h2g2 The Hitchhiker's Guide to the Galaxy: Earth Edition

Entry: Microsoft .NET Framework - A966963
Author: MSL - U166666

I know this is a bit of a technical niche I am trying to explain. However, there might be some perplexed people who might find it useful. What does everyone think?

Nice U-number that you got there, MSL!

"Microsoft stresses that security and privacy are top priorities" - please forgive me for ing! If I had patented the 'buffer overrun weakness' technology, I would be a quintillionaire just from MS' royalties

"Weather you want" - should be 'whether'

Be it as it might, I don't trust it (nor will I buy it) just because it's from MS. They are striving too high into Big Brother mode and they have sunken too deep. Aah well, I digress.

I gather that, whatever .NET is good for, it looks like it's designed for computers that are always connected to the internet. This might be the case for big companies but back here in bad old Germany, most private users still have time metered modem connections. Plus, once it's widespread enough, I'm afraid (read: I'm sure) they are going to get paid per minute and make it the ultimate cash cow.

"But, I could see how it" -- the Editors frown upon "I"s and "we's". Suggestion: "But, it is imaginable" / "one can imagine..."

"Weather it is fair" - see above

"Microsoft's reputation" - oh, I see

"No software company can ever be perfect..." - this might be, but isn't it a certain company by the name of Microsoft that builds the compilers too? Why don't the implement a 'buffer size check' routine which is called whenever a function is called from outside the module?

"scares the heebie-jeebies out of me" and "I would not touch " -- third person style suggestions: '...out of this researcher' and 'this researcher would not...'


Well, ok you got me ranting for the bigger part of this posting but I also learned something



As to the further proceedings... the Writing Workshop is a quiet place. If you don't get much response then I'd recommend taking it out of here (there's a 'remove' button at <./>RF2</.> (an alias for the Workshop) and head over to PR.



Bossel

well, this article stinks to high heaven, and is basically an advert for using microsoft .NET for development.

As you claim it aims at a security based system, I have serious doubts that it will ever work as anything but a virus propogations tool.

due to microsoft's faith in the "security by obscurity" model of security (ie shh! don't tell anyone), and their increasing trend towards needing online access for them to overwrite stuff on your machine, it is highly doubtfull that large numbers of people will use it out of preference.

in fact, as it is being developed to enforce lock-in and lock-out on microsoft systems, I expect it to become increasingly important on their operating systems, while at the same time their operating systems become increasingly irrelevent to the rest of the world (as is already happening in large parts of it).

the denigrating attitude in the article towards the idea of "open systems" is also rather inapropriate, considering everyone but microsoft is starting to insist upon it, and microsoft are being draged kicking and screaming into it as well.

I knew I was going to get a lot of gruff for posting this! But here is the scoop:

My intention was not to advertise .NET as something everyone should blindly use. I was just trying to explain what it was, so people could decide if it is something to consider to use.

So far, there have been few attempts to offer simple, clear explanations of what .NET is, and so as a result there have been a lot of misconceptions. The first few paragraphs of the article represent my attempt to do this. Of course, it does get more technical towards the end, but at least people will have a firm idea as to what this whole thing is about.

I will correct all of the first-person stuff (the "I"s and the "we"s), in the next draft, as well as the grievous grammatical errors (such as "weather" instead of "whether") . Sorry about all that. (I guess I proof-read the version on my own web site better than this Guide entry.)

Now, if you do not trust Microsoft's direction with security, that is fine. I stated that there are some issues to deal with, in fact. But I have some comments to defend against the more harsher criticisms:

Most of the criticisms deal with Microsoft's reputation, which is pretty ugly, right now. However, it is less likely we will see buffer-overrun related security threats in the future. Microsoft's developers are now scrutinizing every bit of code, at least in their newer products, to avoid them.

.NET itself, does not aim to be a security-based system. Only .NET Passport has the nerve to make that kind of claim. Web Services, in general, are not any less safe than any other TCP/IP (basic Internet) traffic. The .NET Framework gives the developers of these services more opportunities to keep their systems secure: But that is in the hands of the developers. If a Web Service programmer is dumb enough to allow anyone to execute an SQL statement sent into their system, just because it was packed into XML, that is the programmer's fault.

The actual Framework part of the .NET Framework is not even exposed to the outside! Its API stays firmly inside the local machine it is installed on to. Only the SOAP XML that carries the data is sent in and out of the system, and only through the Web Service interface that the programmer designed.
No-Touch deployment might be an exception to this, which is why it "scares the "heebie-jeebies out of me". But you do not need to worry about this so much, as long as you never allow executable files to be downloaded onto your machine, unless you know you really need them.

Maybe I should mention some of this in the article...good idea! I think I will do that, soon!

As for my U-Number: I am glad you like it, but I did not pick it myself.

-Mitch

"Most of the criticisms deal with Microsoft's reputation"?

not in my case they don't, they come from my experience of running multiple operating systems from microsoft and others, and guess which one's give the most trouble?

yes, microsoft. any one of their operating systems gives me more trouble than all of the non microsoft operating systems that I run put together. (I think it was 8 at the last count)

While I don't dispute their stated aims, they have an unrivaled history of failing by their own standards.

if microsoft are doing a manual audit of their code, then it's about time.

every new version of their code has claimed to be more stable than the last, and the stablest system I have from them is dos6.2 and windows 3.11.

as to the .net bytecode, there was no need to create yet another bytecode system when UCSD and the java bytecode worked perfectly well.

as to choosing not to run stuff, even in M.E., you have the problem that they expect you to install the critical updates, but the only way to do so is to leave a set of security holes wide open (because of their choice of install method) which probably means that you end up being more secure NOT installing the updates.

I expect .NET to turn out to be at least as much trouble as the continuous changes in the various API's and calling methods that they have made over the years.

and that is before you realise it is tied to XP, Passport, product activation, online automatic updates, and their various approved digital content formats. all of which are incredibly bad ideas.

I am open to being convinced that net might possibly be something other than a total disaster, but I won't hold my breath while I wait. especially considering the number of people I know who won't let XP anywhere near their PC's.

Xyroth says that Microsoft's operating systems are becoming increasingly irrelevant to the rest of the world. This is a strange view. Virtually every new computer sold today comes with a Microsoft Operating System. The proportion of people using non-MS Operating Systems is falling all the time.

"The proportion of people using non-MS Operating Systems is falling all the time" seems a bit of a strange assertion to make, considering certain problems that they have brought upon themselves.

for example a lot of countries have seen the way that gates provided "free software for schools" to britain, causing lock-in and quick upgrade cycles, and are thus refusing to go down the same route.

Other countries see open source as a method of creating a domestic software industry to cope with the lack of support for their region from microsoft and partners.

others see the problems of having a dependance on a foriegn company making a fundamental infrastructure element (which can be remotely modified) and thus won't use it on their military systems.

many others see the numerous reliability and licensing problems, and won't use microsoft for mission critical systems or generally prefer a policy of open source where possible.

and this is all before you start to consider all the countries that are insisting on open systems so as to not get lock-in.

While it might be true that microsoft came with all systems (due to compulsory bundling deals with big suppliers) there was a turning point a few years ago when this stopped being the case.

you can now go into a lot of places and get an OS free system, and put anything you want on it. the main competitors are now producing viable alternatives not just for server systems, but for many other systems as well.

given the way microsoft is totally failing to get into the "smartphone" market (due to the inflexibility of their model) and the way they have also lost the set top box and entertainment server markets, it will no longer be true that "most people run microsoft".

They keep losing new markets, while the competition goes from strength to strength, while at the same time they try nd become more and more restrictive about what they will let you do on your own machine with your own files. A lot of people won't go anywhere near that mentality.

A good example of the mentality behind microsofts problems occured during the post I just made 9 minutes ago.

despite having 899Mb of free space left on my hard drive, it insisted on filling it up with temporary files and giving me low space warnings, so that the machine was unusable until they were resolved.

upon uninstallin one optional component, and then reinstalling the same component, my 899Mb of space has come back.

In the meantime, I found the only way to get out of the low memory warning to be to reboot the machine, without being able to close down open applications cleanly, so that any unsaved data is then irretrevably lost.

This whole problem could have been solved when they wrote the software, simply by not creating temporary files unless they are needed, keeping track of which files were created, and making sure that next time the application starts up, it cleans up properly if it didn't do so when it shut down.

uptimes measured in shorter and shorter periods are not the way to hold on to market share.

windows 3.1 and dos 6.22 only get reinstalled here when a catastrophic failure occurs (usially due to the msdos filing system).

windows 95 seems to need a reinstall on any machine within 1 year of active (but not busy) use.

windows ME seems to fail seriously a couple of times a month.

is there any doubt as to why I am moving to linux (among others) and away from microsoft? adn that is before you consider the microsoft bloatware model.

hey folks, I think this discussion should better be held in a conversation below the entry

Whoa, hold on, folks! Let us please keep this discussion focused on .NET, and not general Microsoft problems. Maybe someone should start a "I HATE Microsoft" discussion, if there is not one here, already.

Every month my (formerly) good feelings about MS gets chipped away a bit. However, I have thoroughly examined .NET, and I think it can provide great value to some companies, as I will attempt to explain in Version 2 of the .NET article. I will release it sometime over the weekend (Feb. 22 or 23, 2002). Look for it Monday morning, if not sooner.

Here are a few misc. comments, to bicker and argue over, in the meantime:

.NET supports a new bytecode that Microsoft feels is better optimized for their systems. And, of course they control it, so they can change and add things when they feel like it. By the way, an obfuscator will be included in the next version of Visual Studio, to preserve your intellectual property in your code.

Microsoft is not the only company dishing out a Web Services system. In fact, Microsoft designed their .NET stuff around existing formats and protocols (like SOAP) established from other companies. And, Microsoft offers the most complete vision for this system, right down to the excellent development environments they provide.

I feel .NET will not offer any more trouble for people, than any other Web Services system. They might even have fewer problems, since every part is streamlined.

.NET Web Services are only an interface to a server, that can be consumed by a computer program. Much like a Web Page is an interface to a server, that can be read by a human.

The .NET Framework is, in a sense, much like an operating system, that focuses on optimizing the performance and features of web services. However, unlike Microsoft's Server products (such as SQL Server, Exchange Server, etc.), there are no interfaces into its innards, from outside the computer, other than those the developer designs – as Web Services.

Also, do not forget that Microsoft already has one great success in the Internet services arena: ASP pages! They are almost everywhere! And, they have proven to be versatile and solid! Of course, performance and scalability stank, in classic ASP, but those issues are addressed in ASP.NET!
I think can get their act together, and do something right, when they need to. And, .NET may not be perfect, but it is very much on the right track, as you will see if you care to learn about it with an open mind.

Choosing not to run .NET assemblies and executable files is a separate issue than choosing not to run the critical update system in Windows Me, etc. Yes, the critical update system may have problems, but you can always download security patches, as executable files, on a different machine than the one that needs to be patched. But, that has nothing to do with .NET.

Saying that .NET is "tied" to various other systems is a bit deceptive, because it does not make clear who controls who. I prefer to say that .NET technologies are "integrated" into other systems.
If you think .NET Passport, Activation, etc. are incredibly bad ideas, that is fine. That does not mean .NET is a bad idea. That is like saying Java is a bad idea, simply because making banner ads with Java is a bad idea.

Here are a few comments I feel I must make, that do not apply to .NET. But, please do not comment on them for too long, here:

There is a trade off between stability and compatibility.

Yes, DOS 6.2 and Windows 3.11 are stable, if you need limited features and do not mind awful usability of your system. Windows 95, in retrospect, had nasty stability problems, (along with "Illegal Operation" errors that scared the socks off of people), because it had to be compatible with a lot of different hardware configurations and applications. They slowly made it more stable with Windows 98 and Me (and yes, I feel Me is more stable, but perhaps not as compatible with older, uglier programs).

ONE IMPORTANT THING you must remember is that Windows 2000 and Windows XP are MUCH LESS COMPATIBLE with some types of hardware. They decided to sacrifice compatibility for stability – and thus, both newer versions of Windows are MUCH MORE STABLE. Of course, you can still find all the devices you could need for Windows 2K and XP, principally because they are such a widely used set of Systems. Make sure they are Certified Designed for Windows, and it should all be stable.

Any security holes in 2K and XP are a different matter, and deserve their own forum for discussion, if someone wants to make one.

I also wanted to add, just for the heck of it, that "Windows Me" is a bad name for an Operating System. Why does Microsoft pick such lousy names for things?!!

Oops! Version 2.0 of my .NET article will be released on Feb 22 or 23, 2003! Not 2002! Sorry!

"Saying that .NET is "tied" to various other systems is a bit deceptive, because it does not make clear who controls who. I prefer to say that .NET technologies are "integrated" into other systems."

true, but it ignores the fact that the only people who want those systems work at microsoft (and a few record companies).

"I feel Me is more stable, but perhaps not as compatible with older, uglier programs" like for example internet explorer and outlook express? I run virtually a vanilla system, with negligable other code except norton antivirus. If this is your idea of stable, I would hate to encounter your idea of unstable.

"Of course, performance and scalability stank, in classic ASP, but those issues are addressed in ASP.NET" exactly my point. every 18 months or so, they have to rewrite fundamental parts of the operating system to get around basic faults that should have been fixed pre-release. add to that, the "fixes" are often totally incompatable with the previous version, meaning that any program that uses that subsystem needs to be largely rewritten. and that is before you take into account that the file formats are usually incompatable with the older versions as well.

"Yes, the critical update system may have problems, but you can always download security patches, as executable files, on a different machine than the one that needs to be patched." well, actually you can't. in a lot of cases they will only work directly from the microsoft site with your security wide open on that one machine. you also can't do a batch install on multiple machines on the network either.

PS I don't hate microsoft, and there are quite a few things about them that I quite like, but their programming ability (or lack of it) isn't one of them. Their credibility with .NET is directly affected by the stability of both the resultant code, and the API's which they use to impliment it. if the code only works for a year or two, and then breaks on the new machine, it won't work, but this is exactly what their history suggests will happen.

> "ignores the fact that the only people who want those systems work at microsoft (and a few record companies)."

On the contrary, there are already quite a few companies doing things with .NET, but like any system, it will take time to infiltrate most of the larger companies. I think MS has a page, someplace with .NET success stories. I am too lazy to find it right now.

> "every 18 months or so, they have to rewrite fundamental parts of the operating system to get around basic faults that should have been fixed pre-release."

That argument does not apply to ASP and ASP.NET - they are actually very different systems that do similar things, and were given similar names. ASP.NET is a rewrite, but only because people were using ASP for things they did not initially design it for - hence the initial performance problems crept up.
By the way, I would not call ASP.NET a 'fundamental part of the OS'. It is just a sort-of "plug in".
Also, by the way, I would like to see anyone build a system as large a scope as an Internet server page system, and do it absolutely right the first time.

> ""fixes" are often totally incompatable with the previous version

ASP.NET is perfectly backwards compatible with ASP. (There is some minor trouble sharing session state info between the two, but otherwise I have seen no other hiccups.)

> "well, actually you can't."
Well, actually, you can!! Every patch they make is available as an .exe for downloading, though sometimes they could be hard to find. The most convenient place to download them is on the MS site, but so what? Get in there, get what you need, and get out! Use a different machine, if you must - And no security holes are left wide open. You also have the option to subscribe to MSDN or TechNet and have the patches delivered on CD-ROM, among other options.

> "like for example internet explorer and outlook express?"
I was refering to legacy DOS and some Windows 3.0 and 3.1 programs, mostly.
By the way, I do not care for Outlook Express, but I do use Outlook 2002, and have had no security problems with it, yet. Older problems had been long addressed before its release.

I have entered version 2 of my .NET article.

I changed its name from "Microsoft .NET Framework" to "What is Microsoft .NET?", because it really deals with all of .NET, not just The Framework, and the two are different beasts: .NET is simply a technology for transfering stuff, and The Framwork is a bunch of services to use that transered stuff.

I took some lines out to make it sound less like a commercial, and I tried to address the Microsoft-bashing issues brought up, without making the thing too long.

Still, I know it is not perfect. Any CONSTRUCTIVE feedback would be appreciated.

You want constructive criticism?

ok.

first, open systems do not mean "non microsoft" by any means. open systems means that if you have any two programs or other computer systems that need access to the same data, they can get it, rather than being locked into a propriatory file format that only works on one version of one companies program.

Then you go on about how wonderfull xml is (I agree it helps) and go on about how hard it was to transfer the information before (it was not, it was just hard to read it because of the lack of the open systems you denigrate).

Your section about .net security, you say "Some people who have heard a bit about .NET are concerned that XML Web Services are designed to poke through firewalls", but this whole section is a red herring.

.NET is inherently no more or less secure than any other way of accessing those open standards that microsoft are being forced into supporting (because the big companies won't buy programs that don't use them).

the entire thread about loss of interlectual property of your code also has nothing to do with the security of it. code is secure by using secure algorithms. the best example of this is openBSD, which has the code completely available for scritiny, and has also had the code security audited, as opposed to microsoft's "security by obscurity" model which has repeatedly been proven not to work. (in fact, most viruses come in through known security holes that they have not bothered to fix).

related to the security problem, you yourself have said in the article that "Never, ever download any executable files, of any sort, unless you know it is something you really need" and yet you are supposed to run XP which insists that microsoft can automatically do exactly that (and thus so can anyone who can pretend to be microsoft).

you also comment on the difficulty of the mono project, but this difficulty is caused by exactly the problems with microsoft I have mentioned in previous posts. the samba fileserver project has similar problems due to microsoft continually changing the format to remain (or become again) incompatable.

also you have the problem that you have left the end of the section on notepad .net unfinished. similarly, you have in the same place placed a footnote which says that you would need various .net tools to run the files, even though by your own admission in the rest of the article, most of the components are independant of the framework.

in fact this is a persistant problem all through the article. you repeatedly say thinks along the lines of isn't net wonderfull for using xml which isn't part of .net, isn't it wonder full for using soap which is not part of .net, isn't it wonderfull for using ASP which isn't part of .NET.

you need to refocus the article so that you don't keep doing this.

fine, xml, soap, asp and a number of the other tools can be fairly good, but they are largely independent of .net, also, their renaming c, C++ and java to be microsoft specific (as you point out in your article) and making them only compile to microsoft .net intermediate code is NOT an advantage, it is a step backwards towards being locked in to one supplier of systems software which is something the entire industry is moving away from (see the comments earlier about open systems).

Again, I will say that I am not anti microsoft, only against some of their practices.

I hope these comments have been both specific enough and constructive enough for you.

First of all, I have just corrected the sentance that got got off. Sorry about that. The completed fragment goes like this "...it is possible for others to build their own .NET construction tools, as well."

Yes, I found your criticism quite constructive. And, I will address the issues in Version 3 of the article, which I will work on in a day or so. I think I will also include more compelling examples of web services.

One thing I wanted to mention, for now: I brought up the "fire wall" paragraph, because this was a genuine issue people had against .NET, when it was first declared. People screamed "Oh no! It is designed to poke through fire walls!", and Microsoft then looks more evil.

Thanks,
MSL

fair enough.

I will have a look after the update and see if I can spot any more holes.

A piece of interesting news has just arrived.

not only is .NET a microsoft specific set of development technologies, but they are now asking for software patents for large sections of the technology.

if they are granted, then almost by definition the mono project is down the tubes.

yet another reason not to use it.

From what I can tell, Microsoft's patents do not apply to what Mono is trying to do. In fact, I doubt Mono will get much trouble from Microsoft, any time soon. Although Microsoft does not endorse what they are specifically doing, Mono is taking advantage of the openess of .NET's protocols, to build their own platform. IANAL, but it looks like Mono is still on legal grounds.

The third version of this article is now up. Sorry it took so long. I hope it was worth the wait. I reorganized things a bit. Hope everyone likes it better.