Only Wally was spared. While everyone else was at the desks working, Wally was wandering the halls, holding a coffee cup.

'Just Wally' is a cartoon that removes all the unneccessary elements from Dilbert, and leaves just the hero himself, Wally, wandering the empty building, holding meetings with himself, filling his loneliness with imagined interactions.

Wally has always been the truest character in Dilbert. I've met a few Dilberts in my time. I've met a few Pointed Haired Bosses. But just about everyone is at least part-Wally. And more than a few have been pure-Wally. You know who you are.

Some people theorise that the true story of 'Just Wally' is that Wally is the one who died. This is his limbo, wandering alone, unable to interact with the living.

Others say Wally has fallen into a coma. This is his extended delusion. He cannot tell dream from reality, sarcasm from seriousness. What exactly is a dream? What exactly is a joke?

The words of JD Salinger are relevant here, as always.

"It isn't just Wally. It could be a girl, for goodness' sake. I mean if he were a girl - somebody in my dorm, for example, - he'd have been painting scenery in some stock company all summer. Or bicycled through wales. Or taken an apartment in New York and worked for a magazine or an advertising company. It's everybody, I mean. Everything everybody does is so - I don't know, not wrong, or even mean, or even stupid, necessarily. But just so tiny and meaningless and - sad-making.

And the worst part is, if you go bohemian or something crazy like that, you're conforming just as much as everybody else, only in a different way."

Tiny and meaningless and sad-making.

Tiny and meaningless and sad-making. 'Just Wally' makes us stop and ponder the futility of everything we do, everything we think and everything we are.

In the style of Garfield minus Garfield, Just Wally plays upon the maxim of my old buddy Antoine de Saint-Exupery:

"Perfection is achieved not when there is nothing more to add, but when there is nothing left to take away"

• 4 - Star Wars: A New Hope
• 5 - Empire Strikes Back
• 2 - Attack of The Clones
• 3 - Revenge of the Sith
• 6 - Return of the Jedi

Which lead to deep conversations with myself about which order I should use when introducing my daughers to 'The Lord of the Rings'.

The three films can be arranged into 6 possible non-repeating combinations:

• Fellowship, Towers, King
• Fellowship, King, Towers
• Towers, Fellowship, King
• Towers, King, Fellowship
• King, Fellowship, Towers
• King, Towers, Fellowship

All of which have their own pluses and minuses, but none of which would qualify as a true 'machete' reordering.

I finally settled on the following order, which you'll agree is the best possible version of events:

• 1. The Two Towers -- A good story always starts in the midst of the action, and leaps past the boring parts.
• 2. The Hobbit, An Unexpected Journey -- having established the story we now move learn the origin of the Ring and Gollum.
• 3. How to Train your Dragon -- the loveable Toothless and Hiccup show us that not all dragons are nasty Smaugs.
• 3a. Read all of the books -- that way you can complain bitterly about the missing 'Scourge of the Shire' segment during:
• 4. Return of the King, Disc 2 -- 5 minutes of chucking a ring in a pit, a quick eagle ride, and two hours saying goodbye.
• 5. Return of the King, Disc 1 -- Awesome battle scene. Best war ever.

I dub this the Chop-Suey Reordering, and in line with Oracle's copyright on the arrangement of the Java Api's, I claim ownership of this and all derivative reorderings of the LOTR franchise.

Here's a few relevant excerpts:

Android, the world's leading free, open source platform for everything beyond smart phones, and the world's most popular phone amongst Android software developers and Google employees, is proud to announce the discovery of their first Consumer.

The Android developer community first suspected the existence of the Consumer after finding non-Google IP addresses in the log file of an Android Developer Forum. The discovery was quickly escalated to Google management who sent a rapid response Privacy Intrusion Team to perform expanded analysis of his web searches, browser, email and telephone usage. They were thrilled to discover that the lurker was a genuine Android customer who was neither an Android software developer or a Google employee.

The potential existence of such a Consumer had been hotly debated on Android developer forums for years. But even the most optimistic Android enthusiasts had assumed that the debate was purely theoretical.

Google had previously spent millions of dollars placing 'Angry Birds' in their 'Google Play' app store, in the hope that it could potentially attract a Consumer to consider using the Android platform for Consumer Purposes. Google's Privacy Intrusion Team have revealed that analysis of the Consumer's correspondence offer no clear rationale for why he purchased an Android phone from a market place crowded with more suitable offerings. Skeptics have taken this as an indication that the Consumer's existence could be the result of Google Finland's controversial 'tag and release' program where members of the public were anaesthetised, given an Android phone, and released back into the population.

This new phase of the Android platform is an exciting time. Predicting an influx of Consumers, developers have quickly raced to make the phone more technically intimidating and to provide an even more fractured range of devices. Google employees remain unaware of anything that has happened to non-Google employees.

The Consumer is now considering getting into Android development, and has recently taken a job at Google.

Crazy times. Next they'll be announcing the discovery of a teenager who wants a Zune.

It's such a simple idea that I don't know how it couldn't have possibly existed earlier. It doesn't require massive graphic capabilities, no CUDA NUMA GPGPGPU and the like -- it's an idea so profoundly simple that you'll be scraping your jaw off the floor with a spoon before you finish reading this blog post.

You run the 'game' and it sets up a directory structure to represent every possible state of the game. To play the game, you inspect the current folder, look at the currently available sub folders, and choose which one to navigate into. Each sub folder you see represents the next possible state of the game.

There is no executable program running when you are playing. The game is just your act of navigating the folder structure. It's a clever form of madness!

Here's some screenshots that show me playing the game, in a command prompt.

I've changed my prompt to just a 'greater than' sign, by typing 'prompt $g', to make it cleaner. Old-school DOS wizards do this kind of thing all the time. Hipster kids, try and keep up.

First I type 'dir /b' to get a clean view of the current folder.

There is only one folder, '__PLAY HANGMAN__' so I navigate into it by typing  'cd[TAB][Enter]'. The game has begun.

Looking in that folder I see the empty scaffold, three underscores (representing a 3 letter word) and the available letters listed down the left hand side. We're playing with a reduced alphabet to keep the number of permutations within a reasonable amount.

My first guess is the letter 'A'. To make this guess I type 'cd A[tab]'. When I type 'dir /b' to inspect the new state of the game I see that it was a good guess, as one of the letters of the word has been filled in. Also there is an 'x' next to the 'A' indicating that that letter has been guessed. That's all there is to it. Hear that pop? That was your cerebellum exploding through your temporal lobe.

If I try guessing 'A' again, all I find is a folder containing a file named 'You have already guessed that letter.' To undo my mistake I back out by typing 'cd ..' (You could, theoretically use this technique to undo any move, but that would be unsportsmanlike.)

A couple of moves later and I've guessed every letter:

The word is 'CAB'. There's no particular fanfare. Just the word 'WIN' declaring my victory.

Okay, now you've seen the whole thing I hope you're aching to not just download the game, but to write your own entry into this brave new genre. You could do for Gehtto-Folder-Games what John Carmack did for first person shooters!

I'd love to see an implementation of tic-tac-toe, aka, naughts and crosses. Also, hangman could be minified by using junctions (i.e. symbolic links) -- I'd love to see that implemented. The possibilities for new games are pretty much endless. Maybe six or seven.

Okay let me level with you. The mathematics of this idea were just ridiculous. For a full 26 character alphabet, I would've killed my little computer. (Care to accurately calculate how many folders are created for the given alphabet?) It's all based around N-factorial where N is the size of the alphabet. Factorial is not something you want to see in the real world.

I'm on holiday at the moment, so the only computer available to write it on was my dell mini, which doesn't have any serious coding environment. So rather than write it as a console app in visual studio (or even a powershell app) I wrote a javascript page that generates a batch file. It's very niche.

This also turned into an opportunity to learn the ins and outs of getting recursion wrong with javascript. The most common mistake you make with recursion in javascript, it turns out, is forgetting to declare a local variable. This means that the variable becomes global and your recursion goes nuts. Don't make that mistake. When your code is creating subfolders all over your hard drive it's a particularly painful mistake. It took me considerably less time to write the program than it did to debug it, and (considerably*considerably) less time to debug than the time to clean up all the folders left in unexpected places.

But the funnest bit was the ascii sprite code.

I had one array that showed the final hanged man:

var hangyPicture = [
'   _______   ',
'   I     I   ',
'   I     O   ',
'   I   --I-- ',
'   I    I I  ',
'   I         ',
'--===--      '];

(Side point... why wasn't my ascii art better than this? Because | and \ are not valid in folder names.)

And I had another array that showed how many misses were required before a given character of the hangyPicture was shown:

var hangyMask = [
'             ',
'             ',
'         1   ',
'       33233 ',
'        4 4  ',
'             ',
'             '];

Then, with those two arrays in place, I can work out the names of the folders to create. I walk through the mask, one character at a time, and compare the digit I find to the current number of missed guesses. If the digit I find is less than (or equal to) the current number of missed guesses, then I include that character in the folder name, otherwise I mask it out with a space. Ah, I give in -- it's easier to just show the code:

for (var h in hangyPicture) {
  // use hangyMask[h] and numberOfMisses to mask chars out of hangyPictures[h] 
  for(var i = 0; i < hangyMask[h].length; i++) {
    if (hangyMask[h][i] == ' ' || hangyMask[h][i] <= numberOfMisses) {
      folders[h] += hangyPicture[h][i];
    } else {
      folders[h] += ' ';
    }
  }
}

Okay. Now you've been enlightened with the future of ultra-ghetto folder-based gaming, go ahead and make your own. I can wait.

Here's the code

The accompanying program is a piece of javascript that creates a windows batch file. You run the batch file.

The only things that will survive the forthcoming nuclear+zombie apocalypse are cockroaches, javascript and CSV.

So I've written an open source javascript library, agnes.js, that the cockroaches can use for dealing with CSV from javascript. And in the brief pre-apocalypse era you can use it too.

Download the zip

I've written before about how CSV starts off looking easy, but quickly descends into a world of insanity. So in javascript land, let agnes handle all the nasty quirks and edge cases (embedded delimiters, qualifiers, nulls and so on).

I wrote a bunch of unit tests to go with it, so you can tell exactly what it does with each weird bit of input you can throw at it.

You can download it from agnes.codeplex.com

This was a particularly fun little bus project, and what I like best about agnes is the content you get when you download her.

The readme file has executable examples, that work by having a chunk of code displayed in a div, which is the exact code that is grabbed and executed when you click 'Try it'.

Browse source code

I like the unit tests that come with it, and the little unit test runner. I could've gone really overboard with it, but I stopped myself before it went too far.

And I like the sample that performs Csv to Json conversion, back and forth, back and forth. My favourite part of that is using html entities in the button titles, for left and right arrows.

Try it out

Now that I've got agnes out of the way, hopefully I can focus on my new bilion dollar idea, youmustget.com

Yesterday Joel told me, 'hey you really should read "The Big Short" by Michael Lewis' -- and I thought, yes, I'll write that in my list of books I must get and when I have a chance I'll order it and all the other books in my list of books i must get.

Looking through my iphone I was shocked to find I don't even *have* a list of books I must get. I've got a list of which Woody Allen movies I haven't seen, and I have a list of which Jeeves and Wooster books I own (or own twice) so I don't accidentally buy them again (or again again), but no "Books I must get".

And I realised it's not just books that I keep forgetting. It's everything in our stupid materialist world. It's gadgets, music, movies, games, t-shirts, toys, gifts for my wife, baby stuff, apps, power tools -- a whole big fat materialist world full of stuff I must get, that, realistically i'll never get, but which my inner taxonomist wouldn't mind having a list of somewhere.

Suddenly, before I could stop them, my hands had rushed off and spent 9.95 to buy all of the following websites...

• http://things.youmustget.com
• http://books.youmustget.com
• http://movies.youmustget.com
• http://games.youmustget.com
• http://gadgets.youmustget.com
• http://apps.youmustget.com
• http://stocks.youmustget.com
• http://software.youmustget.com
• http://dvds.youmustget.com
• http://jokes.youmustget.com
• http://vaccinations.youmustget.com
• http://tattoos.youmustget.com
• http://cars.youmustget.com
• http://piercings.youmustget.com
• http://hookers.youmustget.com
• http://starewarsstuff.youmustget.com
• http://drugs.youmustget.com
• http://websites.youmustget.com
• http://cakes.youmustget.com
• http://clothes.youmustget.com
• http://bikes.youmustget.com
• http://girlfriends.youmustget.com
• http://babystuff.youmustget.com
• http://diseases.youmustget.com
• http://travel.youmustget.com
• http://tshirts.youmustget.com
• http://shirts.youmustget.com
• http://wines.youmustget.com
• http://beers.youmustget.com

...and so on, because i bought 'youmustget.com'.

And now I have a slight dilemma. I already own too many urls that I'm not using (this brings my total internet empire to 11.5 sites) And I don't have time to execute on even the simplest ideas in my idea log.

So: how can I crank out a social recommendation/shopping app in under 5 bus trips!?

I want something that produces an output a little bit like this is why i'm broke dot com but where the recommendations come from people i respect, and with affiliate dollars flowing into my wallet on every recommended purchase. (And i'd like to come up with a less-sleazy way to monetize, if possible, but I do have to recoup that $9.95 somehow)

I've begun by creating a Trello board to capture all my ideas. I've got details for the home page, a products page, a user page, and a topic page. I've got a backlog of features that I won't implement at first, and I've got a list of ideas for what technology I'll use where. Next I'll put together some screen mockups and put them in front of my extended team of insult generators lunch buddies.

In the mean time I'll need to keep a cricket bat handy with which to repel the hordes of nodding VCs.

Thoughts?

When I finally starting shipping, Joe Cooney said:

I tip my hat to you - I think in the time I've re-written a few bits of UI you shipped a product.

...in reference to his awesome LogEnvy tool. But it's not a fair comparison, for two reasons.

Firstly, LogEnvy is a much more sophisticated product than NimbleText. LogEnvy does all kinds of powerful manipulation of events logs in a wide range of formats and intersperses it with all the kind of dazzling UI you expect from a WPF ninja. But most of all his statement is incorrect because NimbleText was almost six years in the making.

I wrote the first version in February 2005 and published it as part of a blog post soon after. I wrote it the very same day I came up with the idea for TimeSnapper. It was a stressful week when I desperately needed both of those tools.

Although I was already a .net programmer, I wrote the original code in server-side VBScript for easier deployment. It was just a dozen or so lines. I called it variously 'the data pattern merge tool', 'the merger,' 'the programmer's mate' or the 'text multiplier.' Starting from that day, and continuing right up until the present, I have depended on this tool absolutely daily.

I released a second version in July 2005, and called it 'the world's second simplest code generator'.

The source code is largely a comment block listing all the extra features I wished it had. (And almost all of which, by the way, are implemented in more recent verisons)

A complete rewrite occurred in May 2006 when I started huffing the XSLT pixie dust and thought XSL could solve everything. Its dynamic nature gave it big advantages over the vbscript implementation.

But it soon turned into an exercise in writing a fully fledged compiler and I knew I was headed in the wrong direction.

I wrote an "offline version" around that time, in Windows Forms (VB.net version 1.1) I was never happy with it and didn't release it. If I have the code for it, I don't know where. My clearest memory of it was the way parts of the UI would animate (using a Timer control, of course :-) ).

I re-wrote the tool in August 2007, this time in javascript. Why did I rewrite it in Javasript? Because I was momentarily trapped on a machine that had no development tools, but I still felt like cutting some code. I assumed that browser performance would kill the tool, but I was dead wrong. Javascript was the perfect language for the problem, and the performance of Javascript was just beginning to take off as the browser wars re-ignited.

It was a clear victory for Atwood's Law:

"any application that can be written in JavaScript, will eventually be written in JavaScript."

Or a pre-cursor to Bambrick's Premonition:

"I don't know when skynet will take over. But I know what it will be written in: JavaScript."

I wrote a (playful) WPF version in Oct 2007 (in C#).

I wasn't happy with the tooling for WPF (maybe someone should fix that?), but more-so the dynamic behaviour of javascript trumped C# for this tool, so the WPF version never went anywhere.

Around that time I wrote other undocumented, unreleased versions in powershell and one in ruby (shoes). Powershell was well suited as a language, but lacked the reach of javascript, plus the performance (at that time) was dreadful. The shoes version dissappeared around the same time as _why. (Coincidence? I think not.)

Late last year I decided to release it as a windows app, using a polished and thoroughly bus-tested version of the javascript implementation, wrapped in a browser control inside a skinny winforms shim. Early this year I went live with it, under the new official title of NimbleText. I've hunted down bugs and added features in the months since.

The latest release looks a little more metro than any previous version, as I stripped away a lot of the padding and extraneous lines, simplifying the appearance (and improving a few features as well, of course).

It's kind of amusing that after I chose to shun all of Microsoft's native application development toolkits (wpf, silverlight, and winforms) going with HTML for the UI, it seems like Microsoft have now decided to meet me half way, making HTML a first class citizen in Metro.

Anytime I'm faced with a new platform, I usually implement a version of nimbleText as my own personal hello world, and it looks like Metro will make it easy for me. Porting the heart of this baby to Metro should be a breeze. I'll still have to put in some design effort around how the supporting features are presented (what will happen to the menus, toolbars etc?). But I expect it will be a good ice-breaker.

Meanwhile -- if you ever write code or munge data, save yourself some time and use NimbleText. Both the download and the online version are FREE. There's no time-limit on the application and you only choose to pay if you want the extended features (customizability and commandline integration).

If you have features you want, please leave a comment here or send an email to supportexclude this bit@exclude this bitNimbleText.com

I think i get it now. In Windows 8 you have two modes: metro and classic.

Metro is for exciting responsive new apps that you can use while sitting on a designer couch.

Classic is the Windows of spreadsheets and complex applications that we've used in our day jobs for years.

It's basically a mullet. Business in the front, party in the back.

I'm looking forward to joining the Metro party. I don't know if the business guy is going to host a very good party. But his client list is so long that a lot of great people are bound to be there.

Maybe I'm a little worried it will be like the party that Rick Moranis's character, Louis, is hosting in ghostbusters:

Louis: I'm givin' this whole thing as a promotional expense, that's why I invited clients instead of friends. You havin' a good time, Mark?
[heads across the room, greeting other guests]

It's all going well until a terror dog turns up and terrifies the guests. But I digress.

At first I thought that this metro-fad would only have as much take-up as designing sidebar gadgets in Vista (i.e. approximately none). But the killer features to attract devs is the app store. Having your apps readily available to (potentially) hundreds of millions of people, is a very tempting proposition and bound to attract a lot of developers, possibly including me.

So, does anybody wanna play Parcheesi?

'Cosby' is a small site for generating striped backgrounds (or gradient edges). You can incorporate the code from Cosby into your own asp.net/mvc applications and create striped backgrounds directly from within your Css file.

Once you've got Cosby in place, you can start to magically conjur stripy images out of thin air. Just reference a Cosby image as if it already exists, and it will cause the relevant image to be generated spontaneously and stored on disk for eternity.

For example, if you write: "background-image: url(/Image/Stripes/V/20/FFF/1/000);" then you will get a background with vertical ('V') stripes, alternating between 20 pixels of white (FFF) and 1 pixel of black (000). A moment later you decide you want the black stripes a little wider. Just alter the css (change the 1 to a 2) and they will be. No need to jump back and forth between image editor, filesystem, IDE and browser.

Cosby includes a playground where you can experiment with creating your own backgrounds.

Play with cosby

Get the code

Visit the site

But Why!?

While I was procrastinating about working on my talk for WDCNZ I wanted to mess around with MVC's 'FileResult' which lets you return a file from an action. So I resurrected and mutated the idea behind a Gradient Maker I wrote SIX years ago, using asp.net 1.0, and ended up with this latest monstrosity. (Cosby also lets you generate gradients, though I haven't done much with that feature)

The code is published at cosby.secretGeek.net, so feel free to grab it, criticise it, and forget about it.

And of course the name is a reference to Bill Cosby's infamous Cosby sweaters, which get their own detailed write up on wikipedia. I was recently heartened to see 'Cosby sweater' amongst the text generated by the hipster ipsum random text generator.

That's all for now.

I am just returned from an excellent holiday in New Zealand, wherein I talked about MVC 3 at the first ever WDCNZ in Wellington.

On the day of the talk I was deathly ill, so it was a very much less animated talk than I wanted to give, but still enjoyable (for me, if not the audience). I missed out on seeing the rest of the conference, which is a real bugger.

In particular I wanted to see Paul Irish on Html5, but I did at least get to meet him for a quick chat the day before. Other speakers I met the day before were pretty interesting to talk to and I very much wanted to see the talks by Kirk Jackson and Jeffrey Wegesin, among others.

Here's my slides, using an updated version of Higgins. You'll need to unzip them, then you can see the readme file, the slides themselves (by viewing higgins.html) or look at the included code.

Slides and Code for 'Live Coding Asp.net MVC 3'

The talk covers Razor syntax, Display and Editor Templates, custom Code Templates and custom Project templates. Thankfully, there is no video.

Joseph Cooney built a special utility to help with the talk, called 'BigNote' -- available from bignote.codeplex.com.

This is a handy tool for presenters. Invoke it with a hotkey (ctrl-F1) and then it lets you write in giant letters on top of the desktop. Very slick.

I had a slight panic during the talk when I realised that Joe Cooney, creator of ComputerUnlocked.com could have used the opportunity to slip any kind of nasty prank into the tool, just to punk me in front of a room full of strangers. But luckily he slipped up and missed the opportunity.

One other thing I ought to mention: the Dell laptop I bought in anticipation of the presentation turned out to be a total dud. I was only rescued the day before leaving Australia when Paul Stovell managed to hook me up with an old laptop of his, which performed flawlessly. Thanks Paul!

Web Dev Conf New Zealand (WDCNZ), is in Wellington very soon (schedule on lanyrd), and I'll be talking there about all things MVC 3. This is keeping me awake nights, I can tell you.

I've applied to talk at the stack overflow dev days conference in Sydney in October. That would be an absolute blast. I rank my chances pretty low, but my excitement is high regardless.

Recently I talked at QMSDNUG, on 'MVC 3: Third Times a Charm', alongside Joe Cooney. It was a lot of fun, and we allegedly broke a record with our crowd size. It's basically a preview of what I'll cover in Wellington, though some material will be in or out as I revise.

(Higgins got another workout, and had some html5 goodness baked in)

I promised to put up the references from my talk. They're mostly about customizating your MVC 3 experience in Visual Studio. Here they are.

If you use MVC 3, what are your favourite bits? What would you cover in a talk? If you don't use it, why not? And what are the sort of things you'd like to see deomonstrated?

Cool looking 404 pages are the new hotness. Github has an amazing parallaxing 404 page that allegedly cost more than any other feature on their site.

For a lot of sites, the 404 page is the most visited page, so it's worth getting it right.

The website for my new product, NimbleText, uses asp.net mvc. A framework I really enjoy. The gu wrote it on a plane. Before takeoff.

One of the more voodoo aspects of getting NimbleText.com into production was setting up a succesful custom 404 page. Here's what I came up with: check it out.

Some of the articles out there that cover custom errors in asp.net MVC seemed to be a little bit confused about exactly what is going on, many are out of date or incomplete and some are downright misleading.

So once and for all I want to give a definitive guide to error handling in asp.net MVC.

Here we are. Just eleven simple steps to follow for amazing results.

First, map a catch-all route in global.asax, at the end of your other routes. E.g.

routes.MapRoute(
   "404-PageNotFound",
   "{*url}",
   new { controller = "StaticContent", action = "PageNotFound" }
);

Second, create an Error Controller, like this:

public class ErrorController : Controller
{
   [AcceptVerbs(HttpVerbs.Get)]
   public ViewResult Unknown()
   {
     Response.StatusCode = (int)HttpStatusCode.InternalServerError;
     return View("Unknown");
   }

   [AcceptVerbs(HttpVerbs.Get)]
   public ViewResult NotFound(string path)
   {
     Response.StatusCode = (int)HttpStatusCode.NotFound;
     return View("NotFound", path);
   }
}


Third and fourth -- create custom views to handle the Unknown and NotFound actions above.

Fifth, create a page called Custom404.htm and add it to the root of your application. Use it to display a helpful, edgy and hopefully cool message. But don't be too edgy.

Sixth, add this to web.config, inside the system.web node:

<customErrors mode="RemoteOnly" defaultRedirect="GenericErrorPage.htm">
   <error statusCode="404" redirect="/Custom404.htm" />
</customErrors>

Seventh, add a httpErrors element inside the system.webServer node:

<httpErrors>
   <error statusCode="404" subStatusCode="-1" path="/custom404.htm" responseMode="Redirect" />
</httpErrors>

Eighth, inside your existing controllers, if there is no data to serve (e.g. if someone asks for a UserId that doesn't exist) then use this snippet of code:

throw new HttpException(404);

Ninth, inside Global.asax, look for the RegisterGlobalFilters method (it will be called during Application_Start), and add another global filter, to handle any specific exceptions in your code, like this:

filters.Add(new HandleErrorAttribute
    {
        ExceptionType = typeof(FileNotFoundException),
        View = "Custom404", // Custom404.cshtml is a view in the Shared folder.
        Order = 2
    });

Tenth, add a view called Custom404.cshtml under views/shared.

And, eleventh, take care to handle the global application error event, capturing and logging any errors, before redirecting to the views you're after:

protected void Application_Error(object sender, EventArgs e)
{
    Exception exception = Server.GetLastError();
    Response.Clear();
    HttpException httpException = exception as HttpException;
    if (httpException != null)
    {
        string action;
        switch (httpException.GetHttpCode())
        {
            case 404:
                // page not found
                action = "HttpError404";
                break;
            case 500:
                // server error
                action = "Internal500";
                break;
        default:
            action = "General";
            break;
        }
        // clear error on server
        Server.ClearError();
        Response.Redirect(String.Format("~/Error/{0}/?message={1}", action, exception.Message));
    }
}


Good.

Now your website is well and truly borked.

Every request will bounce around your application like a demented pinball tripping on acid.

When an error happens, a bunch of different code modules will go to war.

The victorious code module will tear out the entrails of all those who oppose it, and throw them in the visitor's face.

You'll get a different error handler depending on what version of IIS you have, what version of MVC you're using, whether you've deployed in debug or release, whether you're visiting locally or remotely, whether it's sunny or raining.

Your server will be reduced to a pile of smouldering rubble from which reboot is impossible.

But if you want to get truly weird, try setting up a custom 403 page. That's about three times as odd.

Or, switch to Dos on Dope*. Life will be simple again.

Sorry I didn't really have time to write a definitive guide to this stuff. Error handling in MVC is crazy man, I'm busy fighting a clandestine war against hackers and crackers and bots and beuracrats: I can't be documenting that kind of mystery wrapped in an enigma.

If someone does write a complete guide to error handling in MVC, that includes the meaning and interaction behind each of these snippets, plus how the interplay between IIS, asp.net and MVC truly works, then I will happily update this article to include a link to it, right up top.

* Don't switch to Dos On Dope.

My relentless campaign of jokes and nonsense will not be stopped.

And now, just a couple of long weeks later, here I am, happy to report I'm back in control of secretGeek.net.

Right when I was ready to migrate over to leonbambrick.com, I got an email from the Russian registrar, Regtime Ltd, saying:

Sorry  for answer delay. Domain was transferred onto you account.

The number one thing, I think, that helped get the site back was when a good friend, Madina, translated a lengthy email into fluent Russian for me to send to the Russian Registrar.

She re-structured the email to put the sob-story up front, all about how much personal meaning this site has for me, and the positive effects it has had on my life. I think that did the trick.

So what did we learn?

I learnt that passwords at google can be brute forced, if pop is enabled. This can be sped up by use of multiple IP addresses, or a botnet.

That's the most likely way they got access to my account. My password was 'good' by gmail standards but is now 'freaking solid' by any standard.

And I've turned on 2-step verification, plus all the other recommendations from part 1.

Thanks for the encouragement and support. It was dark times, but now the nonsense can continue.

If you have any information that could help me get control of my domain again please leave a comment, or tweet me (@secretgeek), or get in touch via my (now re-secured) email address, leonbambrick@gmail.com

From Russia with Love

On Monday 9th May, I checked my gmail account at around 3:40 in the afternoon, and I was confronted with a dark red message at the top of the screen (in the area where you normally see messages like 'Your email has been sent'). The message said:

Warning: we believe your account was recently accessed from: Russia. Show details and preferences | Ignore

I clicked on 'show details and preferences', and a new window opened with this message:

(click to see the message in context -- [note that my own ip addresses are redacted])

This was definitely not me. At 4:19 AM, and 5:40am I had been far too busy being fast asleep, preparing for a big week, to get to Russia and back for some casual email reading. So someone had infiltrated my email. The freaking out sensation began immediately. I couldn't move. I was frozen completely still.

I followed google's advice and immediately changed my password, then notified my wife. My mind was racing as to what the implications could be.

A little voice told me to check the trash. I was really hesitant, I think I knew the trash would contain something I didn't want to see.

In the trash I found two messages, received at 5:45am.

The content of the messages was to explain that my domain, secretGeek.net, had been succesfully transferred from my registrar, GoDaddy, to a Russian registrar, Regtime Ltd.

I felt completely unreal, like this was a dream, or a prank. I logged into my GoDaddy account to check on my domains. They all still appeared to be there. I took a few deep breaths. I felt it must be all just a daydream. I read the list carefully. No -- secretGeek.net was missing from the list. All of the others were still there.

I started sending emails to GoDaddy. I replied to the emails I'd found in the trash, telling them that it was a mistake, the result of my email being violated.

I lodged support requests with GoDaddy. When I went back to the trash to read the deleted emails again I found there were new messages in the trash. Emails from godaddy in response to my support requests had been automatically deleted. This was *weird*. It was a few minutes before the penny dropped.

I looked in my gmail filters and there were two new ones. The two new filters were designed to delete any messages containing the words 'GoDaddy' or 'Webnames'. (I later found that 'Webnames.ru' is the trading name of 'Regtime Ltd', the Russian registrar holding secretGeek.net)

This was starting to become very 'real'. This wasn't some kind of misunderstanding. It was definitely a thing. It was a deliberate, targeted attack, by a person or people who knew what they were doing and had either done this thing before or had thought it through very carefully.

I turned to my friend, Joe Cooney, to show him what I'd found. He was equally gobsmacked. He told me to call GoDaddy on their support number and see what they said.

A whois request on secretGeek.net showed that my name servers were still listed, but the registrar was Regtime ltd, and the contact information was all blank.

The support guy at GoDaddy told me to contact the gaining registrar and find out what their policy is for transfer disputes. He told me there was nothing GoDaddy could do (turns out this was bad advice, by the way)

I was busy worrying about what else was in danger. My wife was already on the task of changing every password, keycode, and security question associated with all of our bank accounts, credit cards, online identities, home pcs etc, and checking at each of these places for any trace of unusual activity.

In order to send a support request to the Russian registrar, I had to sign up as a member (and I noted with some distaste that they sent me my new password in plain text.) I sent them multiple emails explaining what happened. Then I re-sent each of those messages, in Russian this time, translated by translate.google, and including the original text.

I worked late that day to make up for the lost time and somehow managed another check-in before I went home.

That night I called GoDaddy again, hoping to get more help. By now I'd read about the similar case of David Airey where a gmail vulnerability led to a domain hijacking, which also involved godaddy. This time I got a more helpful support staff member. She told me to fill out the 'dispute on transfer away' form at GoDaddy, which I promptly did. This meant that the right people at godaddy would be notified, and they'd contact the Russian registrar to request the domain be returned.

Wrapping up part 1.

While there's more that's happened since, things haven't really progressed since that day at all.

I still haven't regained control of the domain. I'm waiting on word from the Russian registrar. I remain hopeful that any minute now I'll get an email from them saying "Ah, we're sending back your domain!" -- but my hope is fading.

The name servers haven't been changed, so my content continues to be served up as always. If it does go down, the plan is to launch a new and improved secretGeek at LeonBambrick.com. Announcements or news will be via twitter (@secretGeek) or from my business website, NimbleThing.net.

If you have any information that could help me get control of my domain again please leave a comment, or tweet me (@secretgeek), or get in touch via my (now re-secured) email address, leonbambrick@gmail.com

In the next part of the story I want to discuss gmail security, all of the possible ways I could've been hacked, and the one I think is most likely. But I can't wait until then to put out the following checklists. These are steps that you can do to protect your email account and to protect your domains:

What can you do to stop this happening to you?

Protect your email via:

• Change your password often. For example, right now.
• Make your password very strong.
• In gmail: disable POP.
• Ensure your password recovery options are as strong as your password.
• Make sure 'always use https' is selected.
• In gmail: check for unusual activity (it's available at the foot of the screen).
• In gmail: don't let any other apps be associated with your account.
• Use two-step authentication.

Protect your domains via:

• Pay for private domain registration.
• Pay for enhanced transfer protection. (e.g. at GoDaddy they call it 'Deadbolt' protection, and it means they require you to send them identification before they'll approve a transfer.)

A person with a Russian IP address broke into my email account and used that access to transer ownership of the secretGeek.net domain to a Russian registrar, webNames.ru.

The full story is jam packed with intrigue, daring adventure, black ops helicopters, sexy double agents, Ukrainian php developers, and a liberal dash of nerdy security best practices.

I will tell the full story once I have secured my domain again.

In the meantime, if your beloved secretGeek.net is suddenly replaced by a spammy porn site or variant thereof, do not despair. Follow me on twitter (@secretGeek) or head to my business website (NimbleThing.net) where (if necessary) I will mirror the original secretGeek content and continue blogging until I've taken charge of the domain again.

So here was the problem...

On one of my machines, in recent months, anytime I tried to run an asp.net application that attempts to connect to a SQL Server database I receive this error:

Login failed. The login is from an untrusted domain and cannot be used with Windows authentication.

This is in a scenario where everything is local: I'm on a home computer, using a local database server. And it doesn't matter if I'm using IIS, webdevserver, or IIS Express. It doesn't matter if I'm trying to connect to SQL Express or SQL Server 2008 r2. I can enter the credentials using the machine name or IP address. The result is the same.

Looking in the Windows Event Viewer I see:

SSPI handshake failed with error code 0x8009030c, state 14 while establishing a connection with integrated security; the connection has been closed. Reason: AcceptSecurityContext failed. The Windows error code indicates the cause of failure. [CLIENT: ].

Most of the 'solutions' online were not applicable because they involve domain issues. This is just a local machine.

One particular forum message involved a guy with a similar setup to me. He solved the problem for himself, but left behind only this very abbreviated and somewhat cryptic explanation:

Solved. Traced the prob. to my net setup. The clue was this a msg in the Win System Log from Lsasrv about the target name and it showed the fqdn. Did some checks and the fqdn didn't look right, cleaned up my network config (I had customized it for another project), and now it's workin.

The 'fqdn' is the fully qualified domain name. I found three different ways to find my fqdn, and one of them disagreed with the others! So this was a smoking gun.

Method 1 for finding the fqdn: When I right clicked on "computer" in the start menu and looked at the properties, the 'full computer name' was reported as 'Leon_xps'.

Method 2 for finding the fqdn: When I ran "ipconfig /all" and got these values for Host Name and Primary Dns Suffix:

   Host Name . . . . . . . . . . . . : Leon_xps
   Primary Dns Suffix  . . . . . . . : 

(Add them together and you get a fqdn of just 'Leon_xps'

Method 3 for finding the fqdn: In cmd when I ran 'ping -a Leon_xps' I saw a very unexpected result!

It said:

Pinging leonx_xps [192.168.1.2] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Notice that it's changed the name 'leon_xps' into 'leonx_xps' and come up with the ipaddress of '192.168.1.2'. instead of what I expected (such as a loopback address, 127.0.0.1... or some IPv6 nonsense)

There's only one kind of alchemy I know of for turning a good name into a crazy ipaddress: and that's the magic of the HOSTS file.

So I looked in there for 'leonx_xps' and I found it. Found this crazy nonsense line, probably added by myself during some other wild-goose-chase for a solution to some other messed up problem:

192.168.1.2 leonx_xps leon_xps

Once I'd commented out that rule, the asp.net application immediately started to connect succesfully to SQL Server 2008 r2. And I can move forward with my testing of Massive and Dapper.

But just mentioning the probable cause of this (not cleaning up during an earlier problem-panic) I remember that earlier tonight, while frantically trying to fix this problem I added some stupid rules to the windows firewall. I had better go and remove them now before my computer gets owned. Hey wait a moment!? Why is my CPU at 100%? Be right back...

I gave a talk at Brisbane's alt.net recently. You can download the slides here (1.5M zipped) or:

View the 97 slides online here

                (use arrow keys to advance)

The theme was 'Coding on the Bus' -- the optimisations and approach I've used for cranking out a dozen mini projects on my daily commute in the last year.

A bus is a seemingly counter-productive environment. As I say in one of the slides:

If your workplace was like a bus: everyone would quit.

And yet I'm producing a lot of stuff while on that short ride, definitely pushing the limits of my abilities. So this talk was an attempt to extract all the lessons I could from this real life productivity success story.

TL;DR;

Here's the quick version:

#1 Internet is bad
#2 Keep it damn simple
#3 Value your tools/libraries/snippets
#4 Don't be a hero

The people at Brisbane Alt.Net are a very cluey bunch so it was great to get their input on the whole thing. They were a very attentive and helpful bunch. It was a massive buzz talking to them. I highly recommend it.

...And Introducing Higgins

Naturally, I wrote the slides about writing on the bus, while on the bus. I don't have Powerpoint on my bus netbook, so I also had to write my own html-based slide presenter, which I've codenamed Higgins.

I've since added higgins to codeplex. You can get Higgins from codeplex and use it yourself, if you're so inclined.

Visit higgins at codeplex

Download higgins here