<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: declarative]]></title>
    <link>http://securityratty.com/tag/declarative</link>
    <description></description>
    <pubDate>Fri, 18 Jan 2008 02:08:20 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Null Strings in ASP.NET Declarative DataSource Updates]]></title>
      <link>http://securityratty.com/article/11f8906732a7b86831292456d642b2f5</link>
      <guid>http://securityratty.com/article/11f8906732a7b86831292456d642b2f5</guid>
      <description><![CDATA[I just spent about 15 minutes debugging a problem where a document was getting unexpected nulls where empty strings should have been. Indeed controls like the TextBox have code in them that allows you...]]></description>
      <content:encoded><![CDATA[<p>I just spent about 15 minutes debugging a problem where a document was getting unexpected nulls where empty strings should have been. Indeed controls like the TextBox have code in them that allows you to set the Text property to null and the TextBox will convert that into an empty string. So it&#39;s a bit counterintuitive that <em>the declarative data source works the opposite way by default</em>.</p> <p>When you use a declarative data source to perform a parameterized update that contains string parameters, consider setting ConvertEmptyStringToNull=&#39;false&#39; on your &lt;asp:Parameter&gt; elements, because <em>it&#39;s true by default</em>! In other words, if a text field contains an empty string, it&#39;ll be sent to your declarative data source not as string.Empty, but as null.</p> <p>Now I don&#39;t know about you, but I don&#39;t like dealing with nulls if I can avoid it. Especially strings. Unless there&#39;s a clear need to have a null state, I avoid them like the plague not only in my database designs but also in my XML schema designs. Hopefully this helps somebody out!</p><div style="clear:both;"></div><img src="http://www.pluralsight.com/community/aggbug.aspx?PostID=52773" width="1" height="1">]]></content:encoded>
      <pubDate>Fri, 29 Aug 2008 11:42:47 +0000</pubDate>
      <category domain="http://securityratty.com/tag/strings">strings</category>
      <category domain="http://securityratty.com/tag/declarative data source">declarative data source</category>
      <category domain="http://securityratty.com/tag/empty strings">empty strings</category>
      <category domain="http://securityratty.com/tag/null">null</category>
      <category domain="http://securityratty.com/tag/empty">empty</category>
      <category domain="http://securityratty.com/tag/xml schema designs">xml schema designs</category>
      <category domain="http://securityratty.com/tag/textbox">textbox</category>
      <category domain="http://securityratty.com/tag/text property">text property</category>
      <category domain="http://securityratty.com/tag/nulls">nulls</category>
      <source url="http://www.pluralsight.com/community/blogs/keith/archive/2008/08/29/null-strings-in-asp-net-declarative-datasource-updates.aspx">Null Strings in ASP.NET Declarative DataSource Updates</source>
    </item>
    <item>
      <title><![CDATA[EPTS: Proposed Event Processing Definitions, September 20, 2006]]></title>
      <link>http://securityratty.com/article/c90d53785950324b36b55747a92766da</link>
      <guid>http://securityratty.com/article/c90d53785950324b36b55747a92766da</guid>
      <description><![CDATA[For interested readers, here are the event processing definitions we provided to the (future) EPTS working group on September 20, 2006, coordinated (edited)by David Luckham and Roy Schulte
adaptive...]]></description>
      <content:encoded><![CDATA[<p>For interested readers, here are the <a href="http://www.thecepblog.com/pdf/EVENT.PROCESSING.DRAFT.GLOSSARY.V4.SEPT.pdf" target="_blank">event processing definitions</a> we provided to the (future) EPTS working group on September 20, 2006, <a href="http://complexevents.com/?p=195" target="_blank">coordinated (edited) by David Luckham and Roy Schulte</a>;</p>
<p><strong>adaptive process management</strong> (n.) an element of resource and business process management, adaptive search and event processing. Sometimes referred to as “Level 4” event processing or process refinement.</p>
<p><strong>application concept</strong> (n.) a definition of a set of properties that represent the data fields of an application entity. An application concept can describe relationships among themselves. For example, an order concept might have a parent/child relationship with an item concept. A department concept might be related to a purchase requisition concept based on the shared property, department_id. Application concepts can include an application state model.</p>
<p><strong>application state modeler</strong> (n.) a UML-compliant application that allows you to model the life cycle of a concept instance — that is, for each instance of a given concept, you can define which states it will pass through and how it will transition from state to state. States have entry actions, exit actions, and conditions, providing precision control over the behavior of an event processing agent. Transitions between states also may have rules. Multiple types of states and transitions maximize the versatility and power of the application state modeler.</p>
<p><strong>derived event</strong> (n.) an event that is created as a result of processing one or more other events.</p>
<p><strong>complex event</strong> (n.) an event that is a situation-entity abstraction of two or more simple, derived or other complex events.</p>
<p><strong>complex event processing</strong> (n.) CEP is a technology for extracting information from message-based systems. CEP is primarily an event processing concept that deals with the task of processing multiple events from an event cloud with the goal of identifying the meaningful events within the event cloud. CEP employs techniques such as detection of complex patterns of many events, event correlation and abstraction, event hierarchies, and relationships between events such as causality, membership, and timing, and event-driven processes.</p>
<p><strong>event</strong> (n.) a instance of an event definition. It is an immutable object that represents a business activity that happened at a single point in time. Just as one cannot change the fact that a given activity occurred, one cannot change an event — events are immutable.</p>
<p><strong>event aggregation</strong> (n.) the aggregation of simple, derived or complex events into higher levels of event abstractions.</p>
<p><strong>event definition</strong> (n.) a set of properties related to a given activity that represents an important or interesting change of state in a human, system or computational activity. An event definition includes event properties such as event priority, event time to live (TTL), and a description of the payload, which is comprehensive information related to the activity that occurred. Events expire when the TTL has elapsed, unless the event processing agent has instructions to consume them prior to that time.</p>
<p><strong>event channel</strong> (n.) a communications channel in which events are transmitted from event source to event receivers, typically received as electronic messages. Each channel can have multiple destination and. events can be configured to transmit to a default destination. JMS is an example of an event channel.</p>
<p><strong>event cloud</strong> (n.) a partially ordered set of events (poset), either bounded or unbounded, where the partial orderings are imposed by the causal, timing and other relationships between the events. Typically an event cloud is created by the events produced by one or more distributed systems. An event cloud may contain many event types, event streams and event channels. The difference between a cloud and a stream is that there is no event relationship that totally orders the events in a cloud.</p>
<p><strong>event-driven</strong> (n.) the behavior of a human, system or computational entity whose execution or actuation is in response to events, typically received as electronic messages.</p>
<p><strong>event-driven architecture</strong> (n.) an architectural style for distributed computing applications in which some of the components are event-driven and communicate by means of events.</p>
<p><strong>event processing</strong> (n.) computing that performs operations on events, including modifying, creating and destroying events.</p>
<p><strong>event-object</strong> (n.) an software object that represents an event, generally for the purpose of computer processing, that exhibits both encapsulation, inheritance and polymorphism.</p>
<p><strong>event prediction</strong> (n.) computational activity where the impact of events, complex events, and situations caused by events identified, including both opportunity or threat. Sometimes referred to as “Level 2” event processing, impact assessment or predictive analytics.</p>
<p><strong>event pre-processing</strong> (n.) computational activity where events are cleansed or normalized to produce semantically understandable data. Sometimes referred to as “Level 0” event processing.</p>
<p><strong>event processing</strong> (n.) computational activities on events dealing with the association, correlation, and combination of event data and information from single and multiple event sources to achieve refined identity and situation estimates for observed event objects, and to achieve complete and timely assessments of opportunities, threats, and their significance. Event processing is characterized by continuous refinements of event estimates and assessments and by evaluation of the need for additional sources, or modification of the process itself, to achieve improved results.</p>
<p><strong>event processing agent</strong> (n.) an EPA is a computational entity that performs event processing.</p>
<p><strong>event processing network</strong> (n.) a set of event processing agents and a set of event channels connecting them.</p>
<p><strong>event properties</strong> (n.) data representation of an event, typically by name-value pairs of type string, integer, real, boolean or a complex data type.</p>
<p><strong>event refinement</strong> (n.) filter, identify and track events &amp; make initial processing decisions based on association, correlation and state estimation. Sometimes referred to as “Level 1” event, or event-object, track and trace.</p>
<p><strong>event stream</strong> (n.) a time-ordered sequence of events. An event stream may be bounded by a certain time interval or other contextual dimension (content, space, source, certainty), or be open ended and unbounded.</p>
<p><strong>event stream processing</strong> (n.) a time-ordered sequence of events. An event stream may be bounded by a certain time interval or other contextual dimension (content, space, source, certainty), or be open ended and unbounded.</p>
<p><strong>rule</strong> (n.) defines what triggers unusual, suspicious, problematic, or advantageous activity within an event processing agent and what the EPA does when it discovers these types of activities. Rules execute actions based on certain conditions on events, instances, or a combination of both. A rule includes a group of condition-rule statements and action-rule statements. The condition statements instruct the EPA what to look for in events, and action statements instruct the EPA how to respond when conditions are met. If all the conditions in a rule are satisfied by events or instances or both, the EPA fires the actions. The action might be to execute tasks, create an event instance, modify property values in an event instance, create and send an event, or something else.</p>
<p><strong>rules engine</strong> (n.) a type of event processing agent that uses a declarative programming model to process events. Formally described as &#8220;an abstract structure that describes a formal language precisely, i.e., a set of rules that mathematically delineates a (usually infinite) set of finite-length strings over a (usually finite) alphabet“. Informally, it can be any system that uses rules, in any form, that can be applied to data to produce outcomes.</p>
<p><strong>rule language</strong> (n.) is an artificial language that is used to control the behavior of an event processing agent. Rules languages, like human languages, have syntactic and semantic rules to define meaning.</p>
<p><strong>situation refinement</strong> (n.) identify situations, or complex events, based on event clustering, event-event relationships and relationship analysis and context. Sometimes referred to as “Level 2” event processing.</p>
<p><strong>simple event</strong> (n.) an event that is not an abstraction or composition of other events.</p>
<p><strong>virtual event</strong> (n.) an event that is imagined, modeled or simulated.</p>
<hr />Note:  The Emerging Technologies Engineering Team at <a href="http://www.tibco.com" target="_blank">TIBCO Software </a>significantly contributed to these event processing terms and definitions.</p>
]]></content:encoded>
      <pubDate>Thu, 21 Aug 2008 01:47:11 +0000</pubDate>
      <category domain="http://securityratty.com/tag/event">event</category>
      <category domain="http://securityratty.com/tag/event-object">event-object</category>
      <category domain="http://securityratty.com/tag/business process management">business process management</category>
      <category domain="http://securityratty.com/tag/process">process</category>
      <category domain="http://securityratty.com/tag/event correlation">event correlation</category>
      <category domain="http://securityratty.com/tag/process refinement">process refinement</category>
      <category domain="http://securityratty.com/tag/simple">simple</category>
      <category domain="http://securityratty.com/tag/simple event">simple event</category>
      <category domain="http://securityratty.com/tag/process events">process events</category>
      <source url="http://www.thecepblog.com/2008/08/21/epts-proposed-event-processing-definitions-september-20-2006/">EPTS: Proposed Event Processing Definitions, September 20, 2006</source>
    </item>
    <item>
      <title><![CDATA[A Blast from the Past: CEP at Stanford,1998-2003]]></title>
      <link>http://securityratty.com/article/ecd27eebd62b2df7d9e99b1fcf7ac96f</link>
      <guid>http://securityratty.com/article/ecd27eebd62b2df7d9e99b1fcf7ac96f</guid>
      <description><![CDATA[Courtesy of Complex Event Processing at Stanford
Complex event processing (CEP) is a new technology. It can be applied to extracting and analyzing information from any kind of distributed...]]></description>
      <content:encoded><![CDATA[<p>Courtesy of <a href="http://pavg.stanford.edu/cep/" target="_blank">Complex Event Processing at Stanford</a></p>
<p>Complex event processing (CEP) is a new technology. It can be applied to extracting and analyzing information from any kind of distributed message-based system. It is developed from the Rapide concepts of (1) causal event modeling, (2) event patterns and pattern matching, and (3) event pattern maps and constraints. Complex event processing can be applied to a wide variety of Enterprise monitoring and management problems, from low level network management to high level enterprise intelligence gathering.</p>
<h2>Applications of Complex Event Processing:</h2>
<ul>
<li><strong><a href="http://pavg.stanford.edu/cep/enterprise-viewing.html">Instant Insight</a></strong>  - hierarchical event viewing applied to the Enterprise IT layer. (coming soon)
<ul>
<li><a href="http://pavg.stanford.edu/cep/instantinsightpaper.pdf">Analysing business processes</a> (paper in pdf format)</li>
</ul>
</li>
<li><a href="http://pavg.stanford.edu/cep/netviewer-presentation.ppt">Network Level Monitoring and Management (Powerpoint presentation)</a></li>
<li><a href="http://pavg.stanford.edu/ID/">Cyber Security: Network Intrusion Detection</a></li>
<li>Enterprise Monitoring and Management (coming soon)</li>
<li><a href="http://pavg.stanford.edu/cep/final-version-131102.pdf">Modeling and Simulation of Collaborative Business Processes </a></li>
<li>Business Policy Monitoring. (coming soon)</li>
<li>Analysis and Debugging of Distributed Systems (coming soon)</li>
</ul>
<h2>Presentations:</h2>
<ul>
<li><a href="http://pavg.stanford.edu/cep/ee380abstract.html">&#8220;Complex Event Processing: An Essential Technology for Instant Insight into the Operation of Enterprise Information Systems,&#8221; </a>lecture at the Stanford University Computer Systems Laborary EE380 Colloquium series. <a href="http://stanford-online.stanford.edu/courses/ee380/030115-ee380-100.asx">Video of the lecture (duration: 60 minutes). </a></li>
</ul>
<h2>Publications:</h2>
<ul>
<li><em><a href="http://pavg.stanford.edu/cep/fabline.ps">Complex Event Processing in Distributed Systems.</a></em> David C. Luckham and Brian Frasca, Stanford University Technical Report CSL-TR-98-754, March 1998, 28 pages.<em>Abstract:</em> Complex event processing is a new technology for extracting information from distributed message-based systems. This technology allows users of a system to specify the information that is of interest to them. It can be low level network processing data or high level enterprise management intelligence, depending upon the role and viewpoint of individual users. And it can be changed from moment to moment while the target system is in operation. This paper presents an overview of Complex Event Processing applied to a particular example of a distributed message-based system, a fabrication process management system. The concepts of causal event histories, event patterns, event filtering, and event aggregation are introduced and their application to the process management system is illustrated by simple examples. This paper gives the reader an overview of Complex Event Processing concepts and illustrates how they can be applied using the Rapide toolset to one specific kind of system.<br />
 </li>
<li><em><a href="http://pavg.stanford.edu/cep/99pakdd.ps">Event Mining with Event Processing Networks.</a></em> Louis Perrochon and Walter Mann and Stephane Kasriel and David C. Luckham, The Third Pacific-Asia Conference on Knowledge Discovery and Data Mining. April 26-28, 1999. Beijing, China, 5 pages.<em>Abstract:</em> Event Mining discovers and delivers information and knowledge in a real-time stream of data, or events. We show that the process of delivering knowledge by searching patterns in data and subsequent abstraction of found patterns can be applied in real-time to a complex, asynchronous system. Our event processing engine consists of a network of event processing agents (EPAs) running in parallel that interact using a dedicated event processing infrastructure. The agents can be configured at run-time using a formal pattern language. The underlying infrastructure (1) provides an abstract communication mechanism and thus allows dynamic reconfiguration of the communication topology between agents at run-time and (2) provides transparent, location-independent access to all data. These features allow dynamic allocation of EPAs to different threads and processes on different machines at run time.<br />
 </li>
<li><em><a href="http://pavg.stanford.edu/people/santoro/distrib/ejava.ps">eJava - Extending Java with Causality</a></em>. Alexandre Santoro and Walter Mann and Neel Madhav and David Luckham, Proceedings of the 10th International Conference on Software Engineering and Knowledge Engineering, June 1998, 10 pages.<em>Abstract:</em> Programming languages like Java provide designers with a variety of classes that simplify the process of program development. Some of these classes allow one to easily build multithreaded programs. Though useful, especially in the creation of reactive systems, multithreaded programs present challenging problems such as race conditions and synchronization issues. Validating these programs against a specification is not trivial since Java does not clearly indicate thread interaction. These problems can be solved by modifying Java so that it produces computations, collections of events with both causal and temporal ordering relations defined for them. Specifically, the causal ordering is ideal for identifying thread interaction. This paper presents eJava, an extension to Java that is both event based and causally aware, and shows how it simplifies the process of understanding and debugging multithreaded programs.<br />
 </li>
<li><a href="http://pavg.stanford.edu/cep/99wicsa1.ps.gz">Event-Based Execution Architectures for Dynamic Software Systems</a>. James Vera, Louis Perrochon, David C. Luckham.<br />
Proceedings of the First Working IFIP Conf. on Software Architecture. 1999. San Antonio, Texas.<em>Abstract:</em> Distributed systems&#8217; runtime behavior can be difficult to understand. Concurrent, distributed activity make notions of global state difficult to grasp. We focus on the runtime structure of a system, its execution architecture, and propose representing its evolution as a partially ordered set of predefined architectural event types. This representation allows a system&#8217;s topology to be visualized, analyzed and con-strained. The use of a predefined event types allows the execution architectures of different systems to be readily compared.<br />
 </li>
<li><em><a href="http://pavg.stanford.edu/cep/cidf.ps.gz">Using Context-Based Correlation in Network Operations and Management</a></em>. Louis Perrochon (work in progress, mail author for newest version)<em>Abstract:</em> Network operation consists to a large degree of reaction to activities happening in the network. Better knowledge of the network at any time allows more appropriate reactions. On the example of intrusion detection, we show how context-based correlation of such activities can provide a more detailed view of the network in shorter time. We first present how we model context and then describe the architecture of the Stanford University CEP context-based correlator. Correlation is specified as event patterns in a declarative language that allows us to specify what needs to be detected, instead of specifying how it should be detected. CEP introduces the concept of causal context to intrusion detection. The correlator is able to process events on-line, as they are generated and it can be reconfigured at dynamically. We then show how it increases detection rate, reduce false alarms, and detect large-scale attack patterns at an early stage.</li>
</ul>
]]></content:encoded>
      <pubDate>Mon, 07 Jul 2008 15:20:21 +0000</pubDate>
      <category domain="http://securityratty.com/tag/architectural event types">architectural event types</category>
      <category domain="http://securityratty.com/tag/event">event</category>
      <category domain="http://securityratty.com/tag/event pattern maps">event pattern maps</category>
      <category domain="http://securityratty.com/tag/event types">event types</category>
      <category domain="http://securityratty.com/tag/event aggregation">event aggregation</category>
      <category domain="http://securityratty.com/tag/event patterns">event patterns</category>
      <category domain="http://securityratty.com/tag/complex event">complex event</category>
      <category domain="http://securityratty.com/tag/event based">event based</category>
      <category domain="http://securityratty.com/tag/hierarchical event">hierarchical event</category>
      <source url="http://www.thecepblog.com/2008/07/07/a-blast-from-the-past-cep-at-stanford1998-2003/">A Blast from the Past: CEP at Stanford,1998-2003</source>
    </item>
    <item>
      <title><![CDATA[When does Declarative Data Binding Happen?]]></title>
      <link>http://securityratty.com/article/1ffb23ec7f70a30daf34af87875839e6</link>
      <guid>http://securityratty.com/article/1ffb23ec7f70a30daf34af87875839e6</guid>
      <description><![CDATA[I try to use declarative data binding (let's call it DDB for short) wherever I can in my ASP.NET apps, but there's one pain point I've run into in the past. It has to do with lists
Let's say you want...]]></description>
      <content:encoded><![CDATA[<P>I try to use declarative data binding (let's call it DDB for short) wherever I can in my ASP.NET apps, but there's one pain point I've run into in the past. It has to do with lists.</P>
<P>Let's say you want to populate a list box or drop down list of choices by calling a static method - you can wire up an ObjectDataSource to do that. But then in your Page's Load event, you may want to look up a record and <EM>select one of those choices</EM> based on data from that record. Maybe the user chose the item in the past and you're looking in the user's profile to recall her choice. Well, you'll quickly find that Load fires <EM>before</EM> declarative data binding has occurred. You'll probably discover this like I did when you get an error because there are no items in the list to select from. In the past I've simply avoided declarative data binding when I ran into this problem and used programmatic data binding instead (control.DataSource=collection; control.DataBind; control.SelectedIndex=whatever;).</P>
<P>But today I talked with <A href="http://www.pluralsight.com/fritz/" target=_blank><A title="Fritz Onion, author of Essential ASP.NET" href="/fritz">Fritz</A> Onion</A>, ASP.NET guru, and we figured out when declarative data binding actually occurs. We tested LoadComplete, and that wasn't late enough. Then we figured certainly DDB would happen before PreRender. No such luck. So finally Fritz suggested testing out PreRenderComplete, and that worked like a charm. So by the time PreRenderComplete has fired, DDB has already taken place and you can safely make list selections for lists that have been populated via DDB.</P>
<P>My current solution looks like this:</P>
<BLOCKQUOTE><PRE>protected void Page_Load(object sender, EventArgs args) {
    if (!IsPostBack)
        PreRenderComplete += PopulateControlsFromUserData;
}
void PopulateControlsFromUserData(object sender, EventArgs args) {
    // DDB has already happened, so party on!
}
</PRE></BLOCKQUOTE>
<P>I hope this helps someone else who also searches for "when does declarative data binding happen", which didn't used to bring up any results :-)</P><div style="clear:both;"></div><img src="http://pluralsight.com/community/aggbug.aspx?PostID=51070" width="1" height="1">]]></content:encoded>
      <pubDate>Thu, 29 May 2008 09:31:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/declarative data">declarative data</category>
      <category domain="http://securityratty.com/tag/programmatic data">programmatic data</category>
      <category domain="http://securityratty.com/tag/list">list</category>
      <category domain="http://securityratty.com/tag/list box">list box</category>
      <category domain="http://securityratty.com/tag/ddb">ddb</category>
      <category domain="http://securityratty.com/tag/void">void</category>
      <category domain="http://securityratty.com/tag/void page load">void page load</category>
      <category domain="http://securityratty.com/tag/page">page</category>
      <source url="http://pluralsight.com/community/blogs/keith/archive/2008/05/29/51070.aspx">When does Declarative Data Binding Happen?</source>
    </item>
    <item>
      <title><![CDATA[When does Declarative Data Binding Happen?]]></title>
      <link>http://securityratty.com/article/2e94a8a3ffd300bca283b93199173b08</link>
      <guid>http://securityratty.com/article/2e94a8a3ffd300bca283b93199173b08</guid>
      <description><![CDATA[I try to use declarative data binding (let's call it DDB for short) wherever I can in my ASP.NET apps, but there's one pain point I've run into in the past. It has to do with lists
Let's say you want...]]></description>
      <content:encoded><![CDATA[<P>I try to use declarative data binding (let's call it DDB for short) wherever I can in my ASP.NET apps, but there's one pain point I've run into in the past. It has to do with lists.</P>
<P>Let's say you want to populate a list box or drop down list of choices by calling a static method - you can wire up an ObjectDataSource to do that. But then in your Page's Load event, you may want to look up a record and <EM>select one of those choices</EM> based on data from that record. Maybe the user chose the item in the past and you're looking in the user's profile to recall her choice. Well, you'll quickly find that Load fires <EM>before</EM> declarative data binding has occurred. You'll probably discover this like I did when you get an error because there are no items in the list to select from. In the past I've simply avoided declarative data binding when I ran into this problem and used programmatic data binding instead (control.DataSource=collection; control.DataBind; control.SelectedIndex=whatever;).</P>
<P>But today I talked with <A href="http://www.pluralsight.com/fritz/" target=_blank><A title="Fritz Onion, author of Essential ASP.NET" href="/fritz">Fritz</A> Onion</A>, ASP.NET guru, and we figured out when declarative data binding actually occurs. We tested LoadComplete, and that wasn't late enough. Then we figured certainly DDB would happen before PreRender. No such luck. So finally Fritz suggested testing out PreRenderComplete, and that worked like a charm. So by the time PreRenderComplete has fired, DDB has already taken place and you can safely make list selections for lists that have been populated via DDB.</P>
<P>My current solution looks like this:</P>
<BLOCKQUOTE><PRE>protected void Page_Load(object sender, EventArgs args) {
    if (!IsPostBack)
        PreRenderComplete += PopulateControlsFromUserData;
}
void PopulateControlsFromUserData(object sender, EventArgs args) {
    // DDB has already happened, so party on!
}
</PRE></BLOCKQUOTE>
<P>I hope this helps someone else who also searches for "when does declarative data binding happen", which didn't used to bring up any results :-)</P><div style="clear:both;"></div><img src="http://www.pluralsight.com/community/aggbug.aspx?PostID=51070" width="1" height="1">]]></content:encoded>
      <pubDate>Thu, 29 May 2008 09:31:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/declarative data">declarative data</category>
      <category domain="http://securityratty.com/tag/programmatic data">programmatic data</category>
      <category domain="http://securityratty.com/tag/list">list</category>
      <category domain="http://securityratty.com/tag/list box">list box</category>
      <category domain="http://securityratty.com/tag/ddb">ddb</category>
      <category domain="http://securityratty.com/tag/void">void</category>
      <category domain="http://securityratty.com/tag/void page load">void page load</category>
      <category domain="http://securityratty.com/tag/page">page</category>
      <source url="http://www.pluralsight.com/community/blogs/keith/archive/2008/05/29/51070.aspx">When does Declarative Data Binding Happen?</source>
    </item>
    <item>
      <title><![CDATA[When does Declarative Data Binding Happen?]]></title>
      <link>http://securityratty.com/article/13da8f42c7952343ade4c2efdbbd0343</link>
      <guid>http://securityratty.com/article/13da8f42c7952343ade4c2efdbbd0343</guid>
      <description><![CDATA[I try to use declarative data binding (let's call it DDB for short) wherever I can in my ASP.NET apps, but there's one pain point I've run into in the past. It has to do with lists
Let's say you want...]]></description>
      <content:encoded><![CDATA[<P>I try to use declarative data binding (let's call it DDB for short) wherever I can in my ASP.NET apps, but there's one pain point I've run into in the past. It has to do with lists.</P>
<P>Let's say you want to populate a list box or drop down list of choices by calling a static method - you can wire up an ObjectDataSource to do that. But then in your Page's Load event, you may want to look up a record and <EM>select one of those choices</EM> based on data from that record. Maybe the user chose the item in the past and you're looking in the user's profile to recall her choice. Well, you'll quickly find that Load fires <EM>before</EM> declarative data binding has occurred. You'll probably discover this like I did when you get an error because there are no items in the list to select from. In the past I've simply avoided declarative data binding when I ran into this problem and used programmatic data binding instead (control.DataSource=collection; control.DataBind; control.SelectedIndex=whatever;).</P>
<P>But today I talked with <A href="http://www.pluralsight.com/fritz/" target=_blank><A title="Fritz Onion, author of Essential ASP.NET" href="/fritz">Fritz</A> Onion</A>, ASP.NET guru, and we figured out when declarative data binding actually occurs. We tested LoadComplete, and that wasn't late enough. Then we figured certainly DDB would happen before PreRender. No such luck. So finally Fritz suggested testing out PreRenderComplete, and that worked like a charm. So by the time PreRenderComplete has fired, DDB has already taken place and you can safely make list selections for lists that have been populated via DDB.</P>
<P>My current solution looks like this:</P>
<BLOCKQUOTE><PRE>protected void Page_Load(object sender, EventArgs args) {
    if (!IsPostBack)
        PreRenderComplete += PopulateControlsFromUserData;
}
void PopulateControlsFromUserData(object sender, EventArgs args) {
    // DDB has already happened, so party on!
}
</PRE></BLOCKQUOTE>
<P>I hope this helps someone else who also searches for "when does declarative data binding happen", which didn't used to bring up any results :-)</P><img src ="http://pluralsight.com/blogs/keith/aggbug/51070.aspx" width = "1" height = "1" />]]></content:encoded>
      <pubDate>Thu, 29 May 2008 03:31:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/declarative data">declarative data</category>
      <category domain="http://securityratty.com/tag/programmatic data">programmatic data</category>
      <category domain="http://securityratty.com/tag/list">list</category>
      <category domain="http://securityratty.com/tag/list box">list box</category>
      <category domain="http://securityratty.com/tag/ddb">ddb</category>
      <category domain="http://securityratty.com/tag/void">void</category>
      <category domain="http://securityratty.com/tag/void page load">void page load</category>
      <category domain="http://securityratty.com/tag/page">page</category>
      <source url="http://pluralsight.com/blogs/keith/archive/2008/05/29/51070.aspx">When does Declarative Data Binding Happen?</source>
    </item>
    <item>
      <title><![CDATA[The Checklist]]></title>
      <link>http://securityratty.com/article/fe4f934e33d82e7c6399c659a93681bb</link>
      <guid>http://securityratty.com/article/fe4f934e33d82e7c6399c659a93681bb</guid>
      <description><![CDATA[Brian Chess wrote about a great article in the New Yorker - &quot; The Checklist .&quot; The article is a fantastic read and I highly recommend it, even if you're not interested in medicine. It is well written...]]></description>
      <content:encoded><![CDATA[Brian Chess <a href="http://extra.fortifysoftware.com/blog/2008/01/the_checklist.html">wrote</a> about a great article in the New Yorker - "<a href="http://www.newyorker.com/reporting/2007/12/10/071210fa_fact_gawande">The Checklist</a>."   The article is a fantastic read and I highly recommend it, even if you're not interested in medicine.  It is well written and quite engaging about how doctors handle a ridiculously complex topic - intensive care.<br /><br />Like Brian, I was struck by how closely the article can parallel some of the problems we face in trying to develop secure software.  I agree with the basic premise of Brian's statement, that a checklist can help in the software development world just like it can in the ICU.  I've had great success providing checklists to developers of common areas of concern, areas they need to make sure the document, etc.<br /><ul><li>Document how you handle authentication.  if different from standard X, get a security reviews.</li><li>Document how you're handing input filtering. If not the standard library with declarative syntax, document and get a security review.....</li></ul>You get the picture.  You can do similar things with static analyzers for example, and even by tweaking compilers or compile environment to prevent the usage of certain easy to mess-up functions such as strcpy, messed up buffer sizes, etc.<br /><br />I want to focus on two other items from the article that are worth noting.<br /><ol><li>Metrics</li><li>Processe<span style="font-weight: bold;">s</span></li></ol><span style="font-weight: bold;">Metrics</span><br /><br />In the paper the author talks about following the checklist and how it reduced deaths.  One thing he never mentions is the cost of following the checklist.  I thought it interesting, but I can only assume based on the number of lives saved, and the cost of even a single infection, that the costs of following the checklist are far outweighed by the cost savings.  Still, it would have been nice to see a cost comparison between the two.<br /><br />What is also interesting though is that in the hospital setting its generally quite clear what an adverse event is.  We generally know when someone has an infection, we certainly know when someone dies.  We do root cause analysis in many cases (though not all) to understand the general cause of death, though when there is an infection for example we don't always get to root cause.<br /><br />One result of this sort of tracking, is that it occurs within a regulatory framework where hospitals must report their incident rates publicly, and there are agencies within government charged with collecting, monitoring, and even in some cases improving on these measurements and results.<br /><br />As a result of this public tracking, the key doctor from the paper, Pronovost, was able pretty clearly to tell whether his process changes were having a positive or negative effect.  He had lots of public data to draw from, and the incidence rate at any given hospital is large enough that we can start to make valid statistical judgments about the impact of our changes.<br /><br />Contrast this with software and the differences in both area, and maturity, are quite telling.  We don't have any standard measures of success/failure, we don't perform lots of root cause on adverse events, and we don't have public reporting of success and failure.  So, we don't have a general body of knowledge that allows us  to get better or at least measure how we're doing.<br /><br />Maybe we ought to have something like that? I <a href="http://securityretentive.blogspot.com/2007/05/analyzing-software-failures.html">wrote</a> about this last year when saying that we ought to have some sort of NTSB for security, or at least for security breaches.  Maybe its time we start taking that more seriously?<br /><br /><span style="font-weight: bold;">Processes</span><br /><br />I was also struck by one of Pronovost's comments about medicine that I think especially relevant to software security.  When asked whether we'd get to the point that checklists are as common as a stethoscope for a Dr, he replied:<br /><br /><blockquote>"At the current rate, it will never happen,” he said, as monitors beeped in the background. “The fundamental problem with the quality of American medicine is that we’ve failed to view delivery of health care as a science. The tasks of medical science fall into three buckets. One is understanding disease biology. One is finding effective therapies. And one is insuring those therapies are delivered effectively. That third bucket has been almost totally ignored by research funders, government, and academia. It’s viewed as the art of medicine. That’s a mistake, a huge mistake. And from a taxpayer’s perspective it’s outrageous.” We have a thirty-billion-dollar-a-year National Institutes of Health, he pointed out, which has been a remarkable powerhouse of discovery. But we have no billion-dollar National Institute of Health Care Delivery studying how best to incorporate those discoveries into daily practice.</blockquote>I was reminded of Gunnar's <a href="http://1raindrop.typepad.com/1_raindrop/2007/10/sacred-cow-gore.html">response</a> to the Spaf piece - "<a href="http://www.cerias.purdue.edu/weblogs/spaf/kudos-opinions-rants/post-124/solving-some-of-the-wrong-problems/">Solving the Wrong Problems</a>."   I think Gunnar hit it on the head with his criticism of Spaf's piece, and I think the situation is quite similar to the one Pronovost finds in medicine. <br /><br />For the most part we fail to treat the delivery/creation of software as a science.  We do lots of research on languages, we do lots of work on theories of security, and then it all breaks down because we have people implementing the processes, and we don't spend any time on that.  Well, at least not in measure to how much we spend on all sorts of other efforts that we don't measure, we aren't sure achieve results, etc.<br /><br />We know lots about how to theoretically secure things, but we don't know a whole lot about how to get large software development organizations to produce consistently high quality/"secure" software.  Heck, we don't even know how to do it if we aren't budget constrained, much less if we are.<br /><br />To be sure, medicine hasn't solved this problem either, and they aren't dealing with a huge installed base :)  They are better at measuring effectiveness, but again they are in a life/death world plus they have the added joy of strict liability.  Operating under those conditions they do manage to settle on newer/better techniques pretty quickly, because they are tracking how they are doing, lives are on the line, and they are pretty strongly incented to get it right.<img src="http://feeds.feedburner.com/~r/SecurityRetentive/~4/231381189" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 07 Feb 2008 17:14:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/secure">secure</category>
      <category domain="http://securityratty.com/tag/develop secure software">develop secure software</category>
      <category domain="http://securityratty.com/tag/software">software</category>
      <category domain="http://securityratty.com/tag/software development organizations">software development organizations</category>
      <category domain="http://securityratty.com/tag/health">health</category>
      <category domain="http://securityratty.com/tag/health care delivery">health care delivery</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/checklist">checklist</category>
      <category domain="http://securityratty.com/tag/software development world">software development world</category>
      <source url="http://feeds.feedburner.com/~r/SecurityRetentive/~3/231381189/checklist.html">The Checklist</source>
    </item>
    <item>
      <title><![CDATA[CEP in Laymans Terms: Reuse and Agility]]></title>
      <link>http://securityratty.com/article/659df1a449054440f50e5077b50aa241</link>
      <guid>http://securityratty.com/article/659df1a449054440f50e5077b50aa241</guid>
      <description><![CDATA[We often hear a lot about the core benefits of SOA, which include reuse and agility
This week, I was in a meeting withManoo Ordeedolchest, Board Member of Software Park, Thailand , Former President of...]]></description>
      <content:encoded><![CDATA[<div class='snap_preview'><br /><p><span style="font-family:Georgia;">We often hear a lot about the core benefits of SOA, which include reuse and agility.</span></p>
<p><span style="font-family:Georgia;"></span><span style="font-family:Georgia;">This week, I was in a meeting with Manoo Ordeedolchest, Board Member of <a target="_blank" href="http://www.swpark.or.th/index.php?page=index&amp;module=first&amp;language=en"><font color="#800080">Software Park, Thailand</font></a>, Former President of the <a target="_blank" href="http://www.sipa.or.th/en/home/index.php"><font color="#800080">Software Industry Promotion Agency (SIPA)</font></a>, Former Dean, <a target="_blank" href="http://www.shinawatra.ac.th/index1.html"><font color="#800080">The School of Technology, Shinawatra University</font></a> and a Lecturer at <a target="_blank" href="http://www.chula.ac.th/cuweb_en/"><font color="#800080">Chulalongkorn University</font></a>, National Institute of Development Administration (NIDA), as well as other universities.  </span></p>
<p><span style="font-family:Georgia;">We were discussing CEP and our proposed CEP Center of Excellence concept for Software Park.  O</span><span style="font-family:Georgia;">ne of the topics we touched upon today was CEP &#8220;in layman&#8217;s terms.&#8221;    After some brainstorming about CEP, it we were moved to draw a parallel between the SOA and CEP concepts of IT agility and reuse.</span></p>
<p><span style="font-family:Georgia;"></span><span style="font-family:Georgia;">Just as SOA is centered around service component reuse and the agility to create new applications from service components quickly and economically; CEP can be considered to be centered around the reuse and sharing of domain knowledge, key indicators (KIs) and other intellectual property (like analytics) when processing events.</span></p>
<p><span style="font-family:Georgia;"></span><span style="font-family:Georgia;">In an SOA, we modularize services and a service-component architecture in order to share services and build new applications from these service components.</span></p>
<p><span style="font-family:Georgia;"></span><span style="font-family:Georgia;">One of the business goals of CEP is to modularize and standardize declarative programming logic and reuse this logic with event processing platforms from a variety of vendors.    </span><span style="font-family:Georgia;">This permits both reuse and agility when building event processing applications, at the application logic level versus the SOA service component level.</span></p>
<p><span style="font-family:Georgia;"></span><span style="font-family:Georgia;">So, in laymen&#8217;s terms CEP can be discussed using the same SOA concepts of reuse and agility, applied to event processing application logic and KIs.</span></p>
<p><span style="font-family:Georgia;">In a future post, I will talk about about CEP and transparency in layman&#8217;s terms.</span></p>
<img alt="" border="0" src="http://feeds.wordpress.com/1.0/categories/eventprocessing.wordpress.com/171/" /> <img alt="" border="0" src="http://feeds.wordpress.com/1.0/tags/eventprocessing.wordpress.com/171/" /> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/gocomments/eventprocessing.wordpress.com/171/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/comments/eventprocessing.wordpress.com/171/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/godelicious/eventprocessing.wordpress.com/171/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/delicious/eventprocessing.wordpress.com/171/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/gostumble/eventprocessing.wordpress.com/171/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/stumble/eventprocessing.wordpress.com/171/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/godigg/eventprocessing.wordpress.com/171/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/digg/eventprocessing.wordpress.com/171/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/goreddit/eventprocessing.wordpress.com/171/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/reddit/eventprocessing.wordpress.com/171/" /></a> <img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=thecepblog.com&blog=1100533&post=171&subd=eventprocessing&ref=&feed=1" /></div>]]></content:encoded>
      <pubDate>Fri, 18 Jan 2008 02:08:20 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cep">cep</category>
      <category domain="http://securityratty.com/tag/reuse">reuse</category>
      <category domain="http://securityratty.com/tag/laymens terms cep">laymens terms cep</category>
      <category domain="http://securityratty.com/tag/agility">agility</category>
      <category domain="http://securityratty.com/tag/include reuse">include reuse</category>
      <category domain="http://securityratty.com/tag/cep center">cep center</category>
      <category domain="http://securityratty.com/tag/laymans terms">laymans terms</category>
      <category domain="http://securityratty.com/tag/service component reuse">service component reuse</category>
      <category domain="http://securityratty.com/tag/soa concepts">soa concepts</category>
      <source url="http://thecepblog.com/2008/01/18/cep-in-laymans-terms-reuse-and-agility/">CEP in Laymans Terms: Reuse and Agility</source>
    </item>
  </channel>
</rss>
