I have gotten a lot of questions surrounding the use of certificates in ClickOnce. Here are the key facts to understand:

• You must sign your ClickOnce manifests with an Authenticode certificate. VS 2005 will do this for you when you publish an application.
• Authenticode certificates are not the same thing as an SSL certificate or an X509 client certificate used for authentication purposes, even though they are all based on the same technology.
• You can generate your own certificate using Visual Studio, or the makecert command line utility. In this case, you are both the publisher represented by the certificate and the certificate issuing authority. You will sometimes see this referred to as a self-signed certificate.
• A third party issued certificate (i.e. Verisign, Thawte) is the preferred approach. These companies are already configured in Windows as trusted root certificate authorities (CA), and because they are third party verified, there is an additional level of implied trust associated with them.
• If you are part of a large enterprise domain and you have a domain CA, that CA can issue you a publisher cert for your domain that you can use, and your publisher certificate can be pushed out to client machines through group policy or SMS.
• If user prompting is acceptable for elevating privileges (based on the permissions requested by the application in its manifest and the permissions that would be granted by code access security based on the launch URL), then there is no need to install any certificates on the client side.
• If you want to avoid user prompting, you need to install your publisher certificate in the Trusted Publishers store on the client machine.
• At runtime, certificate checks are only done against the local certificate stores on the client machine. Specifically, the certificate used to sign the manifests is checked for in the Trusted Publishers store, and the issuer of that certificate is checked for in the Trusted Root Certificate Authorities store.

If you want more information on configuring certificates and how they work at runtime, you should check out my article on MSDN Online:

http://www.msdn.microsoft.com/library/en-us/dnwinforms/html/clickoncetrustpub.asp

 

I've been using the Outlook version of Newsgator for a long time to aggregate the feeds that I care about. The problem is that the number of feeds that I care about continues to grow and grow, mainly because I will see a post or two of interest from someone on a topic I am focusing on, so I subscribe. Then after a while I discover that it was only a brief foray for that person into that area of interest and they become a stale subscription that I don't really pay that much attention to and eventually need to purge from my subscriptions.

So I was checking out some of the additional features that Newsgator online supports now through their business subscriptions, and decided to give them a try.

Smart Feeds Rock. I can create a subscription on a keyword (or keywords) or URL, and anytime someone out there in blog/chat/forum land uses that keyword, boing I get a post in my feed. Now I can set up smart feeds like one for ClickOnce or one for Indigo service, or Window Forms Data Binding 2.0, and keep track of everything people are saying about a technology. And yes, I must admit I set up an ego feed on my name to see what all you sneaky bastards are saying about me behind my back out there. :)

You do have to be a little smart about the keywords you pick. I started out with Indigo instead of Indigo service, and I got mostly stuff about the Indigo girls, art. etc. Add service to the keyword (it does an OR of the keywords unless you put them in quotes to get an exact phrase) and the noise went way down. There is still some noise, but much easier to filter through that noise than what hundreds of people may be posting on their individual blog at any given moment.

I still have my feeds to individuals who I like to follow, but I will be much less likely now to subscribe someone just because I found them talking about my technologies of interest. They will now have to break into my smart feeds repeatedly before I bother.

Depending on which subscription level you choose, you also get premium feeds, Mobile and Email editions, and varying numbers of feeds. I haven't fully started taking advantage of these yet, but probably will when I can find time to figure out how to employ them to add value and not just saturate me with more information that I don't have bandwidth to consume.

Roy and I had a great long interview/discussion on a myriad of .NET topics back a couple of months, and he has it all edited and posted now. You can find it here.

I gave my session on extending ASP.NET with custom handlers and modules at DevTeach in Montreal yesterday. If you attended or want the slides and demos, here you go:

Slides

Demos

I'm speaking this week at DevTeach, a nice little conference in Montreal Canada. Today I presented three sessions, two on ClickOnce and one on Data Binding in Windows Forms 2.0.

Here are the slides and demos:

ClickOnce:    Intro Slides   Security Slides   Demos

Data binding: Slides   Demos

In case you stumble and fall over this like I did, there is a bug in Beta 2 for configuring ClickOnce on-demand updates through the API. Normally if you wanted to support on-demand updates in a ClickOnce application, you would set it to not check for updates through the Updates settings in the Publish category of project properties in a Windows Forms project. You would then write code like the following in your application to support an on-demand update check (either programmatically or based on user request):

using System.Deployment.Application;

public partial class Form1 : Form

{

      private void OnDemandUpdate(object sender, EventArgs e)

     {

      if (!ApplicationDeployment.IsNetworkDeployed)

      {

         MessageBox.Show("This application deployment does not support network updates.");

          return;

      }

      ApplicationDeployment deployment = ApplicationDeployment.CurrentDeployment;

       Cursor currCursor = this.Cursor;

      this.Cursor = Cursors.WaitCursor;

      if (deployment.CheckForUpdate())

      {

         deployment.Update();

         this.Cursor = currCursor;

         DialogResult result = MessageBox.Show("Update Complete. Restart?", "ClickOnce On-Demand Update",
             MessageBoxButtons.YesNo);

         if (result == DialogResult.Yes)

        {

            Application.Restart();

         }

      }

      else

      {

         MessageBox.Show("No updates available");

      }

      this.Cursor = currCursor;

   }

However, if you did this in Beta 2, you get an exception when this code runs with an IllegalOperationException saying this application cannot be updated programmatically. The workaround in Beta 2 is to tell the app to check for updates, set it to do so after the application starts, and set the subscription period (how often to check for updates) to a long value, such as 50 weeks. Be careful, because another bug is that VS will let you set an illegally large value for this subsciption, such as 512 weeks. If you do so though, you will get a deployment error because ClickOnce will see a schema violation, and if you try to edit the manifest with MaGe, it will crash with an unhandled exception. This should all be fixed by RTM, but are things to be aware of if you are playing with ClickOnce now or especially if you will be going to production with an application that uses this capability.

 

Saurabh Pant has a good post summarizing the specific settings that go in your manifest for this here.

Here are the demos I gave in my TechEd session on Friday of last week. Sorry it took me a bit to get them posted. Call it post-conference-traumatic-stress-letdown-syndrome that made me go stupid.

Smart Client Offline Demos

This is pretty cool. Hopefully by now you have heard that Microsoft officially announced the release date for Visual Studio 2005 and SQL Server 2005 as 7 November. What you may not have noticed is that is the opening day of the DevConnections conference in Vegas. Well, if you were not sure whether you should come to this outstanding conference before, maybe this will change your mind: you will get a free fully licensed copy of Visual Studio 2005 and of SQL Server 2005. The specific versions they are going to give out has not yet been determined, but hopefully they will be generous and go with Pro/Standard at least. They will also have a live broadcast of the Microsoft launch event in San Francisco, at which either Bill Gates or Steve Balmer will be speaking.

And if you happen to come to the show, come check out the talks I'll be giving, which include:

- Connect Smart Client Applications with Indigo

- Build Event Driven Applications with Indigo

- Secure Smart Client ClickOnce Deployments

VB programmers have a pretty cool feature to wave in the faces of C# programmers in 2005 with the My feature... or do they? If you are not familiar with the My feature, it is a new keyword in VB2005 that you can type, and when you hit the . (dot) key, you will have instant access to a ton of common things such as the file system, user identity, network, and so on through some easy to use properties.

So VB has Me and My, why shouldn't C# have this and That? My colleague Juval has implemented a That class that exposes all the capabilities of My from VB to C# developers. It uses the same syntax and approach as My, just type That. and navigate through the object heirarchy to find the features that you want.

You can find the code for That on our downloads page at IDesign: http://www.idesign.net. Look for the link on the downloads page to "My for C# 2.0", or you can grab it here.

All My (and That) do is give you shortcut access to the most common features that people code against. Ultimately, you can achieve the same thing by finding the appropriate class in the .NET framework and invoking its functionality. But My (and now That) make it a lot quicker and easier to code up common scenarios.

In case you are a hard core C# guy who thinks this is just a joke and are thinking that there is no point, consider if you find some VB 2005 code in a sample that does what you want, but they are making extensive use of the My feature. How do you port that code to C#? Without the That class, you will have to rewrite anything that is using My. With the That class, you can just migrate it directly with little to no syntax conversion. The same would be true if you were going to migrate a complex VB 2005 app to C#.

Obviously since That is kind of a play on words, and we provide you the source code, you could change That to My and have the same name for the class as in VB. But That kind of has a nice ring to it. :)

Hats off to Juval for throwing this together in the wee hours

I just got back from Holland Thursday after speaking at SDC there, and now I am in Orlando to speak at TechEd. These things are nothing but fun, but man, the travel can get crazy.

I had a great time last night joining in with the crowd at the Party with Palermo, which evolved from a loosely organized geek dinner into a great gathering of speakers, RDs, MVPs, and attendees in the Peabody hotel restaurant and bar. Today there are a collection of overlapping events that I plan to try to attend portions of, including some MVP events, the INETA summit, and some of the pre-con sessions.

The rest of the week is already pretty packed. My breakout session is not until Friday, but I have a bunch of other things I am participating in / presenting as well:

Tuesday 7 Jun:

3:15-6:15 PM- proctoring Juval Lowy's Instructor Led Lab (ILL) on Generics (DEV20/DEV20R)

9:00 - 10:00 PM - Preparing for Indigo Birds of a Feather (BoF) given by Juval

Wednesday 8 June:

8:30 AM-11:30 AM- proctoring Michele Leroux Bustamante's ILL on Iterators (DEV23/DEV23R)

7:00-11:00 PM Influencer Party

9:00-10:00PM Leading BoF session on Smart Client Deployment (BOF051)

Thursday 9 June:

3:15 - 6:15 PM - Giving System.Transactions ILL (DEV 22/22R)

Friday 10 June:

10:15 AM -12:00 PM - Answering Q&A questions through LiveMeeting for Juval Lowy's Simulcast session Being More Productive with the .NET Framework (DEV325)

1:00 - 2:15 PM - Presenting CLI440 Smart Client Offline Data Caching and Synchronization

 

Those are just the items that warrant an unchallenged block on my calendar. There are a ton of other events mixed in there as well to keep the week packed. I also need to get some more work done on my book this week getting the second half of the book up to date with Beta 2 and ready for Tech review, and also want to try to blog a few technical posts about stuff I am working on. Hmm, when is thattime expansion device going to be on the market??

UPDATE: I just realized the link that I refer to is not in here. Here it is:

http://www.microsoft.com/downloads/details.aspx?FamilyID=06616212-0356-46A0-8DA2-EEBC53A68034&displaylang=en

I was informed by my friends Richard Campbell and Steve Forte the other day in Holland at SDC that Northwind will not ship with SQL Server 2005. I was a little bummed, because I have used it for a lot of the samples in my book because I was told by certain contacts at Microsoft that it would ship with 2005, and I wanted to maintain backwards compatibility with folks who have not migrated to SQL Server 2005 yet (I think Whidbey adoption will be much faster in development shops than SQL Server 2005 for licensing reasons).

Well, just in case this is a surprise to you to, and you want to be able to add Northwind to SQL Server 2005 after you install it, here is a link to the sample DBs (Northwind and Pubs) as scripts that should work fine with 2005 as well.