Softwaremaker

Saving some space in my living-room for the Windows Home Server

softwaremaker — Fri, 02 Feb 2007 11:36:32 GMT

Windows Home Server will be one of the better well-kept secret products that will be ultra-cool once its released into the wild. You can go here for a brief animation overview. The official Home Server Team blog can be found here.

Some of the interesting briefs include:

This is not a product based on the Windows Server 2003 codebase. It's a consumer-oriented product that is quite similar to Media Center Edition, in that it's less of an "edition" of Windows Server than it is a special application (like Media Center) that runs atop a version of Windows.

There are, of course, many features on this server but what I live best about it is placed on emphasis here:

Expandable Drive space - Add as many Hard-Drives in gigs, teras and petas as your hardware allows. (No problem with the hard-disks I have lying around. I could easily squeeze 6 SATA suckers into this once I can find the supporting muthaboard ...)
Remote Access - Access your photos, music, videos from any computer with a WWW connection. Even give restricted access to your cronies through your free, customizable Live Web Site.
Automatic Backup - It stores only a single copy of every file, remembering which computer had what and saving your drive space - Hard Disk Storage Space Virtualization, anyone ? (this is just music to my ears ...)

I dont know about you but my living room is ready ...

Softwaremaker is moving...

softwaremaker — Sun, 31 Oct 2004 02:29:00 GMT

I am moving my blog to a self-hosted environment here at http://www.softwaremaker.net/blog. Having owned this domain of Softwaremaker.NET for some time now, it only makes sense to move my blog back there as well.

Not only am I moving my blog back there, I am switching blog engines as well...from .TEXT to dasBlog. I love the fact that dasBlog gives me more customizable and extensible features and also NOT to forget to mention that dasBlog doesnt use a database, just XML Files. That saves some licensing costs for me as well.

The most important part of this move is the fact that I retain control over my blog. That is a huge plus point for me !!! I have noticed that .TEXT Weblogs hosted on DotNetJunkies seemed to run into many problems recently. Downtime, some very common recurring exceptions of SQLParameters and @ItemCount have also plagued the weblogs of DotNetJunkies recently.

Having advertisements on the blogs of DotNetJunkies was the final straw that broke the camel's back and triggered me to make this move.

Sorry Doug and Donny. However, thanks so much for providing me with a fantastic blog host for the past year.

For the rest of the folks who follow my blog, do NOT forget to point your links, opml to me at http://www.softwaremaker.net/blog and I hope to be able to further interest you with more technical and XML Services blog posts in the future.

See you there. (Hows that for some in-your-face marketing ? )

SOA: Is that boat finally going somewhere OR are all rowers in that boat rowing in different directions ?

softwaremaker — Thu, 21 Oct 2004 17:03:00 GMT

Like some of the XML Service Architects we have here, I think sometimes we bemoan on what SOA really is, or should I say, what the market thinks. Personally, I feel it is a term that business consultants have flogged left-right-center for too much and too long and the idea and meaning is all lost in the market (yeah, blame the business ppl ). Some people think its Service-Oriented Analysis, for some, it is Service-Oriented Architectures and its Service-Oriented Approach for the others.

So, ask what SOA means to different enterprises, they will give their own correct perspectives of it based on their definition of the term. And that is why, sometimes I used the term Service-Orientation to give it a more detailed approach. It is also harder to get the definition wrong.

In my opinion, Service-Oriented Architectures revolves around the business process. That process drives the design of Service-Oriented Architectures. And that ladies and gentlemen, to get the business guys / gals to sit down and agree with the streamlining of business processes ? Now, that IS difficult !

I do get a bit flustered when I get questions and posts from people how do they can "SOA their application and objects". No offense, but I dont think Service-Orientation actually can get down and dictate to the object or component oriented layer. I believe, usually, what they meant is that how can I more easily exposed my objects or applications via WebMethods (ASMX) or, for the hardcore geeks, SoapMethods (WSE)

That, to me, is just one important but yet small part to play in an environments of Service-Orientation. Service-Orientation is a lot more than that. Services can mean virtually any and everything, not just an exposure of application logic decorated with WebMethods or SoapMethods. It can also mean the Infrastructure Handlers and the Transport Carriers.

Looking it in another way, a CD Player is proving a service and an interoperable one at that, as it can play any and every CD (OK, for the smart alec that wants to bring up the argument of the DVD, save it ) . It is unlikely that a CD Player will come with its own CDs that only it can play. So I would say that the CD player is a system of Service-Orientation. There is an element of abstraction and polymorphism in it in that you invoke the common PLAY API and you know what to expect even though you dont know and dont want to know how it is being implemented and you can also be sure that the CD (messages) being put into the player can return you decent music (messages) without it being thrown out or ejected or jammed (exceptions).

Most application people today, I believe, wants to know how they can build that CD and NOT the CD Player. Of course, building the CD Player is a mammoth task in itself. There is Indigo by Microsoft that tries to build that CD Player...AND...from what I have seen, it is ONE HELL OF A CD PLAYER --- making simple efforts to play any kinds and types of CD, provided it is in CD Format (SOAP1.2). Of course, there are a few people out there who may be interested in attempting to build that CD Player as well BUT it cannot be an individual person's effort. It is an entire industry of W3C, OASIS, WS-I, etc at work.

I love this article found here. There is an interesting fictitious case study there involving Iteration One, Two, Three of Rum Island Industries. As you can easily imagined from the painted scenarios, having Service-Orientation fit into a connected systems strategy is not an easy task and certainly cannot be correctly implemented from Day One. If you look at the same case studies again, you would see that there is a common identifying and underlying theme uniting them all, which, I think, is the key for Service-Oriented Architectures - The role of the Business Process.

I wont go too deep into the territories of the evolution of the Business Process as I am ill-equipped to do so. Suffice to say that a Service-Oriented Architecture is more than just XML or Web Services.

Anyways, moving on. I came across this article and am pleasantly surprised to find in this article:

"More companies are understanding the big picture. Ask them if they know what an SOA is, they'll say 'yes.' Ask them if they understand the business value proposition, they'll say 'yes' and talk about reuse and other concepts," said Jason Bloomberg, analyst with ZapThink LLC. "If you ask them who is on the SOA team, or what's their schedule for SOA, that's a different question...
They want to know how to build the right services, how to deal with semantics and data consistency, and how to assemble the right team..."

Are we really moving somewhere ? Is everyone ready to accept that there is NO single one solution as in

"The root of the problem is that SOA is hard; architecture is hard..."
"There's no magic bullet."

"A flexible IT architecture is the holy grail..."

Alas, isnt that we are trying to build forever ? A Holy Grail ? Isnt that the reason why they called it a Holy Grail in the first place ?

Anyways, here are some comments which can be found in the same article

Noticed how different all those definitions are from each other. Wonder what it would look like if I submitted my CD Player analogy into the mix as well.

--------------------------------------------------------------------------------
"SOA is a framework enabling application functionality to be provided, discovered and consumed as re-usable Web Services sets. While Web Services do not equal SOA, it's one of the enabling standards. SOA abstracts complexity and implementation details, making it an ideal architectural mindset to leverage functionality trapped within mainframe/midrange systems."
Scott Rosenbloom is chief strategist with WRQ Inc.
--------------------------------------------------------------------------------
"Secure, integrated delivery of IT solutions meeting business requirements. Solutions must implement, optimize and guide business process execution by combining the functionality of separate, discreet, reusable services. SOA moves away from complex application development, promoting a focus on standardizing interfaces between atomic service components with centralized management and distributed implementation."
Dave Morris, I.T. Security Lead TransAlta Corp.
--------------------------------------------------------------------------------
"The SOA models the business as a collection of self-contained services that are available across the enterprise that can be evoked through standard protocols both internally and externally."
Dave McComb, president, Semantic Arts
--------------------------------------------------------------------------------
"Service Oriented Architecture is nothing but business oriented architecture, which allows the flexibility of business applications, to become independent but collaborative, while providing their services. The applications under this architecture are both 'client' and 'server' at the same time with freely available services."
Satheesan Kunnel, USWWI
--------------------------------------------------------------------------------
"A service oriented architecture is an approach to design and integrate software in a modular method where each module is precisely a 'loosely coupled service' that is accessible over a network and has the capability of being dynamically integrated with other services at run time. A service must present a standard Interface (be it WSDL today) for its functionality and invocation methods while the real implementation of the service is not a concern of an SOA."
Rajesh Dawar
--------------------------------------------------------------------------------
"Services provide something of value to those who know how to request and consume them, without having to know how to produce that value. SOA is an approach to building software applications as collections of autonomous services that interact without regard to each other's platform, data structures, or internal algorithms."
Michael Champion, R&D specialist, Software AG
--------------------------------------------------------------------------------
"A pattern of design, development, deployment, and management of (a) applications and (b) software infrastructure and frameworks in which: Applications are organized into business units of work (services) that are (typically) network accessible Service interface definitions are first-class development artifacts
Quality of service (QoS) characteristics (security, transactions, performance, etc.) are explicitly identified at design time Software infrastructure takes active responsibility for managing QoS and enforcing policy for service access and execution Services and their metadata are cataloged in a repository Protocols and structures within the architecture are, optionally, based on industry standards (e.g., the emerging SOAP stack of standards)
Randy Heffner, vice president, Forrester Research Inc.
--------------------------------------------------------------------------------
"SOA is a style of design that strives to enable easy integration and flexible applications. In SOA, application functionality is designed as shared reusable services. A service is a piece of application functionality that exposes its functionality through an abstract interface, which hides the inner workings of the service implementation."
Anne Thomas Manes, analyst, Burton Group
--------------------------------------------------------------------------------
"An SOA is an enterprise-scale architecture (typically spanning multiple applications within an enterprise or across multiple enterprises) where the primary structuring element is a service (as opposed to modules, systems, applications or components). A service is a set of related business functions that are interacted with locally or remotely using a message-passing/document-oriented communication style. A service is composed of (1) a (functional) service interface and (2) a service implementation that implements one or more service interfaces and adheres to a certain set of (non-functional) capabilities. Specific services are defined in terms of the transport/application/messaging protocol, not in terms of a specific programming model.
An SOA will typically include technical services to manage metadata about service interfaces and implementations, service providers and service consumers; and services for managing and enforcing policies, access control, security features, and transactions, although all of these are optional within any specific SOA instance."
Stefan Tilkov, CEO, innoQ
--------------------------------------------------------------------------------
"Service-oriented architecture is an architectural discipline that centers on the notion that IT assets are described and exposed as Services. These Services can then be composed in a loosely-coupled fashion into higher-level business processes, which providing business agility in the face of IT heterogeneity."
Ronald Schmelzer, analyst, ZapThink LLC
--------------------------------------------------------------------------------
"Service Oriented Architecture (SOA) is an approach to the development of loosely coupled, protocol-independent distributed applications composed from well-defined, self-contained software resources accessible as Services across the extended enterprise in a standardized way, enhancing re-usability and interoperability."
Ankur Gupta, marketing manager, Fiorano Software Inc.

WS-Security and the BinarySecurityToken

softwaremaker — Wed, 20 Oct 2004 20:41:00 GMT

I had recently returned to the WSE newsgroup (microsoft.public.dotnet.framework.webservices.enhancements). The crowd there is a bit different from when I left it. Casey Chesnut has disappeared from there in search of bigger neural and cerebral challenges (which, incidentally, is a loss for WSE on the .NET Compact Framework BUT it is sure good to see Julie there.

I came across some questions pertaining to how the asymmetric keys of X.509 PKI Digital Certificates are being transmiited during SOAP Message exchanges for both XML-Encryption and XML-Digital Signature.

There seems to be some sort of slight confusion here so I will explain in a more user-friendly fashion here.

Although XML-Encryption and XML-Digital Signature works on the same fundamental principles, they are implemented rather differently. I will not go into details on how they work on top of Factoring, Prime Numbers and such as these are topics that will not fit into one blog post. You may want to go here to find out more. To put it simply:

If Alice wants to encrypt a message just for Bob, Alice will encrypt the message using Bob's (Publicly-available) Public Key, which, Bob's (Secretly-held) Private Key can decrypt once he received the message
If Alice wants to sign a message, Alice will encrypt the message using her (Secretly-held) Private Key and then anyone with Alice's (Publicly-available) Public Key will be able to verfy that the message was authentic and signed by Alice only.

If you scrutinize these 2 key principles enough, you will realize that there is a key differing implementation detail.

Now, lets go into how WSE 2.0 implements OASIS WS-Security Specifications riding on top of ASMX XML Web Services.

To be true to myself and how I would try to use the term XML Services whenever I can, I would also avoid the use of client-server whenever I can and use the term Publisher-Subscriber instead.

For simplicity's sake, I assume the following:

[PublisherCode] is always going to return "Hello World"
[PublisherCode] Response Stream is just going to be plain simple vanilla message with NO fat and trimmings
ONLY X509 Asymmetric Encryption Public Private Key Pairs are used here
Alice is the Subscriber while Bob plays the role of the Publisher

For Scenario (1) XML-Encryption ========================================================
[PublisherCode]

<WebMethod()> _
Public Function HelloWorld() As String

Return "Hello World"

End Function

[SubscriberCode]
Dim a As IndexWse = New IndexWse

    Dim store As X509CertificateStore = _
      X509CertificateStore.CurrentUserStore(X509CertificateStore.OtherPeople)
    store.OpenRead()

    Dim cert As X509Certificate = store.FindCertificateByKeyIdentifier _
    (Convert.FromBase64String("bBwPfItvKp3b6TNDq+14qs58VJQ="))(0)
    Dim xTok As New X509SecurityToken(cert)

a.RequestSoapContext.Security.Elements.Add(New EncryptedData(xTok))

MessageBox.Show(a.HelloWorld)

[Resultant Request SOAP Message in brief]
...
<xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
<xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5" />
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<wsse:SecurityTokenReference>
<wsse:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509

SubjectKeyIdentifier">bBwPfItvKp3b6TNDq+14qs58VJQ=</wsse:KeyIdentifier>
</wsse:SecurityTokenReference>
</KeyInfo>
<xenc:CipherData>
<xenc:CipherValue>XFMDuiWzvjOVA9kYPBRrOmrxwnT7u+p4avsEBdlISdYx/tLZPHXSivSBRJW5j6JWwQxPjVWNOwWv9fxN1ebjeS+zGXztZRX+Gpx3

wTpIfIvUeoz+VJBGcLXdLbp292dkX3n0723DsZ8N6fMZCLkKh3bPe8jDy6Es6XYaFThrkUo=</xenc:CipherValue>
</xenc:CipherData>
<xenc:ReferenceList>
<xenc:DataReference URI="#EncryptedContent-e8284f45-0a66-409d-a5e2-c041b648fbac" />
</xenc:ReferenceList>
</xenc:EncryptedKey>
...

[Comments]
Since Alice is encrypting something specific for Bob's eyes only, Alice need to explicity get Bob's (Publicly-available) Public Key. This has to be an explicit assumption to make. This can be done in many ways which traditionally make take some out-of-band approach. In our case above, Bob's Public Key is installed on my machine in the CurrentUserStore\OtherPeople key store. Bob can then use his (Secretly-held) Private Key to decrypt the cipher in the message. This is a very end-user specific approach. It is unlikely Alice will be encrypting something that she wants the whole world to see. Therefore, the Publisher (Bob) can be sure that the X509 SubjectKeyIdentifier of "bBwPfItvKp3b6TNDq+14qs58VJQ=", which contains his (Secretly-held) Private Key, can be found in his key store of the machine. It would be a fairly safe assumption to make.

For Scenario (2) XML-Digital Signature ========================================================
[PublisherCode]

<WebMethod()> _
Public Function HelloWorld() As String

Return "Hello World"

End Function

[SubscriberCode]
Dim a As IndexWse = New IndexWse

    Dim store As X509CertificateStore = _
      X509CertificateStore.CurrentUserStore(X509CertificateStore.MyStore)
    store.OpenRead()

    Dim cert As X509Certificate = store.FindCertificateByKeyIdentifier _
    (Convert.FromBase64String("gBfo0147lM6cKnTbbMSuMVvmFY4="))(0)
    Dim xTok As New X509SecurityToken(cert)

a.RequestSoapContext.Security.Tokens.Add(xTok)
a.RequestSoapContext.Security.Elements.Add(New MessageSignature(xTok))

MessageBox.Show(a.HelloWorld)

[Resultant Request SOAP Message in brief]
...
<wsse:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"

EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"

wsu:Id="SecurityToken-7b5d8096-928a-45d2-b504-d0bfb84eab41">MIIBxDCCAW6gAwIBAgIQxUSXFzWJYYtOZnmmuOMKkjANBgkqhkiG9w0BAQQFADAWM

RQwEgYDVQQDEwtSb290IEFnZW5jeTAeFw0wMzA3MDgxODQ3NTlaFw0zOTEyMzEyMzU5NTlaMB8xHTAbBgNVBAMTFFdTRTJRdWlja1N0YXJ0Q2xpZW50MIGfMA0GCS

qGSIb3DQEBAQUAA4GNADCBiQKBgQC+L6aB9x928noY4+0QBsXnxkQE4quJl7c3PUPdVu7k9A02hRG481XIfWhrDY5i7OEB7KGW7qFJotLLeMec/UkKUwCgv3VvJrs

2nE9xO3SSWIdNzADukYh+Cxt+FUU6tUkDeqg7dqwivOXhuOTRyOI3HqbWTbumaLdc8jufz2LhaQIDAQABo0swSTBHBgNVHQEEQDA+gBAS5AktBh0dTwCNYSHcFmRj

oRgwFjEUMBIGA1UEAxMLUm9vdCBBZ2VuY3mCEAY3bACqAGSKEc+41KpcNfQwDQYJKoZIhvcNAQEEBQADQQAfIbnMPVYkNNfX1tG1F+qfLhHwJdfDUZuPyRPucWF5q

kh6sSdWVBY5sT/txBnVJGziyO8DPYdu2fPMER8ajJfl</wsse:BinarySecurityToken>

<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
<Reference URI="#Id-f7e1c0fa-e3da-4cb4-be53-f583153bc588">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>avMezj5NhZwNerXidi5oBmjqi/g=</DigestValue>
</Reference>
...
</SignedInfo>

<SignatureValue>SJfnqZeDHboWDI2n2gWHqTJO5hXvZOFQw8UtDdajktzR40H+W6Dprs5CW/l9A5TF3xcFfyryA3hz7c+0vdlZSnaA+cBn2qPxt7/YmwaAx5Ave

awuach6YPYI123I4I3f58eSMUgPsx6/uuFQFcJltEMw1nWLE6Wb6CPg5OdtXLs=</SignatureValue>
<KeyInfo>
<wsse:SecurityTokenReference>
<wsse:Reference URI="#SecurityToken-7b5d8096-928a-45d2-b504-d0bfb84eab41"

ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" />
</wsse:SecurityTokenReference>
</KeyInfo>
</Signature>
...

[Comments]
If you look closely at the subscriber code, you will notice a few differences. First, Alice is using her (Secretly-held) Private Key to sign the message. Then she attaches the X509 Digital Certificate to the message. WSE2.0 is smart enough to know that ONLY the Public-Key pair of the X509 Digital Certificate goes out in SOAP on the wire. This is encapsulated in the <wsse:BinarySecurityToken> element in the SOAP Header. Why the difference ? Because a signed message by Alice is for any and everyone to verify and therefore Alice cannot assume that any and everyone has got a copy of her Public Key. In this case, she has to attach her Public Key in the X509 Cert to her SOAP Request Message so that anyone getting hold of her Public-Key can verify that ONLY she (Alice) can sign the message. The <wsse:BinarySecurityToken> element, in this case, actually contains a Base64 Binary Respresentation of Alice's Public Key X509 Certificate.

Now, can you spot the hack here ?

If Mallet of Man-In-The-Middle chances upon this message, he can actually signed the SOAP Message elements with his (Secretly-held) Private Key. Then he can replaced Alice's <wsse:BinarySecurityToken> element with his own Base64 Binary Respresentation of Mallet's Public Key X509 Certificate. If Mallet succeeds in doing so, and this can be fairly straightforward and easy to implement (I may blog about how to do this in a later post), the SOAP Message received is actually cryptographically verified to be accurate even though the trust has failed because of the Untrusted Public Key.

So, what can Bob do ? Well, Bob has got 2 choices BUT both require some out-of-band communication with Alice. There has to be some kind of communication work done before trust can actually be established. You really cannot run away from it.

1) Bob can implement a Trust Verification at the Application Layer
[PublisherCode]

<WebMethod()> _
Public Function HelloWorld() As String

    Dim xtok As X509SecurityToken = GetSigningToken(RequestSoapContext.Current)

    If xtok.Certificate.GetCertHashString = RetrieveFromListofTrustedThumbPrints
    OR
    If xtok.KeyIdentifier.Value = RetrieveFromListofTrustedKeyIdentifiers

Return "Hello World"

End if

End Function

Public Shared Function GetSigningToken(ByVal context As SoapContext) As SecurityToken
    Dim element As ISecurityElement
    For Each element In context.Security.Elements
      If (TypeOf (element) Is MessageSignature) Then
        ' The context contains a Signature element.
        Dim sign As MessageSignature = element
          ' The SOAP body is signed
          Return sign.SigningToken
      End If
    Next
    Return Nothing
End Function ' GetSigningToken

[Comments]
As you can see, the message is allowed through and Bob checks it at the application level. He can either verify via the Digital Certificate's Thumbprint which is exposed via the GetCertHashString property or the Digital Certificate's KeyIdentifier which, in this case, happens to be "gBfo0147lM6cKnTbbMSuMVvmFY4=" One drawback on this method is that message is allowed through to the application layer and certain resources are invoked to check for the trust of the sender.

2) Bob can implement a Trust Verification at the WS-Policy Level
[PublisherCode]

<WebMethod()> _
Public Function HelloWorld() As String

Return "Hello World"

End Function

[WS-Policy File in brief]
...
<request policy="#Sign-X.509" />
...
<policies xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"

xmlns:wsp="http://schemas.xmlsoap.org/ws/2002/12/policy" xmlns:wssp="http://schemas.xmlsoap.org/ws/2002/12/secext"

xmlns:wse="http://schemas.microsoft.com/wse/2003/06/Policy"

xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"

xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/03/addressing">
   <wsp:Policy wsu:Id="Sign-X.509">
   ...
   <wssp:Integrity wsp:Usage="wsp:Required">
   <wssp:TokenInfo>
   <wssp:SecurityToken wse:IdentityToken="true">
   ...

<wssp:TokenType>http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3</wssp:TokenType>
   <wssp:TokenIssuer>CN=Root Agency</wssp:TokenIssuer>
   <wssp:Claims>
   ...
   <wssp:SubjectName MatchType="wssp:Exact">CN=WSE2QuickStartClient</wssp:SubjectName>
   <wssp:X509Extension OID="2.5.29.14" MatchType="wssp:Exact">gBfo0147lM6cKnTbbMSuMVvmFY4=</wssp:X509Extension>
   </wssp:Claims>
   </wssp:SecurityToken>
   </wssp:TokenInfo>
   ...
   </wsp:Policy>
</policies>
...

[Comments]
As you can see, this method is so much cleaner and neater. Messages will fail at the Policy Pipleine level and will NOT reach Bob's application code itself. See that the HelloWorld WebMethod has no extra trimmings and fat. The policy file dictates that the X509 Digital Certificate coming in must have SubjectName = CN=WSE2QuickStartClient AND KeyIdentifier = gBfo0147lM6cKnTbbMSuMVvmFY4=

If the SOAP Requests carrying the <wsse:BinarySecurityToken> element doesnt meet these policy demands, an exception is thrown. Beautiful ! Of course, technically speaking, resources are still being invoked to check for these demands but they happen at the policy-assertion level of the WSE pipelines which are abstracted away from the developer, thus allowing these developers to focus on the business logic itself. Application code is definitely cleaner and more maintainable.

Both methods, though slightly different, work on a major principle of assumption that Alice and Bob have established some kind of communication channel between them or amongst others where Trusted KeyIdentifiers or Thumbprints are exchanged. It also highlights the fact on how important having a common trusted root Cert Authority that can be verifiable such as Verisign or Checkpoint is.

This blog post, long as it is, highlights some major points. We dont live in a secure world and this is the only thing we can assume safely. Verifying a signed message is NOT as simple as it may seem. There has to be some kind of out-of-band approach to ascertain trust between partners because validation of the message, as we can see from the above example, is definitely NOT enough.

Things that make you go hmmm...

softwaremaker — Wed, 20 Oct 2004 14:12:00 GMT

I had this wierd thought going through my head just now... If all the manufacturing processes of fruit-juice makers are as streamlined as we think or they should be (why should us consumers bear the costs of their inefficiencies ? ), then could I safely assume that the manufacturing processes to bottle up a 1-litre pack and a 2-litre pack are the same ? If they are, then how come the expiry dates are different by almost 1 month for the 1-litre and 2-litre packs of...(read more)

NICC and XMLOne Asia Usergroup: Certified Web Services Professional

softwaremaker — Tue, 19 Oct 2004 10:37:00 GMT

Finally, after months of hard work behind closed doors with members from the academia and technology camps, I am happy and proud to announce that the beta version of the the Certified Web Services Professional is ready.

This is a joint effort between National Infocomm Competency Center and XMLOne Asia Usergroup.

Together, with members from the Institutes of Higher Learning from Singapore, IBM, SUN and or course, I represent Microsoft, as recognized industrial subject experts on Web Services, we have managed to craft out, sift through and organize a set of testing and evaluation framework with regards to design, implementations, specifications, standards that we think Web Services Professionals, Specialists and Experts should know.

So far, responses from the beta pool of candidates have been that this is a tough certificate process to achieve BUT they think this is definitely what the industry needed. To put it crudely...separate the men from the boys . None of the IDE stuff found in Visual Studio .NET, BEA WebLogic, IBM Websphere, etc will be tested. Candidates will be grilled on innards and plumblings, on specifications and standards that Web Services Professionals, Specialists and Experts need to know.

As some people here will already know, I am a firm believer in XML Services and I believe that professionals need to know the plumbings beneath all the nice and productive BUT too idiot-proof click-throughs that the IDEs provide for XML Services to be sold and adopted in the enterprise space. I believe this will give the technology and its certification a shot in the arm it deserves. There are too many of XML Web Services fallacies and myths out there.

We are not asking for these Web Services Professionals, Specialists and Experts to know and memorize the entire specifications of the Web Services Stack. However, they, for example, may need to know the basic implementation differences between XML-Encryption and XML-Digital Signature instead of just knowing the concepts of it.

I will be speaking about the moving trends of XML Services and touch on the importance of this technology. Thereafter I will touch on the Body of Knowledge outlined in the Web Services Skills Certification Framework in which I will give some idea of the areas of focus in preparation for the certification.

If you are around in Singapore, you may want to be register for the event here.

Purpose

The purpose of this briefing is to provide insight to the Web Services Certification Framework and the certification programme developed jointly by NICC and XMLOne User Group. The certification process and the scope of the certification will be explained in this briefing.

Venue, Date and Time

IDA Multi-purpose Hall
8 Temasek Boulevard #14-00
Suntec Tower Three
29^th October 2004, From 2.30 To 5.00pm

Event Agenda

2.30 pm	Registration
3.00 pm	Web Services Certification Framework, Ms Lim Choon Heong, General Manager, National Infocomm Competency Centre An introduction to the Web Services Certification Framework which was initiated on 10 September 2003. Ms Lim will explain the motivation and objective of this certification programme.
3.10 pm	CWSP Certification Process, Mr Andy Tan, Vice-Chairman, XMLOne User Group Mr Tan will explain the certification process and the pre-requisites of the Certification programme. He will explain the 2 stages of Certification which consists of an Examination and Portfolio Evaluation. He will also present the analysis of previous Certification Examination result.
3.30 pm	CWSP Training Courses, Speakers from NetAssist, Software AG, Nanyang Polytechnic, New Horizons and ECS Computers Respective representatives from the training centers will introduce their course curriculum and provide information about the schedule of the courses to help candidates to prepare for the certification.
4.20 pm	CWSP Body of Knowledge, Mr William Tay, Senior Consultant & Software Architect, NCS. Pte. Ltd, Founding Member, XML Web Services Lead and Moderator, Singapore Professional DotNet Usergroup Mr Tay will provide a brief overview on the moving trends of Web Services in the horizons and touch on the importance of this technology and how its related standards will play a major role in the industrial and enterprise adoption of Web Services. Thereafter, he will explain the Body of Knowledge outlined in the Web Services Skills Certification Framework in which he gives some idea of the areas of focus in preparation for the certification.
4.45 pm	Questions & Answers
5.00 pm	Refreshment

Revised: 18 October 2004

Admission

Free, limited seats only

WS-Management: The not-so-usual players in a very-usual game of WS-* Specifications and Standards

softwaremaker — Tue, 12 Oct 2004 00:47:00 GMT

Web Services Management (WS-Management)

As always, Mr Brains-n-Brawn has and airs his opinions on WS-Idiots

softwaremaker — Sun, 10 Oct 2004 11:43:00 GMT

Casey Chesnut takes a swipe at WS-Idiots and airs it out here. This is in reference to an article here. As usual, it is hilarious and he always hits the nail right on the head.

It is beginning to be (or look) complex because the people and the businesses are asking for it. SOAP was made this way because the originators (can you say Don Box ?) knew that people and the businesses will ask for the complexity one day and SOAP will be able to cope with that.

For a comparision, just take a look at how CORBA and COM turned out.

In all fairness, the first word in SOAP is Simple and it really is. However, if the people and the businesses want more requirements on top of it to meet certain requirements, there is bound to be more overheads layered on top of bare message. As what Casey has mentioned,
"making XML look the way you want it to is about as simple as it gets."

It REALLY is that simple. The concepts and principles are the same. If I know how to add, the level of complexity of adding 1+1 and 1000+1000 is the same.

I am all for these new standards and specifications in the name of Adoption and Interoperability of Web Services in the enterprise. Specifications seemed more complex and thicker because more people and businesses and vendors are involved today than ever before. People and businesses also forget that standards and specifications are there for you to use, should you choose to implement, and not a must for you to implement. I mean, ultimately, it is your (and your service publishers and consumers) decision whether you want to transmit or receive a SOAP Message payload of 100KB when your envelope just contains "Hello World".

Unless you are a plumber like some of us, there is really no need for the average non-plumber to know and grok at the goo underneath it all. They just have to know that it works and can interoperate.

And if you make the wise decision to join us and become a plumber , you will be SO pleasantly surprised that after opening up the box, compared to distributed object technologies such as CORBA and COM, distributed document-exchange-oriented technologies such as XML Services is really nothing BUT just 1+1.

Continuing the talk on Indigo, WSE and WS-*...Why is it all about Interoperability ?

softwaremaker — Fri, 08 Oct 2004 01:32:00 GMT

With reference to my earlier blog here, Julie further expanded her views here with references to Benjamin's and Sam Gentile's blog posts as well.

Julie said and I quote,

[BEGINQUOTE]

Oh and there was one other thing I wanted to comment on which is the perspective that William (Softwaremaker) writes about in his post - about focusing on Interoperability. The funny thing for me is that I am not even LOOKING at interop. At the moment I don't happen to need it with the applications I am working on. I am not trying to learn this stuff so that I can do interop, rather because one of the side benefits of all of this work that everyone is doing with ws-* in order to make interop work more fluidly and efficiently is that we can also leverage these tools in our proprietary applications (hmm - what is the word for non-interop?). I've got .net on both ends of my pipe. I'm not interoping with myself or anyone else. I'm not disagreeing in any way with William as I have no experience in that space at all. I just find it intersting that the real purpose behind WSE and Indigo is for interop, hell the real purpose behind web services is interop, but these tools (well obviously not Indigo yet) are the most important players in my application architecture anyway.

[ENDQUOTE]

If the real purpose of XML Services (I dont like the use of the term Web Services here) is interoperability, then shouldnt the tools that implement the technology be for the same purpose as well ? I have often overheard a lot of conversations that goes like these:

A: “So, how do we communicate with the other application to transfer data...?”
B: “Well, why not we build a Web Service ?”

While I am NOT saying that this approach is wrong (and it will probably be this approach for a few years to come, sadly...), this is what I would always termed as the Silo way of approaching things as compared to a Service-Oriented approach. If you create an XML Service for the sake of a point-To-point integration, then you have just designed a Silo. There is no need to think about extensibility, publishing, discovery, routing and policy approach at all. Since you own both ends of the pipe, you would know what to send over, what to receive, where to find the service information, etc..., there is even no need for interoperability. You can create your own security headers and authenticaion to communicate and cut down the overheads of XML-Encryption and XML-Digital Signature. Yup...it would be proprietary BUT they would work because you own both ends of the pipe.

However, for SOA to make any business sense (and it has to or else how does Indigo, WSE and WS-* justify themselves ?), it really has to sell reusability. NOT code reusability, BUT Organizational and Process reusability. The efforts and resources put into Indigo, WSE and WS-* is not small, by any standards. If everyone knows they are going to own both ends of the pipe, why have those efforts then ? Why not continue using things that are tired, tested, proven and proprietary such as CORBA, COM+, DCOM, Remoting and such ? These technologies are great and did helped a lot (and still is...) in its heydays. However, it didnt solved the problem of interoperability (easily) and the whole world suddenly realizes that heterogeneity happens !

To maximize the reusability of services in every way, it has to be designed in such a way that it could be used in the intended way, by anyone, by any systems using an offline, out-of-band communication to convey the methods and schemas...and this is NOT easy by any chance...For eg. what is the best way to send a data container over so that everyone on any system can understand it easily. (-DataSet, xmldoc ? xmlelement ? or just xml ?)

Dont get me wrong. The RAD-Silo way of creating XML Services to communicate is NOT wrong. It is easy, it is there and it is going to be the way for a long time to come. However, you really dont need Indigo, WSE and WS-* to do any of those at all. In fact, those will give you tremendous overheads (and headaches ) to implement. Therefore the tradeoff is that I must be getting something that I cannot get with today's technologies to even think about justifying those overheads --- And that in one keyword is INTEROPERABILIY.

Chris Menegay does a Mission Impossible: Installing the VS Team System using VS2005B1R on VPC !!!

softwaremaker — Thu, 07 Oct 2004 08:00:00 GMT

See his awesome notes and tips documenting his success.

Jay Roxe, Product Manager of VB.NET is on the Singapore Leg of the VB.NET World Tour

softwaremaker — Thu, 07 Oct 2004 00:22:00 GMT

Jay Roxe spoke in Singapore today to MSDN Connection and Singapore Professional DotNet Usergroup (SgDotNet).

I will be having lunch with him together with a few other technology champions of Singapore. Jay loves his food here and he knows how to put “Makan Time” (Translates to “Chow Time”) on his MSN.

He should know. One of his first job is actually teaching at a Polytechnic right here in Singapore.

I will be hosting him tomorrow in NCS. Pte. Ltd where I have invited him to speak to our consultants, developers and engineers. It should be a fun event.

Jay will be heading off to the Airport going to Malaysia right after the NCS event where he will address the audience of Malaysian Independent Developers (MIND).

Jay will be heading back to the US this weekend. I understand that Julia Lerman is trying to get him to speak at the Vermont DotNet Usergroup as well in November. Hey Julia, if you are reading this, better book his time quick or else you may not be able to get him to speak . I believe he is feeling the weary effects of the VB.NET World Tour 2004 and that fatigue is beginning to hit him (or is it homesickness ?).

C'mon...13 stops in the Asia-Pacific Leg of the World Tour is hardly a walk in the park...

Embracing Indigo OR Is it Interoperability we should be embracing here

softwaremaker — Wed, 06 Oct 2004 14:48:00 GMT

Benjamin Mitchel has a good blog response to Stu's blog post.

In my comments to Benjamin, I echoed my thoughts that the industry should focus on Interoperability instead. The key points of most of my presentations on Indigo and WSE is usually lost on the audience, which is Interoperability and Heterogeneity.

[BEGINCOMMENT]
Like what Ballmer has said before and I echoed it here.

A lot of ppl dont give MSFT the credit it deserves for being a thought (and action) leader in the process of interoperability. Indigo, WSE and WS-I are major efforts in pushing and implementing them in the market.

It has been going on preaching heterogeneity and interoperability in recent times, unlike other vendors and their pitches.

Contrary to the initial thoughts of most people, I believe the birth of Indigo will NOT (just) get others onto their platform, it will force the industry to design interoperable solutions and frameworks.

Ultimately, business wins because everyone gets to keep their assets. There is bound to be some re-designing and factoring involved BUT the initial investments in current legacy platforms and systems should still be savaged to a certain extent.

SOA == Save Our Assets ?
[ENDCOMMENT]

In theory, you dont need Microsoft's WSE to talk to Microsoft's WSE or Indigo to talk to Indigo. However, until the rest of the market catches up (and I hope for the sake of the whole industry -- they will), it seems that people are going to focus on *-only technology as the focal point for some time.

Do you think the term “Proprietary-Interoperability” qualifies as an oxymoron ?

Contributing back to the Community: Paladin Workspace on GDN

softwaremaker — Sun, 03 Oct 2004 22:35:00 GMT

I have been subscribed to a few Open Source Software Projects on GotDotNet and SourceForge.NET. Plumbwork Orange, ShadowFax, DynWSLib and Paladin are some projects that have caught my attention for some time. However, I (am ashamed to say ) havent been able to contribute to these projects until now...

I have just contributed a sweet piece of encryption routine to Paladin, which happens to be owned by Firedancer, a .NET Microsoft MVP from neighbouring Malaysia. She has basically been bugging me for some voluntary effort [ADDED by Softwaremaker] to contribute some crypto expertise to her project. My routine uses a combination of SHA256-HashDigest, TripleDES and Base64Encoding to do some encryption work on the Connection String. I would also like to see the Object Persistence Framework of hers succeed and take off as well because she has put in an extraordinary tremendous amount of time and effort in Paladin.

Now that I have contributed some effort and codes to her project, I will have to be dog-fed Paladin pretty soon and hopefully can put it to some good use in some real-life projects.

Cover blown...

softwaremaker — Sun, 03 Oct 2004 03:04:00 GMT

They think they know, but do they ?

SPAM Mail has reached a different topic and dimension

softwaremaker — Fri, 01 Oct 2004 07:50:00 GMT

The level of my SPAM Mail is always going through cyclical highs and lows. There will be periods where I will receive a high level of SPAM concerning some product or activity. Then the mail filters caught on and got smart and I will go through another period where SPAM activity is hardly apparent. This will not take long before the spammers got smart and renamed PENIS to PE_N1S or something to that effect. So far, activities have been very much sexually-focused:

PE_N1S Enlarg3r
After the first activity, this second one focuses on how to make sure it stays that way for an elongated period
...for anyone @ any age
Lonely housewives
...who lives on a farm with farm animals
...for anyone @ any age
...

The one email that is not sexually related always seems to originate from Nigeria written by some blue-blooded person.

I just received one that broke all mail filters and curiosity (some of you may argue that its stupidity) got the better of me so I peeked inside:

Subject: [sic]...Submission...[sic] God...[sic]

The body follows with a pretty well-written message of the understanding of Islam, the Quran and other elements of the religion. After it spends almost 7-8 paragraphs extolling the virtues of the Islamic-God and the Quran, the last statement goes like this:

So, do reply back if you are interested in going to Jihad with us ...

I wonder what is next with SPAM. Maybe you can share some hilarious topics here.