for a licence it's pretty good value as a lot of work and expertise has gone into the product, I can see it being a useful and cost-effective tool for maintaining code quality which would quickly provide return on investment.

I have barely scratched the surface of this software in this review but encourage you wholeheartedly to check out the awesome documentation on the vendor's website here as it covers the application in a lot more detail than I ever could in a single blog post.

As an aside and as full disclosure, I have no affiliation nor do I have any monetary gains to be made my making this review, it was simply done off the back of having a chat with the lead developer of NDepend on linked-in who piqued my interest and offered me a licence to have a play with.

That's all folks, happy coding!

Customising ASP.Net Identity in Blazor server side

Joshua Holden — Sat, 21 Nov 2020 19:44:22 GMT

When you create a standard server side Blazor app using the default template with individual user accounts enabled you get a lot out of the box such as user registration, email confirmation, edit profile and role based security.

Blazor uses the core ASP.Net authentication using entity framework to generate the AspNetUsers and related authorisation tables either by as default in a SQL compact database, or by changing the connection string, a different type of SQL database, in this example I will be using on-prem (local) SQL server.

If you are already familiar with setting up individual user accounts with asp.net identity, doing migrations and changing connection strings but just want to know about how to add new fields to the identity user, you may want to skip past the basic functionality section.

The content discussed on this post can also be found in the below video if you prefer to watch, if not just keep scrolling to the text content below:

[youtube:QfMmIUXZw-A]

Basic functionality

We are going to start by firing up Visual Studio and choosing Blazor app as a new project:

Click next and give your Blazor web application a name, then click next again, choose Blazor server side, click change against authentication and make sure you choose "individual user accounts"

Finally, click create, now we can examine the solution.

Looking at the above structure of the default application there doesn't seem to be much going on, no ApplicationUser class or registration pages, etc, this is because Blazor at runtime injects the pages and classes required by ASP.net identity in and if you want to alter them you will have to manually create the pages to override them (or you can add them individually as scaffolded items from the menu).

To create the required tables, first of all, we will need to update the default connection string to point at a database and table, if you are opting to use the SQLCompact database then feel free to skip the following part and jump to the part of the adding migration below.

First of all, fire up SSMS and create a new empty database and add a SQL user account to connect to it And although not necessarily secure, for ease map the account to the database you have created as DBO, in a real environment it's probably better to grant only the permissions required to each table for the user, once this has been done and a new database has been created and a SQL account created with permissions flick back into visual studio and open up the appsettings.json file, we need to replace the existing default connection string to point at our new database.

The existing connection string will be pointing to a localdb, and will look something like this

"ConnectionStrings": {
    "DefaultConnection": "Server=(localdb)\\mssqllocaldb;Database=aspnet-AuthorisationDemo-BC1AB14F-C507-4594-B1B0-250B0A2E609B;Trusted_Connection=True;MultipleActiveResultSets=true"
  }

replace this with your SQL connection string mine looks like this:

Server=localhost;Database=IdentityDemo;User Id=IdentityDemoSqlUser;Password=Password123;

The final config should now look like this:

 "ConnectionStrings": {
    "DefaultConnection": "Server=localhost;Database=IdentityDemo;User Id=IdentityDemoSqlUser;Password=Password123;"
  }

Now the application is configured to point at our new database we can run the initial migration and update the database to build the required authorisation tables.

In Visual Studio click on the tools menu item in the top menu bar, then "Nuget Package Manager", and finally "Package Manager Console", once this is done the package manager console should open at the bottom of the screen, in the console type: "add-migration initial" end press enter:

If everything is successfull, the NPM (Nuget package manager) console should reflect the above screnshot, adding a migration builds all of the scripts required to update your database and add (or remove if reverting to a previous migration) the tables/objects that have been altered since the last migration.

Now, we need to issue one final command: "Update-Database":

Again, if successful, the NPM console should say done and reflect the above screenshot, now we can flick over to SSMS and confirm our tables have been created:

Above, you can now see the database has a bunch of tables related to user accounts and authorisation.

Now it's time to fire up the applicaton by pressing f5 in visual studio, if all goes to plan you should be greeted with a web browser window like below:

Click Register and bash in an email adress and password (note, it's possible and not terribly complex to add google authentication or facebook etc to this page if required), and click register:

Since we have not configured an SMTP account to use with authorisation and doing so is out of scope of this post (clicking the docs shown on the link will explain in detail how to do this) it will show a link in the browser asking you to confirm the acount instead of emailing it, click the confirm link then login with your newly created credentials.

If successfull, the website should now greet you and offer the option to log out, click on the greeting text "Hello, email@address" and it should take you to your account managment page:

Here, a whole host of options are presented such as adding a microsoft 2 factor authenticator to your account, changing your password and more.
However, in the profile only a phone number can be provided, to customise this we want to add an additional user profile field, "Date of Birth" (Note, all these pages are automagicaly generated and do not exist in your app, so will need to be created and overridden)

Customising Identity User

Up to now, we have only discussed standard functionality, now that's out of the way we can start doing fun stuff, adding in new functionality.

The first thing we need to do is scaffold up the Manage user pages so we can add in new fields, Right click on the "Data" folder in solution explorer, click: add => new scaffold item:

Then in the resulting window, click Identity:

Then select the following, ensuring you select the ApplicationDBContext:

Once you have done this, navigate in the solution explorer to: Areas =>Identity => Pages =>Account =>Manage and click on Index.cshtml, note that you can see the phone number HTML field, we are going to add a new field called Date of birth, but first we need to alter the IdentityUser account so the DateOfBirth property can be saved back to the database:

The first thing we need to do now is right click on the "Data" folder and create a new class called ApplicationUser, this needs to inherit from IdentityUser and have the new custom date of birth property, the code for this should look like this:

public class ApplicationUser : IdentityUser
    {
        public DateTime DateOfBirth { get; set; }
    }

the second thing we need to do now is to replace globally across the application all references to IdentityUser and replace it with ApplicationName.Data.ApplicationUser (Replace ApplicationName with your app name so the namespace matches), this should update around 53 records (Using the fiull namespace to avoid going into each view and adding: @using AuthorisationDemo.Data) :

Once you have replaced all instances of IdentityUser with ApplicatioName.Data.ApplicationUser, go back into the ApplicationUser class and update it back to inheriting from IdentityUser as the find and replace will have broken the code here:

The final thing we need to do now before adding the new migration and updating the database is to update the ApplicationDbContext so it inherits from IdentityDbContext<ApplicationUser> instead of just IdentityDbContext, also we need to add in the on model building code, the final amended class should look like this:

  public class ApplicationDbContext : IdentityDbContext<ApplicationUser>
    {
        public ApplicationDbContext(DbContextOptions<ApplicationDbContext> options)
            : base(options)
        {
        }

        protected override void OnModelCreating(ModelBuilder builder)
        {
            base.OnModelCreating(builder);
        }
    }

Now back into NPM and run: add-migration DateOfBirth:

Once completed, it should generate the migration code for out new column shown above, we can now run: update-database:

Once this has completed succesfully as shown above, flick across into SSMS and refresh the table, we should see out new column in the AspNetUsers table:

Going back into visual studio now, lets edit the Areas/Indentity/Pages/Manage/Index.cshtml page and add the following date of birth field below the phone number:

 <div class="form-group">
                <label asp-for="Input.DateOfBirth"></label>
                <input asp-for="Input.DateOfBirth" type="date" class="form-control" />
                <span asp-validation-for="Input.DateOfBirth" class="text-danger"></span>
</div>

The code should look something like this now:

Finally we need to edit the code behind for this page by clicking the arrow next to the index.cshtml page and opening the Index.cshtml.cs code page:

In this code we need to update the viewmodel to contain the new field as get/save it back to the database, copy and paste in the following code over the top of the existing:

 public partial class IndexModel : PageModel
    {
        private readonly UserManager<ApplicationUser> _userManager;
        private readonly SignInManager<ApplicationUser> _signInManager;

        public IndexModel(
            UserManager<ApplicationUser> userManager,
            SignInManager<ApplicationUser> signInManager)
        {
            _userManager = userManager;
            _signInManager = signInManager;
        }

        public string Username { get; set; }

        [TempData]
        public string StatusMessage { get; set; }

        [BindProperty]
        public InputModel Input { get; set; }

        public class InputModel
        {
            [Phone]
            [Display(Name = "Phone number")]
            public string PhoneNumber { get; set; }
            
            public DateTime DateOfBirth { get; set; }
        }

        private async Task LoadAsync(ApplicationUser user)
        {
            var dbuser = await _userManager.GetUserAsync(User);
            var userName = dbuser.UserName;
            var phoneNumber = dbuser.PhoneNumber;
            var DOB = dbuser.DateOfBirth;
            Username = userName;

            Input = new InputModel
            {
                PhoneNumber = phoneNumber,
                DateOfBirth = DOB
            };
        }

        public async Task<IActionResult> OnGetAsync()
        {
            var user = await _userManager.GetUserAsync(User);
            if (user == null)
            {
                return NotFound($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
            }

            await LoadAsync(user);
            return Page();
        }

        public async Task<IActionResult> OnPostAsync()
        {
            var user = await _userManager.GetUserAsync(User);
            
            if (user == null)
            {
                return NotFound($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
            }

            if (!ModelState.IsValid)
            {
                await LoadAsync(user);
                return Page();
            }
            if(Input.DateOfBirth!= user.DateOfBirth)
            {
                user.DateOfBirth = Input.DateOfBirth;
            }
            if(Input.PhoneNumber != user.PhoneNumber)
            {
                user.PhoneNumber = Input.PhoneNumber;
            }
            var success = await _userManager.UpdateAsync(user);
            if(!success.Succeeded)
            {
                StatusMessage = "Unexpected error when trying to update user.";
                return RedirectToPage();
            }         

            await _signInManager.RefreshSignInAsync(user);
            StatusMessage = "Your profile has been updated";
            return RedirectToPage();
        }
    }

That's it, we should now be done, lets fire up the web app and view the user profile again:

As you can see now, the additional date of birth field now shows and if we populate it and click save:

You get a nice little message informing you the changes have been saved back to the database.

This concludes this introduction to customising IndentityUser in Blazor, additional tables can be linked in a similar manner using fluent annotation but this is out of scope of the current post.
Thanks for reading and happy coding!

C# 9, Introducing records

Joshua Holden — Wed, 11 Nov 2020 23:48:45 GMT

1:Record types, what are they?

According to wikipedia, an immutable object is thusly defined:

An immutable object (unchangeable object) is an object whose state cannot be modified after it is created. This is in contrast to a mutable object (changeable object), which can be modified after it is created. In some cases, an object is considered immutable even if some internally used attributes change but the object’s state appears to be unchanging from an external point of view.

In simple terms, this means once an instance of the immutable object has been created no parts of it can be modified and it becomes effectively locked/readonly, this is inherantly useful when working with multi-threaded applications as it creates implicit thread safety in-so-much as because the objects cannot be mutated/altered there is no risk of multiple threads trying to alter the same object and locking, it also has the side effect of creating less bug prone and safer code especially when multiple developers are involved who may be enticed to alter properties of objects at random places in code introducing bugs elsewhere.

So, how do records help... well, actually, consider the following code:

    class Program
    {
        static void Main(string[] args)
        {
            var c1 = new Candidate() { FirstName = "Donald", Surname = "Trump" };
            var c2 = new Candidate() { FirstName = "Donald", Surname = "Trump" };
            //this will return true as both records match even though they are different objects.
            Console.WriteLine($"c1 and c2  are {(c1.Equals(c2) ? "the same people" : "different")} "); 
            c1.Surname = "BOB";
            //Now they won't match
            Console.WriteLine($"c1 and c2  are {(c1.Equals(c2) ? "the same people" : "different")} ");
                        Console.ReadLine();
        }
    }

    public record Candidate
    {
        public string FirstName { get; set; }
        public string Surname { get; set; }
    }

This code is fully functional and compiles but clearly here, a record has been created and mutated... so what's all the fuss about, are records not a new feature explicitly for writing immutable code, how is this even any different from using a class?

Good question, let me answer...
Firstly, pay attention to the above line of code repeated below:

Console.WriteLine($"c1 and c2  are {(c1.Equals(c2) ? "the same people" : "different")} ");

"What's that I see", you might say, "an equality check, but the record doesn't implement the IEquatable<T> interface, what black magic is going on here"... well my friend, welcome to record types.

When a record type is defined, behind the scenes at compile time the compiler creates a lot of boiler plate code for you, implementing the IEquatable interface which allows the above equality check to take place, furthermore it overrides the ToString method so as to print out the object name and methods as shown below:

Candidate { FirstName = Donald, Surname = BOB }

It also creates a "Copy constructor" which when used with the "with" keyword creates a copy of the existing object which will be covered in more detail.

Altering our original code slightly we can now start to leverage some immutability:

    class Program
    {
        static void Main(string[] args)
        {
            var c1 = new Candidate("Donald", "Trump");
            var c2 = new Candidate("Donald", "Trump");            
            //Can't alter the surname any more, because  
            //c1.Surname = "BOB";
            Console.ReadLine();


        }
    }

     record Candidate
    {
        string FirstName { get; init; }
        string Surname { get; init; }
        public Candidate(string Fname, String Sname) => (Fname, Sname) = (FirstName, Surname);
    }

Note that now the record is using the init keyword, this means the records properties can only be set at the time it is created, this code can be made even simpler by using positional records which automatically generate the backing fields and constructor shown above, this is acomplished like so:

   class Program
    {
        static void Main(string[] args)
        {
            var c1 = new Candidate("Donald", "Trump");            
            Console.ReadLine();
        }
    }
     record Candidate(string FirstName, string Surname);

Currently though this shorter positional syntax is bugged and requires you to add in the following class somewhere in your program:

 namespace System.Runtime.CompilerServices
    {    
    public class IsExternalInit { }
    }

and if you don't you will see the follwing error:
predefined type 'System.Runtime.compilerServices.IsexternalInit is not defined or imported'

Incedently, init only references can also be used on classes as shown below in the snippet:

namespace CSharp9
{
    class Program
    {
        static void Main(string[] args)
        {
            var c1 = new Candidate("Donald","Trump");          
            Console.ReadLine();
        }
    }
    public class Candidate
    {
        public string FirstName { get; init; }
        public string Surname { get; init; }
        public Candidate(string Fname, String Sname) => (Fname, Sname) = (FirstName, Surname);
    }  
}
namespace System.Runtime.CompilerServices
{
    public class IsExternalInit { }
}

But while this allows you to create an immutable class, what you won't get is the other good stuff that comes with records and will have to write your own boilerplate code for equality checks etc.

2: How does using immutable objects change how I code?

Obviously there will come a time when writing code you need to change the object you are working with but this is not possible due to the immutable nature of init only properties, enter "With" keyword, consider the below code snippet if you will:

 class Program
    {
        static void Main(string[] args)
        {
            var c1 = new Candidate("Donald","Trump");          
            var c2 = new Candidate("Donald", "Trump");
            var c3 = c1 with { Surname = "Duck" };
        }
    }
    public record Candidate
    {
        public string FirstName { get; init; }
        public string Surname { get; init; }
        public Candidate(string Fname, String Sname) => (Fname, Sname) = (FirstName, Surname);
    }

Here the with keyword is used to leverage the automatically created clone method in the record to create a copy of the c2 record object but altering the surname.

Finally, as a quick aside, if you create a class without an access modifier it defaults to private with records however, the default state is public, one to watch out for if you like to keep your members private!

Happy coding!

The Hackers Manifesto, still valid today!

Joshua Holden — Sun, 30 Aug 2020 10:18:43 GMT

The Hackers manifesto, written all the way back in 1986 by a chap called Loyd Blankenship (the mentor in "Legion of doom","Racketeers" and other hack groups) shortly after his arrest by the FBI for “being in a computer I should not have been”.

A lot of you in the wider world may have already read this but I feel it is an incredibly resounding piece of writing and encompasses the feelings of many white hat hackers and why the educational system and society as a whole needs to change and embrace people who challenge and test the systems and infrastructures.

The short essay still holds true today if not more so and brings back sad echos to me as to how I felt failed and misunderstood by the educational system growing up.

formatting kept as was originally posted:

The Conscience of a Hacker... by The Mentor ...    1/8/86

   Another one got caught today, It's all over the papers.
"Teenager Arrested in Computer Crime Scandal", "Hacker arrested
after Bank Tampering"...

   Damn kids. They're all alike.

   But did you, in your three-piece psychology and 1950's
technobrain, ever take a look behind the eyes of a hacker? did
you ever wonder what made him tick, what forces shaped him, what
may have molded him?

   I am a hacker. Enter my world.

   Mine is a world that begins with school... I'm smarter than
most of the other kids, this crap they teach us bores me...
                    Come on...  Ain't Got All Day!!                                                   
   Damn underachiever. They're all alike.

   I'm in junior high or high school. I've listened to the
teachers explain for the fifteenth time how to reduce a
fraction. I understand it. "No Ms. Smith, I didn't show my work.
I did it in my head..."

   Damn kid. Probably copied it. They're all alike.

   I made a discovery today. I found a computer. Wait a second,
this is cool. It does what I want it to. if it makes a mistake,
it's because I screwed it up. Not Because it doesn't like me...
Or feels threatend by me...
Or thinks I'm a smart ass...
Or doesn't like teaching and shouldn't be here...

   Damn kid. All he does is play games. They're all alike.

   And then it happened... a door opened to a world... rushing
through the phone line like junk through an addict's veins, an
electronic impulse is sent out, a refuge from the day-to-day
incompetencies is sought... a board is found.

   "this is it... this is where I belong..."

   I know everyone herre... even if I've never met them, never
talked to them, may never hear from them again... I know you
all... 

   Damn kid. tying up the phone line again. They're all alike...
                    Come on...  Ain't Got All Day!!                                                   
   You bet your ass we're all alike... we've been spoon-fed baby
food at school when we hungered for steak... the bits of meat
that you did let slip through were prechewed and tasteless.
We've been dominated by sadist, or ignored by the apathetic. The
few that had something to teach us found us willing pupils, but
those few are like drops of water in the desert.

   This is our world now... the world of the electron and the
switch, the beauty of the baud. We make use of a service already
existing without paying for what could be dirt-cheap if it
wasn't run by profiteering gluttons, and you call us criminals.
we explore... and you call us criminals. We seek after
knoledge... and you call us criminals. We exist without skin
color, without nationality, without religous bias... and you
call us criminals. You build atomic bombs, you wage wars, you
murder, cheat, and lie to us and try to make us believe it's for
our own good, yet we're the criminals.

   Yes, I am a criminal. My crime is that of curiosity. My crime
is that of judging people by what they say and think, not what
they look like. My crime is that of outsmarting you, something
that you will never forgive me for.

                    Come on...  Ain't Got All Day!! 
 
I am a hacker, and this is my manifesto. You may stop this
individual, but you can't stop us all... after all, we're all alike.

+++The Mentor+++
   Racketeers