.NET Megathread 3.5: await GetGoodPosts()

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > .NET Megathread 3.5: await GetGoodPosts()

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

Ghost of Reagan Past posted:

What are some Best Practices for building an API client library (I'm using C# if that matters)? I'm trying to build one for the Echo Nest and while the basic functionality is pretty straightforward, I don't know what the data should be really returned to the client as. If I was writing it in Python I'd probably just return it as a dictionary to let the user do what they want with it, but I gather that that's not the best practices for .NET. Should I set up an object to model an Echo Nest API response and then return that? If I do that, is there a sane way to return multiple objects, say, as a List? So, for instance, if I get the Echo Nest response for all Tom Petty songs, I'd want to return a single object for each song and let the client deal with them how they will, but I don't know what the sanest, best way to do that is.

Returning a dictionary or list is fine, I'd say, as long as you're returning lists of objects. Just just return lists or collections of arbitrary strings. You also don't want to return a Response object just as it's received from Echo Nest. Why should the client need to know or care about Echo Nest implementation details?

When I'm designing an API like this, I want to think about what is the API providing? Songs? Artists? Albums? and creating an object model around that. Then, the client shouldn't care about HOW you are getting these things. For instance, check out this class in a Spotify .NET client:

https://github.com/JohnnyCrazy/SpotifyAPI-NET/blob/master/SpotifyAPI/Web/SpotifyWebAPI.cs

The methods are returning types like "FullAlbum" etc.

# ¿ Oct 5, 2015 16:13

Adbot: ADBOT LOVES YOU

# ¿ May 21, 2024 02:36

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

Ithaqua posted:

Try to return collection interfaces, not collection implementations. Like IReadOnlyCollection or IDictionary. That will let me change the implementation later without impacting consumers.

Yeah, good point.

# ¿ Oct 5, 2015 16:22

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

SirViver posted:

Does anyone else experience VS 2015 randomly but insistently resetting the C# "Keep tabs" formatting option back to "Insert spaces"? It's driving me nuts

Can't say I've had that happen. Is it a problem with the vssettings file being corrupted or recreated or something?

# ¿ Oct 7, 2015 19:27

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

I can't wait for VS2015 Update 1... so many bugs right now.

# ¿ Oct 7, 2015 20:18

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

GrumpyDoctor posted:

If I have a NuGet package referenced in one project, can I really not add it as a reference of a different project in the same solution without an internet connection? (in VS2015)

e: Apparently I can't do it with an internet connection either, but it's ok, I can easily diagnose the problem with the helpful log messages NuGet has provided me:
code:
Attempting to gather dependencies information for package 'Newtonsoft.Json.5.0.8' with respect to project 'LibraryEditor', targeting '.NETFramework,Version=v4.5.2'
Package 'Newtonsoft.Json' is not found
========== Finished ==========

Why the flip did they remove the package cache options from the Options UI in 2015? And it also looks like they moved the package cache?

In 2012 and 2013 you could just add the package cache as a Nuget source and add packages from that when you were not connected to a network.

# ¿ Oct 12, 2015 18:25

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

EssOEss posted:

Problems like this are why I generally recommend using real IIS to host your app even in development mode. None of that IIS Express poo poo.

Especially when dealing with these COM components. Currently trying to get a project deployed to prod but keeps throwing up 500 errors all over but everything worked fine in dev and testing environments oh wait what is this COM garbage fjdsklafdksabvd

# ¿ Oct 15, 2015 21:26

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

Random IIS question: Is there any reason I would want to set the X-Frame-Options header (for clickjacking) at the site level as opposed for the entire server? I keep getting pushback from the sysadmins about setting this at the server level. (Part of the problem is that they don't know how to set headers for the entire server, but that's another issue that can be easily solved by point them at https://technet.microsoft.com/en-us/library/cc753133(v=ws.10).aspx)

# ¿ Oct 20, 2015 14:41

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

EssOEss posted:

It rather depends on the overall devops workflow and how such policies apply. On my deployments, each product/service is completely independent and I would be aghast at hearing of some server-global configuration being applied to my service. The only configuration I want to see applied is that which my dev team and my operations team explicitly and intentionally configure, and such decisions are always done on a per-site basis, as each site is an independent product/service.

Overall, server-level configuration is something I have never seen, except on some forums and blogs where it has always smelled to me. But, to play the devil's advocate, I can imagine it making sense if you have e.g. 200 customer blog websites on one server that you manage and you want to enforce proper security practices on all of them.

What exactly is your scenario about? Why do you want to apply this header? To what sort of sites?

This header needs to be applied to address issues that come up in Acunetix PCI compliance scans. Some of these sites are basically marketing sites, but some are B2B management portals for the products/services we offer. There are also a small handful of consumer-facing sites for managing their end of things. Probably about 15-20 sites total that this needs to be done for across 5 or 6 server environements (some load-balanced, some not).

# ¿ Oct 20, 2015 15:33

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

EssOEss posted:

Perhaps it might be interesting to turn this question on its head: what needs do you have that are not being met by UWP? I wonder how big the needs for non-UWP apps will be in 5 years (in the context of something that actually has a GUI - obviously services and such are relevant).

I can't really give more input regarding your actual question but having gone through implementing PCI compliance in the recent past, I can share some advice on the actual PCI aspect. The main thing to understand here is that being PCI DSS compliant is about following a process, it is not about builing "secure" software, for whatever definition of secure.

This means that as long as warnings such as this one are properly understood, the impact documented and the risk taken into account, all is well. To reiterate, PCI compliance is about having a process that can detect and, if the stakeholders consider it relevant, help prevent vulnerabilities. However, there is no requirement to always follow every secure coding guideline in the world. If clickjacking is considered an acceptable risk by the product owner, having non-clickjacking-proof software is just fine as far as PCI goes.

I say this because it seems to be a common fallacy to believe that PCI means nailing down every leak and closing all vulnerabilities but this is just not the case. Obviously, many PCI consultants and auditors like to give that sort of impression since it gives opportunities for good upselling of various services that might otherwise not really be needed. Thankfully, our auditors were a reasonable bunch who helped us understand the real story and did not try to give us the runaround.

Wise words. I think on this particular issue, the powers that be have decided NOT to risk except this, but your arguments about server-wide configuration being smelly and maybe an anti-pattern make me think I should just implement this on each site and call it good.

e: next problem on the list... I see a lot of conflicting reports for how SERVER_NAME is populated in IIS. I'm thinking of replacing HTTP_HOST with SERVER_NAME in some web.config rewrite rules in order to mitigate Host header attacks. But it seems like SERVER_NAME is dependent on doing a reverse DNS lookup for the server? Or some people think it just uses HTTP_HOST anyway? Or there is some way to set "host headers" in IIS to configure the value of SERVER_NAME? Anyone have experience with this?

Finster Dexter fucked around with this message at 15:36 on Oct 21, 2015

# ¿ Oct 21, 2015 15:07

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

chippy posted:

So, as I mentioned a few days ago I'm doing a website for someone with some quite specific security requirements. Specifically, as well as hashing passwords, he also wants email addresses hashed, and full names encrypted (all using his own hand-rolled algorithms, naturally). No personal details stored in plaintext, basically.

I don't know a huge amount about the built-in ASP.NET Identity stuff, so I'm currently doing some reading to try and work out if it's going to be possible to massage it into supporting this stuff. Is anyone else able to quickly tell me if it's going to be, or if I should give up and think about implementing all this poo poo manually (please god no)?

I don't think hashing that stuff is going to be all that hard to do in ASP.NEt Identity. Just write a custom UserStore that implements the interfaces you need and have some wrapper code around your persistent storage layer, etc. etc.

The part that makes me leary is when people "roll their own" encryption. Unless they REALLY know what they're doing, and I mean REALLY... i.e. have written papers on breaking encryption algorithms, I'm going to strongly recommend against using their own encryption/hashing algorithms.

# ¿ Dec 22, 2015 20:06

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

Ithaqua posted:

Yeah, web services are double legacy. They were eclipsed by WCF services which were eclipsed by WebAPI.

That depends on who you ask. The ongoing debate at my job here has been WCF vs. WebAPI, with pretty good arguments on either side. Basically, WCF still has a place where you can use NetTcpBinding or whatever. Honestly, it's moot as far as I'm concerned because I want exposure completely divorced from the service business logic, anyway, so that my WebAPI/WCF is just wrapped around a DLL.

# ¿ Jan 8, 2016 15:41

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

I've never seen that before.

What does your packages.config look like? Is Autofac.Mvc5 in there? (guess not if a solution wide search doesn't find it)

Is it in the packages directory for the solution?

Is your Nuget exe and tooling up to date for VS2012?

It sounds like something is cached or corrupted somewhere, though.

# ¿ Jan 8, 2016 22:45

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

epalm posted:

I keep running into the same ASP problem.

Generally my ASP solutions are structured like this:

FooAsp

FooCore

FooCore.Tests

FooCore is "The Application".

FooAsp is pretty thin, and depends on FooCore to get the real work done. If I wanted to, I could write other interfaces like FooConsole or FooWpf.

FooCore.Tests, as expected, depends on FooCore and runs my tests.

I want to take advantage of user management via the Identity framework, which does registration, login, password hashing, password resets, authorization via roles, authentication via cookies (mvc) and tokens (webapi), and more. I really, really don't want to write and maintain these things myself. However, the ApplicationUser class is sitting in a UserContext in FooAsp, and all my other entities are sitting in DataContext in FooCore.

Here's an example of the problem. Say I wanted to add a feature that sends users text messages based on events that occur in FooCore. I want to build a testable class in FooCore that interfaces with (for example) Twilio, with restrictions on how many messages per second it sends, logs who it has sent messages to, records failures, etc. FooCore doesn't know about FooAsp (ie doesn't know about ApplicationUser).

What I've done in the past is write my own User entity in FooCore that maps 1:1 with an ApplicationUser in FooAsp, but this is a pain to keep synchronized (and redundant to keep two user tables in literally the same database).

How can I deal with this properly?

Assuming that I understand this properly, you're going to have some kind of UserService in FooCore, right? ASP.NET Identity allows you to override all kinds of components. In cases similar to yours, in the past I've set up a UserStore in FooAsp that implements the features I want, and the UserStore methods call into the FooCore.UserService methods. Then you only have the one set of User entities. You can also configure ASP.NET Identity to work with arbitrary TUser types, but I think they have to extend IdentityUser.

But anyway, overriding UserStore seems to be the way to go in this scenario, unless I am missing something.

# ¿ Jan 12, 2016 18:55

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

I'm more than a little miffed that I have to deal with ads in Visual Studio.

https://blogs.msdn.microsoft.com/webdev/2016/01/12/visual-studio-keeps-showing-suggested-extensions/

quote:

In Visual Studio 2015 Update 1 we introduced a mechanism that would analyze a web project and suggest helpful Visual Studio extensions based on what it could find. For instance, if the project was using the Bootstrap CSS framework, it would suggest two very cool extensions specifically for working with Bootstrap.

http://blogs.msdn.com/b/visualstudioalm/archive/2015/11/18/announcing-public-preview-of-visual-studio-marketplace.aspx

quote:

We�re working on enabling commerce and publisher profiles in the future, which will make it hassle-free for publishers to monetize their extensions.

# ¿ Jan 21, 2016 19:56

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

For the love of pete, where the hell do I configure what value TFS 2013 uses for OutDir when it runs builds?

# ¿ Apr 27, 2016 15:54

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

Ithaqua posted:

Assuming a default process template, there's an "MSBuild Arguments" section under "Build -> Advanced". Overriding the outdir is going to probably screw some stuff up though, what do you actually want to do?

If you can upgrade to TFS 2015 and use the new build system, it's way, way better. XAML build is dead.

If I had my way we wouldn't even be using TFS Build. We already have a lot of Atlassian stuff, so I'd rather use Bamboo or even TeamCity would be better than this garbage fire.

But yeah, we just moved our TFS server to a new server and on the old server OutDir was set to go to d:\Builds and on the new server it's going to c:\Builds. On the new server it needs to go to d:\Builds again because IT said so.

# ¿ Apr 27, 2016 16:57

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

Ithaqua posted:

Just change the agent setting, no need to mess with outdir.

Where does one do that?

Note that no one will give me actual permissions to manage this poo poo, but it's apparently my responsibility to figure it out because no one else is willing to do it I guess.

# ¿ Apr 27, 2016 17:04

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

Ithaqua posted:

In VS, team explorer, builds tab: Actions -> Manage Build Controllers -> click agent, select properties. Working directory is configurable.

That's off the top of my head, might not be exactly that path.

Oh sure enough there we go. Okay got it squared away now. Thanks

I hope my request didn't poo poo up the thread too badly. Wasn't sure if there was a better thread.

# ¿ Apr 27, 2016 17:17

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

What's the best practice for setting the DbConfiguration for EF6 when you have multiple referenced projects that each connect to different data sources and defined their own DbConfiguration? What I'm seeing is that the DbConfiguration gets set for the entire app domain and one or the other data library blows up because it can't find that DbConfiguration implementation in its own assembly.

So far, the bulk of google/SO results have you effectively hard-coding the DbConfiguration in the app's config file. Then, I have to go across all of these dependency projects and remove the DbConfigurationType attributes from their DbContext classes.

Maybe the correct way to do this is that DbConfiguration extensions shouldn't be happening at the same layer as setting up the DbContext?

# ¿ Sep 14, 2016 17:11

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

chippy posted:

What's the best way to store fields that are just dates/times in EF? Use DateTime and just use the fields you want, or is there a better way?

If you don't care about timezones AT ALL (like AT ALL AT ALL) then use DateTime. Otherwise, I prefer DateTimeOffset. DateTimeOffset is way easier to work with when you need to handle any kind of timezone data.

Random dumb question about async/await:

I've been reading about ConfigureAwait(false) and seems like a lot of articles are all about "use it everywhere!" but after further digging, the best practice is actually to just don't block on async code.

Only problem is, I'm not even sure how I would block on async code. My guess is something like this:

code:

public Response GetResponse()
{
    return ResponseGetter.GetAsync().Result;
}

as opposed to awaiting like:

code:

public async Task<Response> GetResponse()
{
    return await ResponseGetter.GetAsync();
}

Which begs a follow-up question: How bad is it to do something like:

code:

public Task<Response> GetResponse()
{
    return ResponseGetter.GetAsync(); // this is awaitable
}

# ¿ May 3, 2017 17:07

Adbot: ADBOT LOVES YOU

# ¿ May 21, 2024 02:36

Finster Dexter: Oct 20, 2014; Beyond is Finster's mad vision of Earth transformed.

Quick question. Rider has a feature that does autocomplete from nuget.org for PackageReference versions when editing csproj files. Is there an extension for VS that provides the same thing?

# ¿ Feb 7, 2024 17:05

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > .NET Megathread 3.5: await GetGoodPosts()