Scott Hanselman's Blog

They WILL take your photos and they WILL use them and you WILL like it.

Scott Hanselman — Wed, 19 Jun 2013 05:51:33 GMT

This is hardly a tragic story and it's not even a good photo, but it's interesting because it happens a few times a year. Perhaps it's happened to you! (Share in the comments)

A buddy noticed a story in Business Insider Australia that was picked up off Reuters called "Microsoft says they've disrupted a global cybercrime ring responsible for $500 Million Theft." It was syndicated to OZ by Business Insider US who pulled it from Reuters, and it seems they each pick their own illustrative picture.

And apparently they did it in my damn office. That's my big head, my three monitors and I am, in fact, hacking on CoffeeScript in this picture, not fighting cybercrime. How do I know? Because I was there when this photo was taken by Rob Conery. We used it for my Speaking Hacks educational video.

Rob Conery and I made a video called Speaking Hacks...here's a screen capture.

It got used on a post a CoderWall.com where I describe my system setup. I love that they crop the pictures they so carefully Google Image Search for.

I try to use search.creativecommons.org for my image searches on this blog. Raphael Rivera turned me on to this and reminded me of the importance of respecting image copyright. Just googling for a picture and slapping it on your blog isn't cool.

Usually when this kind of thing happens I'll just email a kind note to the owner of the site and mention it and it gets handled. (I've just emailed Business Insider now) Most people are very nice. Folks at Gizmodo and LifeHacker almost always have a real human behind their stories with a real Twitter account and they've always been accommodating about little things.

Ah, but sometimes it's not just a nameless-faceless newspaper but it's a nameless-faceless newspaper article originally published by Reuters on "put on the wire" which means it can spread literally everywhere, and fast.

Do I care? Not really, but it's the principle of the thing. I mention it because it's a teachable moment for us all.

When you put an image on the Internet, it's on the Internet.

It can be used for anything, anytime, by anyone. You can assert copyright, but usually depending on how big the site is (or how obtuse their Contact Us page is) you'll be lucky to find a human, much less a nice one.

At least I have my hair. So far.

Think about signing that Photo Release

I try to use search.creativecommons.org for my image searches on this blog. Raphael Rivera turned me on to this and reminded me of the importance of respecting image copyright. Just googling for a picture and slapping it on your blog isn't cool.

It matters to me when it's big and public and involves my kids. Some friends were driving down the freeway recently and noticed something. They called and said "Is that your son on a billboard off I-5?"

This was my reaction: O_o

Turns out that years ago in our school's day care we signed a photo release. I assume we thought it was for their blog, or a pamphlet, but in retrospect even that was a bad idea. We never thought my kid would end up on a 30 foot paper billboard advertisement, with little recourse. Fortunately in the billboard case, the head of the school wasn't aware either! Their marketing folks were just pulling the photos from a shared folder, treating them as stock images. In the end, the school was extremely accommodating and apologetic and it's since been handled. Still, a wake up call to us, and I hope, to you, Dear Reader.

Happy Resolution

This email showed up literally as I was/am writing this post.

Hi Scott

Thanks for getting in touch. I’m the editor at Business Insider Australia.

I’ve removed that image, which was syndicated from the US edition. I’ve also alerted them to your complaint.
http://au.businessinsider.com/microsoft-cybercrime-500-million-theft-2013-6

Hope this addresses the matter for you.
Best wishes,
Paul

Awesome. And sometimes your kind letter reaches a kind human and gets handled. Thanks Paul, much respect!

Now, about this NEW picture...;)

(Yes, I realize the thick irony of me blogging it, and thereby putting the image "back out there" but it's for educational purposes.)

Exclusive Sneak Peek: The AGENT Smart Watch Emulator and managed .NET code on my wrist!

Scott Hanselman — Tue, 18 Jun 2013 17:40:27 GMT

I'm totally geeked out about Smart Watches. I always have been, from the original Microsoft SPOT watch (from 10 years ago!) to the Pebble, and now the AGENT Smart Watch from Secret Labs. Secret Labs are the folks that brought us the Netduino open source electronics platform that uses the .NET Micro Framework. It's pretty awesome that you can write C# and run it in 64k or in 64gigs, from the wrist to the cloud.

Upcoming Conference: If you're in or around Chicago in July 2013, consider joining Chris Walker from SecretLabs and I at the MonkeySpace conference! We'll be speaking about developing for embedded systems and the AGENT Watch with C#. What are the power considerations? How low-level is this kind of coding? Can one kind of app cause battery drain while another keeps the watch going for a week? What about notifications and bluetooth? We'll cover all this and lots more, join us.

The AGENT Smart Watch was trying to raise $100k to build a watch and as of the time of this writing they are within spitting distance of a MILLION dollars! There's just hours to go to get in on this cool Kickstarter. (Remember, Kickstarter is an investment, not a store.)

Not only is this a .NET Microframework Device, but we can start writing apps now using the AGENT Watch Emulator. From their Kickstarter site:

Traditional smartwatches run apps in an unrestricted environment. AGENT's OS includes a managed runtime, optimized for our low-power architecture. It is called the .NET Micro Framework and it makes watch apps trustable.
This feature-rich managed runtime also offers developers modern features they crave: event-based programming; multi-threading; garbage collection; lambda expressions; exception handling; automatic power management; and much more.

You can install VS2012 and the .NET Micro Framework 4.3 and write an app for your wrist! I alluded to this a little in my Xamarin talk "How C# Saved My Marriage." You can write .NET apps for embedded systems, a watch, tablets, desktops, web sites, large cloud systems and more.

Full disclosure: I have no financial stake or business relationship with SecretLabs, but we are friends and I'm a fan. I helped Chris with some copy writing on the Kickstarter page, it's text and reviewing the video as a favor. I have received no money from SecretLabs and I backed the Kickstarter with my own money.

I got a preview of the AGENT Smart Watch emulator, and some code from Kickstarter backer Esben Bast who created a binary clock face. I loaded up VS2012 and the binary clock emulator. This initial code is just about 100 lines. You can see the references in Solution Explorer here. SPOT means "Smart Personal Object Technlogy."

The fact that there is an emulator is huge. No worries about breaking a watch or even having a watch! The Agent Watch SDK puts a reference to the AGENT Emulator in my registry, so it shows up directly in Visual Studio:

Then I can debug my watch app without a watch, just as if I were writing a Phone App or Web Site. It's a first class experience inside of VS. This makes me feel particularly empowered as a .NET developer because it means I already know how to write apps for this watch and I've never even seen it before..

The code is pretty straightforward, if appropriately low-level. This IS a small device we're talking about!

You've got total control over the screen and what can be displayed. You could create any watch face that you could imagine (that would fit on the screen) because you have a Bitmap to draw to.

The .NET Micro Framework has no fonts loaded by default, but I can include them as resources. There's some "tinyfnt" files in C:\Program Files (x86)\Microsoft .NET Micro Framework\v4.3\Fonts or I could download or make some myself. Even better I can use the TinyFontTool from Miloush.

I can load a font from a resource like this:

font = Resources.GetFont(Resources.FontResources.small);

and then later in my UpdateTime() method, Draw the time on my binary clock screen.

_bitmap.DrawText(DateTime.Now.ToString("HH:mm:ss"), font, Color.White, 45, 15);

Run my emulator again and I have the time printed as well!

The only real "microframework-ism" in the code is that the watch face doesn't want to use a lot of power, so you should "go to sleep." It's the same as if you were writing a console app. If your main() function ends, then your app will end! But, since this is a watch face, we want it to run all the time, so, we start a 1 second timer, then sleep the main() forever. Everything interesting happens as an event on a background thread. (The watch can control the lifetime and tombstone or kill the watch face if you're doing other things.)

public static void Main()

{

    _bitmap = new Bitmap(Bitmap.MaxWidth, Bitmap.MaxHeight);

    _font = Resources.GetFont(Resources.FontResources.small);



    // display the time immediately

    UpdateTime(null);



    // set up timer to refresh time every minute

    DateTime currentTime = DateTime.Now;

    TimeSpan dueTime = new TimeSpan(0); // beginning of next minute

    TimeSpan period = new TimeSpan(0, 0, 0, 1, 0); // update time every minute

    _updateClockTimer = new Timer(UpdateTime, null, dueTime, period); // start our minute timer



    _button = new InterruptPort(HardwareProvider.HwProvider.GetButtonPins(Button.VK_SELECT), 

        false, 

        Port.ResistorMode.PullDown, 

        Port.InterruptMode.InterruptEdgeBoth);

    _button.OnInterrupt += _button_OnInterrupt;

    // go to sleep; time updates will happen automatically every minute    

    Thread.Sleep(Timeout.Infinite);

}

That last part is interesting. You've got two event handlers here, the one to UpdateTime every second and then one to watch for the Button getting pressed. You want the watch app to be event-driven...it needs to do as ~~little as possible~~ NOTHING until it's time to do something. This InterruptPort is watching for the the middle button (the VK_SELECT button). ResisterMode.PullDown means the button will show "1" or true when it's pressed. InterruptEdgeBoth means I get events when the button is pressed AND when it goes up.

Go make Watch Apps!

Here's another cool watch face from Dylan Mazurek next to the Big Digits example:

And finally, here's an animated concept for a World Time face that Steve Bulgin made for Pete Brown as well as another Steve concept below:

The next step will be more than watch faces, it will be watch utilities and apps. Maybe an app for my FitBit, or an app to manage Blood Sugar? Perhaps a Nest app to control my thermostat?

The AGENT Watch Emulator emulator will be available to download this Thursday at www.agentwatches.com. You can get ready by installing the .NET Micro Framework today.

Watch apps can be written in C# using Microsoft Visual Studio 2012 (including the free Express edition). Deploy your apps over Bluetooth and debug them interactively.

Download Visual Studio Express 2012
Download .NET Micro Framework SDK v4.3
Developers can also use AGENT as a secondary display, interacting with it remotely via Bluetooth from their Objective-C, C#, or Java smartphone app.

Even though the watch ships in December, I'm going to start writing apps now so I'm ready for the Watch App Store (coming soon)!

Stop Doing Internet Wrong.

Scott Hanselman — Fri, 14 Jun 2013 00:14:19 GMT

Some days...some days it's frustrating to be on the web. We're compiling C++ into JavaScript and running Unreal in the browser but at the same time, here in 2013, we're still making the same mistakes. And by we, I mean, the set of web developers who aren't us, right Dear Reader? Because surely you're not doing any of these things. ;)

All of these are solvable problems. They aren't technically hard, or even technically interesting. I consider these "will-required" problems. You need the knowledge that it's wrong and the will to fix it. As users - and web developers - we need to complain to the right people and help fix it.

Redirecting a deep desktop link to a mobile home page

Google has decided that the practice of taking perfectly good deep links like foo.com/something/deep, detecting a mobile device, then redirecting to m.foo.com is user-hostile. In fact, the GoogleBot is going to declare these "faulty redirects" and ding sites in the search result ranking. Stated simply:

Avoiding irrelevant redirects is very easy: Simply redirect smartphone users from a desktop page to its equivalent smartphone-optimized page. If the content doesn't exist in a smartphone-friendly format, showing the desktop content is better than redirecting to an irrelevant page.

For example, if I want to go to the http://www.mcmenamins.com/Pubs page, but I do it on mobile, they ALWAYS redirect me to /mobile. Always. Even though I have a quad-processor pocket supercomputer with gigs of space I've still surfing a second-class internet.

I don't want your crappy app

That means you Quora. I am in my browser, unless I'm going to the App Store, let's assume if I'm in the browser, I want to be on the web.

Giant Interstitial Ads

I'm looking at you, Forbes.com. I GET IT. YOU HAVE ADS.

Stay classy.

Labels for Input Forms

I hate seeing a checkbox and only being able to click on that exact checkbox.

<p>Which fruit would you like for lunch?</p>

<form>

  <input type="radio" name="fruit" id="banana" />

  <label for="banana">Banana</label>

  <input type="radio" name="fruit" id="None" />

  <label for="none">None</label>

</form>

It's so easy to just associate a label with an input. Please do it, then we can all have something larger to click on.

Breaking Hyperlinks

We're still doing this. Haven't we learned that Cool URIs Don't Change? It was true in 1998 when that was written and it's true now. The web as we know it was created in 1990 and made truly open in 1993 and the link to the First Web Page (yes, Capital Letters) is still http://info.cern.ch/hypertext/WWW/TheProject.html. I love that they've done the work to keep that link alive.

There's just no excuse for this. With .htaccess files and web.config files, maintain a list of redirects and do your best to test them. Maintaining deep and complex links can be complex, but if you're companyname.com/about link dies because you switch from PHP to Rails, there's just no excuse for that. I'm your User and I have always typed /about. Don't' give me a To Do like "Update your bookmarks!" I didn't come here for a To-Do, I came her for your damn about page. YOU figure it out.

Click the Flag that represents your Language

I've often been asked to "select my language" from a list of country flags, and ended up clicking on the Union Jack to represent "English." I'm sure the actual English don't appreciate an American declaring they speak English. ;)

but I know I'm not the only one who realizes that a Flag is a lousy representation of a language, especially since your browser is announcing what languages you speak with every web request.

Accept:text/html

Accept-Encoding:gzip,deflate,sdch

Accept-Language:en-US,en;q=0.8

There can be a whole list of languages in the Accept-Language header, in the order the user prefers them! Use that data, it's there for you to use.

You know my Zip Code, why am I entering my State?

For folks living in the states, we're always asked to enter our postal code (ZIP code) and our city and state, even though there are dozens of great APIs and Databases that can give you that information.

The meta-point is this: If you can reliably determine something from the user (language, location, country, preference) without invading their privacy, do it! Save them a little time!

Resizing Giant Images with width and height attributes

Perhaps take a moment and remind your boss that the 6 megapixel photo that he or she took with their new Canon EOS is not a good background image for your corporate site...especially if it's a 4 megabyte JPGs.

Oh, that's OK, we can just <img src="bigassfile.jpg" width="100" height="100"> and that will make it smaller. No, that just downloads the giant file and then makes your browser to the work to resize it on the client.

Resize first, and squish often. Also run all your PNGs through PNGGauntlet or PNGOut.

Serving pages from both www. and naked domains

If you've got example.com/something AND www.example.com/something both serving up the same content, consider "canonicalizing" your URLs. You can do this with rel="canonical" in your META tags, but that only hides the problems and makes the Googlebot happy. Instead, why not PICK ONE and serve a 301 redirect to the other? Did you know that there are rules built into IIS7 that will set this up for you? You can even remove your .aspx extension if that makes you happy. You can do it!

The same is true if you do the same thing for / and /default.html. Pick one if you can, and redirect the other.

<system.webServer>

    <rewrite>

      <rules>

        <rule name="CanonicalHostNameRule1" stopProcessing="true">

          <match url="(.*)" />

          <conditions>

            <add input="{HTTP_HOST}" matchType="Pattern" pattern="^hanselman\.com$" ignoreCase="true" negate="false" />

          </conditions>

          <action type="Redirect" url="http://www.hanselman.com/{R:1}" redirectType="Found" />

        </rule>

          <match url="blog/default.aspx" />

          <action type="Redirect" url="blog/" redirectType="Found" />

        </rule>

      <rules>

   <rewrite>

<system.webServer>

Others?

What are some great examples that you think Break The Internet...but that are easily fixed if we have the will?

Sponsor: Big thanks to RedGate for sponsoring the feed this week! Check out Deployment Manager – app deployment without the stress. Deploy .NET code & SQL Server databases in one simple processfrom a web-based UI. Works with local, remote and cloud servers. Try it free.

The Importance of Closed Captioning - How To and Why Subtitle

Scott Hanselman — Wed, 12 Jun 2013 01:11:54 GMT

If you can hear well, you may have never thought about Closed Captioning or Subtitles. Perhaps you've used it once or twice to catch a missed word in a movie, or perhaps you've only read subtitles in foreign movies. But if you're one of the nearly 10M hard of hearing folks in the US or one of as many (estimates vary widely) 70M profoundly deaf people in the world, it's not the subtitles you're concerned with...it's the lack of subtitles.

Automatic transcriptions are a start, but they are about as useful as automatic translation services. If you speak more than one language you'll agree that computer translation just isn't quite here yet. It's awesome that YouTube can attempt to auto-transcript English and it's an amazing piece of tech, but the results are sometimes ridiculous for any video content that isn't a news reader. Ultimately, today, automatic transcriptions are NOT a good answer.

Here's an example of some automatic captions from my 3 minute Windows 8 video:

Hanselminutes, my "fresh air for developers" podcast has long had transcripts available. Our transcription has been championed by Carl Franklin, my producer, and it IS appreciated. When a show is missed or we lag behind, people notice. You can head to our archives page, and the search supports a live-filter with an * as I've marked all transcript shows with an asterisk.

Transcripts aren't just for the hard of hearing, they are also great for folks who are learning English or people who would rather learn by reading than by listening. Not everyone has an hour to listen to a show, but they can check out the transcripts and decide if they want to bother. It also helps for SEO by allowing keywords in your podcast or video to be picked up by Google, Bing and other search engines. Often people at work want to watch a YouTube video without the volume on.

Hiring a Transcription Service

Transcribing isn't as easy as you'd think. People talk WAY faster than the average typist. Feel feel to try transcribing the news or a podcast yourself. You'll quickly find that it's hard damn work. The service that I use the most,with success, has been Rev.com. They used to be called FoxTranscribe and changed their name.

Ordering is easy, you can upload files or just paste in URLs. I recently had them transcribe my Productivity Talk by just giving them the Vimeo link.

Recently Rev transcribed both of my Windows 8 videos! Having good closed captioning is super important with YouTube videos, and people who are looking for subtitles are REALLY happy when they find good ones.

You can turn on Closed Captioning for YouTube videos as a permanent setting as well.

Go to your Account Settings page
Select Playback from the left-hand menu
Check or uncheck Always show captions
(Check Show automatic captions by speech recognition (when available) to enable automatic captions for videos that don't already have captions provided)

YouTube lets you add captions in a few ways.

Upload a Caption File and Auto-Sync

This is the easiest thing to do because it doesn't include time stamps. YouTube knows what video you're trying to caption so it can make educated guesses as to what words line up where. Time moves forward, so the guesses are usually VERY good if your transcript is a good one. That's what Rev.com provided me.

Here's the first section of what Rev.com gave me for the 25 minute Windows 8 Video:

Scott>> Hi. I'm Scott Hanselman. This is the Missing Windows 8 Instructional Video. I've got another video where I show you basically everything I'm going to show you in this video, except I do it in only four minutes. That might be great for techies or people who are kind of advanced. But for the rest of us, it's pretty intense and it looks a little frantic. I thought it would take some time to go through a number of things within Windows 8, like “What changed?”, “Who moved my cheese?”

See the double >> mark? That's where you indicate who is talking. And that's it! It's worked great and I'm thrilled with the result.

Upload a Caption File with Timestamps

If your video has fast cuts, lots of speakers or needs more precision, you'll want to make a a formal caption file in one of a variety of formats. A .srt file is what I see the most, but there's a number of options.

Here's a .srt example from Google:

1
00:00:00,599 --> 00:00:04,160
>> ALICE: Hi, my name is Alice Miller and this is John Brown
2
00:00:04,160 --> 00:00:06,770
>> JOHN: and we're the owners of Miller Bakery.

These files should be created by a captioning software package, in my opinion.

Regardless of how you create it, once the file is uploaded to YouTube, it works just as it should and can be turned on and off by the user.

Crowd Sourcing Transcripts

You may also be able to Crowd Source your transcripts. That's what I'm trying with This Developer's Life, the other podcast that I do with Rob Conery.

Yes, we are working on the next episode. I promise. The theme is "Space" by the way. Coming soon.

Since we have a primarily technical developer audience, I chose to use GitHub to manage things. It's very open, collaborative and clean...for a programmer. We're using Mark Down files and I hope to generate HTML and link to them directly from the This Developer's Life site. You're more than welcome to get involved and help out. There are still transcripts that need help! Check out https://github.com/shanselman/ThisDevelopersLife-Transcripts

We've just received the complete transcript from the TDL episode where my wife and I talk about our Cancer Year. That one is currently here and the actual episode is still on the TDL site.

We used a more casual layout, but I think the result will be easy to read.

Scott: What happened yesterday, dear?
Mo: Yesterday, I was told that I have cervical cancer.
S: That sucks.
M: Yeah. That REALLY sucks. [Silence] Yeah. It does. It does. Yeah.
S: We spent most of yesterday surprisingly not crying and wailing or gnashing our teeth... but rather with quite a bit of black humor. Wouldn't you say?
M: [Laughing] Yeah, I would. I would say that. But I think what is still true is that it’s a pretty heavy thing to hear. What was particularly frustrating in our case was how we found out about it. It was just not the way that one should ever find out that you have cancer. I don’t care what kind that it is.
S: It was definitely, as I like to say, sub-optimal.
M: Sub-optimal is a very delicate way of putting it. Yes, it was sub-optimal.

I REALLY appreciate all the love that the community has given Rob and I on This Developer's Life. It's a labor of love, it takes hours and hours to make an episode and I hope you know that we are still having fun making it. We thank YOU for helping with the captions! As they get closer to being done, I'll update the site and make them easier to find.

Collaborative Subtitling Systems

There is a great online community and series of tools called Amara that is explicitly for enabling captions for media. You can order transcription services outright, but you can also crowdsource your captions directly from the tool. If you're using YouTube you can give them access to your account via OAuth and they'll update your video's captions automatically. You can volunteer and transcript videos yourself and be a part of the crowd and make someone's video more accessible!

There are also some startups in the space like EnhanceCast and 3PlayMedia that you should also take a look at.

Regardless of what you choose, I really encourage you to consider captioning your content. We're working on doing this for ASP.NET videos now as well.

If you appreciate closed captioning and subtitles, please sound off in the comments!

CSI: Visual Studio - Unable to translate Unicode character at index X to specified code page

Scott Hanselman — Sat, 08 Jun 2013 00:30:07 GMT

A customer emailed me a weird one. I tend to have a sense for when something is up and when an obscure thing will turn into something interesting.

The person says:

...mysteriously most of my projects refuse to build. "The build stopped unexpectedly because of an internal failure... something about unicode... blah blah"

There are a few messages out there on the web about it -- even a really old hot fix. What's the best way to proceed with the VS team / MS? Is there anyone actively interested in glitches like this?

My spidey-sense is tingling. First, when something says "internal failure" it means some fundamental expectation wasn't met. Garbage in perhaps? He says "most of my projects" which implies it's not a specific project. There's also the sense that this is a "suddenly things stopped working" type thing. Presumably it worked before.

I say:

"Have you checked all the source files to make sure one isn't filled with Unicode nulls or something?"

And says no, but sends a call-stack (which is always nice when it's sent FIRST, but still):

Error    1    The build stopped unexpectedly because of an internal failure.

System.Text.EncoderFallbackException: Unable to translate Unicode character \uD97C at index 1321 to specified code page.

   at System.Text.EncoderExceptionFallbackBuffer.Fallback(Char charUnknown, Int32 index)

   at System.Text.EncoderFallbackBuffer.InternalFallback(Char ch, Char*& chars)

   at System.Text.UTF8Encoding.GetByteCount(Char* chars, Int32 count, EncoderNLS baseEncoder)

   at System.Text.UTF8Encoding.GetByteCount(String chars)

   at System.IO.BinaryWriter.Write(String value)

   at Microsoft.Build.BackEnd.NodePacketTranslator.NodePacketWriteTranslator.TranslateDictionary(Dictionary`2& dictionary, IEqualityComparer`1 comparer)

   at Microsoft.Build.Execution.BuildParameters.Microsoft.Build.BackEnd.INodePacketTranslatable.Translate(INodePacketTranslator translator)

   at Microsoft.Build.BackEnd.NodePacketTranslator.NodePacketWriteTranslator.Translate[T](T& value, NodePacketValueFactory`1 factory)

   at Microsoft.Build.BackEnd.NodeConfiguration.Translate(INodePacketTranslator translator)

   at Microsoft.Build.BackEnd.NodeProviderOutOfProcBase.NodeContext.SendData(INodePacket packet)

   ...

OK, so it doesn't like a character. But a character in WHAT? Well, we'd assume a source file, but it's important to remember that there's other pieces of input to a compiler like path names, environment variables, commands passed to the compiler as switches, etc.

It says Index 1321 which seems pretty far into a string before it gets mad. I asked a few people inside and Sara Joiner says:

It looks like the only place in BuildParameters that we call TranslateDictionary is when transferring the state of the environment [variables] across the wire.

Ah, so this is splitting up name-value pairs that are the environment variables! David Kean says "ask him what his PATH looks like." I ask and I get almost 2000 bytes of PATH! It's a HUGE path, it looks like it may even have been duplicated and appended to itself a few times.

Here's just a bit of the PATH in question. See anything?

\;C:\PROGRA~1\DISKEE~1\DISKEE~1\;C:\Program Files (x86)\Windows Kits\8.0\Windows

Performance Toolkit\;C:\Program Files\Microsoft SQL

Server\110\Tools\Binn\;C:\Program Files\Microsoft\Web Platform

Installer\;C:\Program Files\TortoiseSVN\binVN\???p??;C:\Program

Files\TortoiseSVN\bin;C:\PHP\;C:\progra~1\NVIDIA

Corporation\PhysX\Common;C:\progra~2\Common Files\Microsoft Shared\Windows

Live;C:\progra~1\Common Files\Microsoft Shared\Windows

Live;C:\q\w32;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;

C:\Windows\System32\WindowsPowerShell\v1.0\;C:\progra~2\WIDCOMM\Bluetooth

Software\;C:\progra~2\WIDCOMM\Bluetooth

See those ??? marks? That doesn't feel like question marks to me. I open the result of "SET > env.txt" as a binary file in Visual Studio and it looks like it's 3Fs, which are ? marks.

This makes me think that there's unicode goo in the PATH that was converted to ANSI with it was piped. Phrased differently, this text file isn't reality.

However, elsewhere in the Windows UI his PATH variable looks like different.

C:\Program Files\TortoiseSVN\binVN\�侱ᤣp䥠؉;

Sometimes that corruption in the path looks like this and you might assume it's Chinese. No, it's corruption that's getting interpreted as Unicode. Interestingly the error said the naughty character was 0xD97C which is &#0xD97C; � which implies to me that something got stripped out at some point in processing and turned into the Unicode equivalent of 'uh...' Regardless, it's wrong and it needs to be removed.

I ask him if cleaning his PATH worked and the customer just send me a one line response via email...the best kind of response:

========== Build: 12 succeeded, 0 failed, 0 up-to-date, 0 skipped ==========

Yay! I hope this helps the next person who goes aGoogling for the answer and thought they were alone. Thanks to David Kean, Sara Joiner and Srinivas Nadimpalli for looking at the call stack and guessing at solutions with me!

Any insights, Dear Reader?

Sponsor: Big thanks to RedGate for sponsoring the feed this week! Check out Deployment Manager – app deployment without the stress. Deploy .NET code & SQL Server databases in one simple process from a web-based UI. Works with local, remote and cloud servers. Try it free.

How to delete Open or Insecure Wi-Fi HotSpots from Windows 8: Wifi.exe Command Line Utility with Source

Scott Hanselman — Thu, 06 Jun 2013 23:28:52 GMT

For the most part I'm happy with Windows 8 but one feature was removed that makes no sense to me - the wireless networks dialog.

Sure, you can "Forget this network" by right clicking on a Wi-Fi Connection, but only when that network is in range. The old Wireless Networks dialog where you could add and remove networks is gone. Who knows how many saved Wi-Fi hotspot profile I have littering my system?

So, The Problem: I want to remove saved Wi-Fi Profiles whenever I feel like it. I wrote a command line util that will work in Windows 7 and Windows 8.

TL;DR Version

There's a build zipped up of Wifi.exe available here and the source is on GitHub.

UPDATE: I've put Wifi-Manager up on Chocolately so you can now "cinst wifi-manager." Thanks to Brendan Forster for the heavy lifting! Learn more about the Chocolatey package manager here!

Caveats and "Ya I know."

First, let me be clear that I have written a command line utility to replace another command line utility. I get it. I knew it when I did it. Others smarter than I have done similar things and written utilities that match their way of thinking rather than learning an unintuitive syntax. Don't hate the playa, hate the Regular Expression.

Aside: This is also a problem with my iPhone. I likely have 50+ saved Wi-Fi spots on my phone and no way to delete them without jail-breaking.

You can access Wi-Fi profiles with the netsh.exe that comes with Windows, so you could list out profiles like this:

c:\>netsh wlan show profiles



Profiles on interface Wi-Fi:



User profiles

-------------

    All User Profile     : Wayport_Access

    All User Profile     : HANSELMAN

    All User Profile     : HANSELMAN-N

    All User Profile     : HanselSpot

    All User Profile     : EliteWifi

    All User Profile     : Qdoba Free Wifi

Then, for each one, call

c:\>netsh wlan show profile "Qdoba Free Wifi"



Profile Qdoba Free Wifi on interface Wi-Fi:

=======================================================================



Profile information

-------------------

    Version                : 1

    Type                   : Wireless LAN

    Name                   : Qdoba Free Wifi

    Control options        :

        Connection mode    : Connect manually



Connectivity settings

---------------------

    Number of SSIDs        : 1

    SSID name              : "Qdoba Free Wifi"

    Network type           : Infrastructure

For each of these profiles, check if they are secure or open, and if you are connecting manually or automatically. Then, if you wanted, you could netsh wlan delete profile name="Qdoba Free Wifi" and remove a profile, even when it's not near you.

In my recent podcast with security expert Troy Hunt, he pointed out that it's easy to create a fake honeypot Wi-Fi spot that has the same name as a common open network, like Starbucks, for example.

Given: If my PC or phone is set up to automatically connect to any open hotspot named "Starbucks" then it will just connect to one...even an evil hotspot.
Therefore: it would be nice to automatically delete profiles for Wi-Fi spots that are both open (no security) and set to automatically connect.

I was tired, so I thought I'd bang out a little utility to do this. I could have used PowerShell or something but I felt like using C#. It's exercise.

UPDATE: Lee Holmes went and wrote it in PowerShell! Amazing.

Wifi.exe and it's Usage

Tired of reading? There's a build zipped up of Wifi.exe available here and the source is on GitHub. You may need to Right Click | Properties | Unblock the zip.

There's no warranty. The code sucks and I'm a horrible person and you're running a util you found on my blog. However, it works awesome on my machine. Issues appreciated, tidy PRs appreciated more, running Resharper and doing a PR, less so. I'll update the build if good bugs require it.

If you run Wifi.exe (I put it in my path) you'll see something like this:

c:\>wifi

AP-guest                 manual    WPA2PSK

HANSELMAN-N                auto    WPA2PSK

HANSELMAN                  auto    WPA2PSK

HanselSpot                 auto    WPA2PSK

Qdoba Free Wifi          manual       open

Wayport_Access             auto       open Warning: AUTO connect to OPEN WiFi



Delete WiFi profiles that are OPEN *and* AUTO connect? [y/n]

n

Notice the columns, and the prompt. There's a warning when a hotspot is both open and set to auto-connect. If you answer Y to the prompt, the utility will delete that profile. You can also type 'wifi /deleteautoopen' to bypass the prompt and auto-delete just profiles that are auto and open.

A pull request a few minutes after I pushed this code also added the ability to

wifi delete "HOTSPOTNAME"

which is nice also. Thanks!

The Code

One of the great things about writing command line apps like this is that there's literally a dozen ways to do everything. They are trivial and silly but also useful and used daily. In this case I've got command line argument processing to think about, parsing output from a spawned process, doing the parsing in a clean way, making sure it works on a non-English machine (which I thought about but didn't test), as well as cleaning up of generated temp files.

It's hardly impressive code, but some of it was fun or interesting. Here's a few bits I liked.

Making Columns with Console.WriteLine and String.Format

Did you know that you can right- and left-align columns within a fixed with using String.Format? Few people know about this and I've seen whole libraries written custom to do the work that's built right in.

Console.WriteLine(String.Format("{0,-20} {1,10} {2,10} {3,30} ", a.Name, a.ConnectionMode, a.Authentication, warning));

Note the {0,-20} (left aligned) and the {1,10} (right aligned). Those are just like {0} and {1} in a String.Format but they include alignment and width.

Gratuitous use of Linq

It wouldn't be a silly utility without in crazy LINQ, eh? Who needs Regular Expressions when you can when you can do a SQL query over your string? ;) Actually, I don't know if this is a good thing or not. It was fun, though, and it works. Your thoughts?

This takes the output from wlan show profiles (seen above) and parses it into a list of just the AP Names. I think it should work in any language, assuming the : colons are there.

string result = ExecuteNetSh("wlan show profiles");

var listOfProfiles = from line in result.Split(new string[] { "\r\n" }, StringSplitOptions.RemoveEmptyEntries)

                     where line.Contains(":")

                     let l = line

                     where l.Last() != ':'

                     select l.Split(':')[1].Trim();



foreach (string profile in listOfProfiles)

    ExecuteNetSh(String.Format("wlan export profile \"{0}\" folder=\"{1}\"", profile, Environment.CurrentDirectory));

Cleaning up the temp XML files

I export a bunch of very specific XML files with a VERY non-specific extension. I can't control their file name and I don't want guess what their name is because I would need to recreate their AP Name encoding scheme. Instead, I look for any XML files in the current folder (given the rare chance that YOU, the utility runner, have XML files in the same folder already) and only delete the ones with the namespace that I know to be present in Wi-Fi profiles. I patted myself on the back for this one, but just lightly.

static XNamespace ns = "http://www.microsoft.com/networking/WLAN/profile/v1";

    

//Delete the exported profiles we made, making sure they are what we think they are! 

foreach (string file in Directory.EnumerateFiles(Environment.CurrentDirectory, "*.xml"))

    if (XElement.Load(file).Name.Namespace == ns)

        File.Delete(file);

Capturing Command Line Output

Finally, here's how you get the output of a command line process you started:

Process p = new Process();

p.StartInfo.FileName = "netsh.exe";

p.StartInfo.Arguments = arguments ?? String.Empty;

p.StartInfo.UseShellExecute = false;

p.StartInfo.RedirectStandardOutput = true;

p.Start();



string output = p.StandardOutput.ReadToEnd();

return output;

Pretty basic, but useful to bookmark.

Alternatives

After I wrote this I noticed there are some WinForms utilities to do this. That's great. I wouldn't mind making may own, except I'd want it to look exactly like the Windows 7 dialog. It'd be fun just to see if I could get it pixel perfect.

Feel free to go check out the code, play with it and make fun of me. https://github.com/shanselman/Windows-Wifi-Manager

Get Involved! Check out my latest production with TekPub. A meticulously edited TWO HOURS of video content where we cover everything we think a developer should know to "Get Involved" in the developer community.

Announcing "Get Involved" from Tekpub - Enhance your career by engaging with your peers

Scott Hanselman — Thu, 06 Jun 2013 21:33:12 GMT

Get Involved - The Video

My friend Rob Conery and I work on the This Developer's Life podcast together. You should check it out, we work well together. Last year we created a Technical Speaking Tips Video and launched http://speakinghacks.com on Rob's TekPub site.

Since then I've done a little more moonlighting on the side with Rob and release not just The Art of Speaking but also done other episodes with Rob including a regular show called "The Source" where we explore the source of popular open source frameworks. Again, you get all of this with a yearly or monthly subscription.

Today we're launched our most ambitious project yet. A meticulously edited episode that's almost TWO HOURS of video content where we cover everything we think a developer should know to "Get Involved" in the developer community.

Announcing "Get Involved"

If you're a fan of This Developer's Life you know how tightly we like to produce things - this video is no exception. Filmed on the streets of Portland and at a Portland user group, we talk about Blogging, Twitter, Github, StackOverflow, Open Source, Speaking, User Groups and Conferences - all of this hoping to make you a happier, more productive, more connected developer. We want to inspire you and perhaps to take your career to the next level.

Additionally, we stretched far beyond Portland to seek out the other people who are very active and well known in the social arena like Jon Skeet and Jeff Atwood:

Jeff Atwood and I talk about blogging, writing, and "working your voice free" so people who read your posts hear you loud and clear.
Jon Skeet joins us to talk about what a Good Question is on StackOverflow - and also how you can gain reputation by providing Good Answers - and edits to Good Questions!
We venture out to the Portland Area DotNet Users Group (PADNUG) and meet a few developers who have just started going - as well as people who have been there for years.
While we were there, I gave a 10-minute lightning talk on Azure - a great way to get started speaking if you're not a fan of public speaking. Rob filmed the whole thing.

We put an immense amount of work into this production and I really think you'll enjoy it. You can buy it "ala carte" or as with all Tekpub productions you can get a one year subscription and get access to everything on Tekpub including this video, my speaking video, my show The Source as well as my episodes of Full Throttle with Rob PLUS dozens of other videos on new tech like Backbone, Async C# 5.0 with Jon Skeet, ASP.NET MVC with Sam Saffron, RavenDB with Ayende Rahien, Mastering jQuery, and on and on.

I hope you enjoy this show. We poured our hearts into it.

P.S. Here's a 10% discount coupon if you only want the video alone: KQWFCJUE0SPO

Blocking Image Hotlinking, Leeching and Evil Sploggers with IIS Url Rewrite

Scott Hanselman — Mon, 03 Jun 2013 19:25:14 GMT

I recently discovered that a blog called (seriously) "Google Chrome Browser" was reblogging my site. (It of course has NO relationship to Google or the lovely folks on the Chrome team.)

This is a splog or "spam blog." It's less of a blog and more of a 'suck your feed in and reblog it.' Basically every post is duplicated or sucked in via RSS from somewhere else. I get this many times a week and have for years.

However, this particular site started showing up ahead of mine in searches and that's not cool.

Worse yet, they have almost 25k followers on Twitter. I've asked them a few times to stop doing this, but this time I got tired of it.

They're even 'hotlinking' my images, which means that all my PNGs are still hosted on my site. When you visit their site, the text is from my RSS but I pay for the images bandwidth. The irony of this is thick. Not to mention my copyright notice is intact on their site. ;)

When an image is linked to from another domain the HTTP_REFERER header is populated with the location that the image is linked from. That means when my web server gets a request for 'foo.png' from the Google Chrome Browser blog I can see the page that asked for that image.

For example:

Request URL:http://www.hanselman.com/blog/content/binary/Windows-Live-Writer/How-to-run-a-Virtual-Conference-for-10_E53C/image_5.png

Request Method:GET

Referer:http://google-chrome-browser.com/penny-pinching-cloud-how-run-two-day-virtual-conference-10

Because this differentiates the GET request that means I can do something about it. This brings up a few important things to remember in general about the web that I feel a lot of programmers forget about:

The Internet is not a black box.
You can do something about it.

That said, I want to detect these requests and serve a different image.

If I was using Apache and had an .htaccess file, I might do this:

RewriteCond %{HTTP:Referer} ^.*http://(?:www\.)?computersblogsexample.info.*$

RewriteHeader Referer: .* damn\.spammers



RewriteCond %{HTTP:Referer} ^.*http://(?:www\.)?google-chrome-browser.*$

RewriteHeader Referer: .* damn\.spammers



#make more of these for each evil spammer



RewriteCond %{HTTP:Referer} ^.*damn\.spammers.*$

RewriteRule ^.*\.(?:gif|jpg|png)$ /images/splog.png [NC,L]

Since I'm using IIS, I'll do similar rewrites in my web.config. I could do a whitelist where I only allow hotlinking from a few places, or a blacklist where I only block a few folks. Here's a blacklist.

<system.webServer>

  <rewrite>

    <rules>

      <rule name="Blacklist block" stopProcessing="true">

          <match url="(?:jpg|jpeg|png|gif|bmp)$" />

          <conditions>

              <add input="{HTTP_REFERER}" pattern="^https?://(.+?)/.*$" />

              <add input="{DomainsBlackList:{C:1}}" pattern="^block$" />

              <add input="{REQUEST_FILENAME}" pattern="splog.png" negate="true" />

          </conditions>

          <action type="Redirect" url="http://www.hanselman.com/images/splog.png" appendQueryString="false" redirectType="Temporary"/>

      </rule>

    </rules>

    <rewriteMaps>

              <rewriteMap name="DomainsBlackList" defaultValue="allow">

                  <add key="google-chrome-browser.com" value="block" />

                  <add key="www.verybadguy.com" value="block" />

                  <add key="www.superbadguy.com" value="block" />

              </rewriteMap>

    </rewriteMaps>

  </rewrite>

</system.webServer>

I could have just made a single rule and put this bad domain in it but it would have only worked for one domain, so instead my buddy Ruslan suggested that I make a rewritemap and refer to it from the rule. This way I can add more domains to block as the evil spreads.

It was important to exclude the splog.png file that I am going to redirect the bad guy to, otherwise I'll get into a redirect loop where I redirect requests for the splog.png back to itself!

The result is effective. If you visit their site, I'll issue an HTTP 307 (Moved Temporarily) and then you'll see my splog.png image everywhere that they've hotlinked my image.

If you wanted to change the blacklist to a white list, you'd reverse the values of allow and block in the rewrite map:

<rewriteMaps>

    <rewriteMap name="DomainsBlackList" defaultValue="block"> 

        <add key="google-chrome-browser.com" value="allow" />

        <add key="www.verybadguy.com" value="allow" /> 

        <add key="www.superbadguy.com" value="allow" />

    </rewriteMap>  

</rewriteMaps>

Nice, simple and clean. I don't plan on playing "whac a mole" with sploggers as it's a losing game, but I will bring down the ban-hammer on particularly obnoxious examples of content theft, especially when they mess with my Google Juice.

Hanselman's Newsletter of Wonderful Things: May 13th, 2013

Scott Hanselman — Mon, 03 Jun 2013 17:04:25 GMT

I have a "whenever I get around to doing it" Newsletter of Wonderful Things. Why a newsletter? I dunno. It seems more personal somehow. Fight me.

You can view all the previous newsletters here. You can sign up here Newsletter of Wonderful Things or just wait and get them later on the blog, which hopefully you have subscribed to. Email folks get it first!

Here's the newsletter that I sent out May 13th.

Hi Interfriends,

Thanks again for signing up for this experiment. Here's some interesting things I've come upon this week. If you forwarded this (or if it was forwarded to you) a reminder: You can sign up at http://hanselman.com/newsletter and the archive of all previous Newsletters is here.

Remember, you get the newsletter here first. This one will be posted to the blog as an archive in a few weeks.

Tony Stark is the new Captain America, they say.
I bought a Pebble Watch. I think smartwatches are finally going to happen.
Fascinating writup by John Carmack of Doom fame about porting Wolfenstein 3D to the iPhone.
f.lux free software will change the color temperature of your monitor to match the ambiant light and time of day based on your location and the season. What is this sorcery?
This guy is dancing on a treadmill.
Should you feel guilty when you over-sleep? Here's one person who says no, and explains why.
What does economic inequality look like when charted against transit lines in the Bay Area?
Potentially amazing 2D drawing API for JavaScript called two.js.
It's all about the lighting, not your camera.
This video of a dude's 90 year old grandma trying a VR helmet has sold me on it. TAKE MY MONEY.
Here's a lovely monospaced font called Mensch that looks good for coding.
Are you watching Scandal? It's must-Tweet TV.
Why do Animated Gifs work like they do?
Speaking of Gifs, did you know you can make a gif with more than 256 colors? Each frame of an animation can be a different 256!
It's been 10 years since "Star Wars Kid" went viral. Is he OK?

Scott Hanselman

(BTW, since you *love* email you can subscribe to my blog via email here: http://feeds.hanselman.com/ScottHanselman DO IT!)

P.P.S. You know you can forward this to your friends, right?

Is the Windows user ready for apt-get?

Scott Hanselman — Tue, 28 May 2013 08:16:12 GMT

What it does

Chocolatey lets you install Windows applications quickly from the command line via a central catalog of installation scripts. You could install Git, 7Zip or even Microsoft Office (given a key.) The idea is seamless and quiet installations using a well-known key.

For example, once installed you can do this from and command line:

cinst git
cinst 7zip
cinst ruby
cinst vlc

That's basically it.

The catalog has grown so complete, in fact, that I recently wanted to install DosBox so I could play Zork. I took and chance and just "cinst dosbox" and it worked. THAT is a the promise that Chocolatey makes.

Getting Started with Chocolatey

You can get started by first installing the Chocolatey package manager. Copy paste this line to your command line and run it. (More on the fearfulness of this first step in a moment).

@powershell -NoProfile -ExecutionPolicy unrestricted -Command "iex ((new-object net.webclient).DownloadString('https://chocolatey.org/install.ps1'))" && SET PATH=%PATH%;%systemdrive%\chocolatey\bin

Presumably you like to know what command line stuff is going to do to your computer before you do it, so parse this line out. It's going to launch PowerShell to do the hard work. Nearly every Windows machine has PowerShell these days, and it's PowerShell that makes Chocolatey work.

Some folks have custom profiles so the -NoProfile switch suppresses custom profiles to prevent conflicts during installation. It launches a chunk of PowerShell script that it downloads from https://chocolatey.org/install.ps1/ then executes. Note that it's setting execution policy to unrestricted to do this. To be clear, it's executing code downloaded over the web, so there is a non-zero risk there. It then adds Chocolatey to your path (for this one prompt) so you can use it immediately. It'll be added to future instances of prompts automatically.

Look at https://chocolatey.org/install.ps1 now. It's a very clean and easy to read script. It downloads the Chocolatey installation zip file (which is actually a NuGet package), unzips it and continues the installation by running a scripts in the tools section of the package.

How it works

Chocolatey is a bootstrapper that uses PowerShell scripts and the NuGet packaging format to install apps for you. NuGet is the package management system that Windows Developers use to bring libraries down at the project level. Chocolatey (get it? Chocolatey Nu-Get?) extends that concept to bring applications down at the system level.

Today if you want to get 7Zip, you usually google for it, find the site, figure out the latest version or right version for your system, download it, run it, next next next finish and maybe add it to your path. Chocolatey does that for you.

Again, NuGet is libraries installed locally for projects, Chocolatey is applications installed globally for your whole system.

Chocolatey uses PowerShell scripts (that you never have to think about) that package developers use to chain installations and build dependency trees. Take the internals of a Git installation script for example:

try {

  Install-ChocolateyPackage 'git.install' 'exe' '/VERYSILENT' 'http://msysgit.googlecode.com/files/Git-1.8.1.2-preview20130201.exe'



  #------- ADDITIONAL SETUP -------#

  $is64bit = (Get-WmiObject Win32_Processor).AddressWidth -eq 64

  $programFiles = $env:programfiles

  if ($is64bit) {$programFiles = ${env:ProgramFiles(x86)}}

  $gitPath = Join-Path $programFiles 'Git\cmd'



  Install-ChocolateyPath $gitPath 'user'



@"



Making GIT core.autocrlf false

"@ | Write-Host



  #make GIT core.autocrlf false

  & "$env:comspec" '/c git config --global core.autocrlf false'



  Write-ChocolateySuccess 'git.install'

} catch {

  Write-ChocolateyFailure 'git.install' $($_.Exception.Message)

  throw

}

The most important part for you to take away here is the first line. Note that this Chocolatey script is downloading Git from the mSysGit Site. Chocolatey is not changing installers, making installers or hosting installers. It's automating the boring parts of getting software, but it's still getting that software from the same location as always.

Advanced Stuff

Once you learn the basics - and they're pretty basic - there's more depth to Chocolatey to explore. Beyond the cinst and cuninst there's other commands to make installing stuff on Windows easier. Remember, they're all in your PATH so you can call these commands anytime.

Each of these major sources can be called with cinst using the -source parameter like "cinst IISExpress - source WebPI" or using their own aliases for simplicity as shown below.

cwindowsfeatures - If you've ever opened Add/Remove programs then click Install Windows Features in order to setup IIS or Hyper-V then this command is for you. Some examples:
- cwindowsfeatures IIS-WebServerRole
- cwindowsfeatures Microsoft-Hyper-V-All
- cwindowsfeatures TelnetClient
  - Plus, you can always clist -source windowsfeatures for the complete list.
cwebpi - The Web Platform Installer is a great GUI for downloading any development tools you might need for Web Development on Windows. It's a catalog, an installer, and a chainer. There's also a command-line version of WebPI that Chocolatey integrates with so you can:
- cwebpi IISExpress
- cwebpi VWDOrVs11AzurePack_2_0
  - And again, clist -source webpi gets you a list of what you can do.

There's a more complete list at the Chocolatey Commands Reference including how it integrates with Cygwin, Gems and Python.

Security Issues

This is a prickly one. How do you make a system that lets you install anything directly from the Internet quickly, cleanly, and easily without, well, installing something evil directly from the Internet? You'll want the communication with the server to be secure and the packages trusted, but you'll also want to make sure the packages haven't been tampered with since they were uploaded. There's the inevitable threat of a man-in-the-middle attack. You'll want to watch for malicious packages and enable quick takedowns if one sneaks by.

Security concerns aren't unique to Chocolatey, of course. They are a part of package repositories since their inception. The node npm repository had a security breach in March of 2012, and the folks at andyet explored the issues surrounding it, but also pointed out that personal responsibility has to have a role as well.

Linux's apt-get solves much of this with appropriate uses of cryptography and best practices that can (and should) be emulated. Packages in apt repos are signed with SecureApp, there are warnings if you're using a 3rd party repo or installing an unsigned package.

The Chocolatey team has been very quick to jump on security issues and they are very approachable. They've added SSL where appropriate and are aware of the work to come. If Chocolatey gets big (bandwidth and costs is a question in my mind) perhaps a non-profit organization would step in to help with not only costs, but also security audits and best practices.

Here's some points (edited for length by me) from a post from Chocolatey's lead, Rob in a post on their mailing list, also in march of 2012:

Security has a big future aspect of chocolatey. At the present I am the curator and I every day I get an email showing me all of the new packages that went in the day before. I look at all packages from new authors and I typically look at the first version of most new packages from authors I have good contacts with.

I've talked at length with others about having a moderated feed in the aspect of every package, every new version would be approved prior to showing up on the main feed. I am paying attention to how debian does things with multiple feeds and there are thoughts to move in that direction as well.

Security? In the future we are looking at a small group of folks be an approving body for nupkgs. We also talked about showing the hash for the nupkg, and possibly letting folks specify a hash for the installers so chocolatey can verify the things it downloads prior to execution.

Could I make a Chocolatey package called "FormatMyHardDrive?" Sure I could, just like I could ask you to open an admin prompt and format c: /q, but you won't, right? ;)

What's next?

Chocolatey is clearly not meant to be used by your "Gender Non-Specific Non-Technical Parent" and it does have some "competition" in the form of the Ninite GUI installation utility. While still not for the average Joe/Jane and having only a limited catalog, Ninite does fill a gap for the super-user to quickly get the common apps and utilities they want.

Additionally, is Chocolatey really apt-get? It's not installing libraries system-wide, although there's no reason it couldn't. Other open source projects like CoApp would like to be the Windows app-get although CoApp is more of a "system-wide libraries, C++ support, and Unix-like utilities" and Chocolatey is more of a "developer and poweruser utilities and their dependencies."

Chocolatey does install dependencies and you can see that happen yourself by trying out "cinst gitextensions" which itself has a dependency on git. Chocolatey will walk the graph and install what it needs before finally installing gitextensions.

Where Chocolatey, and ultimately Windows itself, falls down is with odd PATHing and install locations. Because Windows doesn't have formal install locations for things and because Chocolatey puts itself first in the PATH, it's possible to get one's self into odd situations where apps that were installed outside of Chocolatey don't line up with apps installed inside. For example, I installed Git with Chocolatey some months ago, then forgot about that version and installed a newer version of Git on my own. However, I kept hitting an old git bug because the Chocolatey version of Git was "first." I believe issues like this have changed with recent builds of Chocolatey, but the point remains: it's hard on Windows today to who installed what low-level utility, when, and where it ended up.

Branding

Now, by no means to I want to take away from the hard work done by Rob and the team, but (and I've said this to Rob before) I really have trouble getting past the name Chocolatey. Sure, there are two ways to spell "Chocolaty," which make it hard at least for me to type "Chocolatey" reliably. The -ey is a theoretically a valid variant spelling, but you can tell that that to the red squiggled underline in Word. But it's less the spelling and more the name itself. It lacks the nerdiness of an "npm," the gravitas of an "apt-get," or the poetic terseness of a "gem." I realize that we are living in a world with companies called Hulu, Yahoo, Microsoft (seriously, MICRO SOFT, what is that?) and Google, but it's worth pointing out that a good name can really take a project to the next level. I'm not sure Chocolatey is the right name for this project, but that's 100% my opinion.

I encourage you, technical reader, to check out Chocolatey for yourself! It's a powerful tool, an engaged and growing community and an interesting piece of tech in its own right.

Is Chocolatey the apt-get Windows users have been waiting for? Sound off in the comments.

Sponsor: Big thanks to SoftFluent for sponsoring the feed this week! Check out their slick code generation tools: Less Plumbing, More Productivity! Generate rock-solid foundations for your .NET applications from Visual Studio and focus on what matters!