David Hayes

Before the Mac and Linux fanboys jump all over this (as they have in several other blogs who have mentioned this report). I’ll point out upfront the following:

• Yes, the guy who wrote the report works for Microsoft
• No, this doesn’t (necessarily) mean he is biased
• I use Linux (several flavours), Unix and Windows both at work and at home so I’m not biased either (although Macs suck of course, just checking to see if Simon still reads my blog :))

The Vista 6 month vulnerabilty report shows that Vista had less security bugs than XP, RHEL4 Workstation, Ubuntu 6.06 LTS, Novell SLED10 and Mac OS X 10.4. The report is based mainly on data available in the National Vulnerability Database so if I decided to compile this report I’d get similar figures (disclosed but unfixed problems being harder to track due to the number of places problems are disclosed).

There is a long held (much promoted) belief that using Linux or Mac OS X makes you immune to viruses etc. and similarly the fallacious belief that using FireFox or Safari makes you immune to any internet badness. This was (perhaps) ever so briefly true because the bad guys (people who want to ‘own’ your computer) logically focused on Windows due to it’s huge user base and the good guys (security researchers etc) did the same for similar reasons. This (combined with the let’s bash MS because it’s cool movement) started the whole “Use Linux/Safari… because it’s more secure” movement. The movement has largely been successful, more and more people are using Macs (although I think the ‘iPod effect’ has had a lot to do with that) and Linux is becoming much more popular and starting to look viable as a desktop system for the masses.

To my mind this ‘movement’ is starting to have exactly the opposite effect. The scrutiny MS is under and the intense bashing they have had from not focusing on security has placed them under immense evolutionary pressure. There is an arms race running between the bad guys, the good guys and the Microsoft. The bad guys have got more and more sophisticated in there attacks the security researchers have developed better and better tools to find bugs in Windows, Microsoft have their Trusted Computing Group to improve code security. The net result of all of this is Windows has got much more secure (as shown by the recent Vista release).

On the other side of the table the increased user base of Linux, OS X, Safari etc is making them attractive targets to both the bad guys and the good guys so more and more vulnerabilities are being found in products that were traditionally believed to be more secure than their MS equivalents. Obviously MS have a huge marketing problem to solve since they are still widely believed to be the producers of shoddy insecure software. Looking at Slashdot I think it’s going to be a whole generation before they get over this hurdle.

To conclude, I really hope that the end of all this is more secure software for all of us. Software is complex and (arguably) the most difficult area of engineering today. Once you add the interactions between different packages and the OS there are (amost literally) an infinite number of ways things can go wrong. With the current state of software engineering it is impossible to eliminate all the bugs and even if you had managed it you’d never know.

/Technology /Rants, /Technology

Just checked my weblogs and found out Yahoo Slurp has used over 13GB of my precious bandwidth (compared to 2GB for the whole of May) this month, the next closest is GoogleBot at around 1GB. Needless to say I’m not very impressed so I’m going to block them until their bot learns to behave. Grrrr

/Technology /Rants, /Technology

Jeff Atwood has a very interesting article on Giving Up on Microsoft. Like him I’ve spent most of my professional life using Microsoft tools, I started out on Visual Basic (which for all the knocks it gets is a massively productive language) and I moved to C# around 4 years ago although I started dabbling in my own time when the early betas were around.

Herectical as it may be to some people I find that Microsoft tools generally “just work” which is great, they are tools after all and that is the way it should be. I find C# the language to be superior to Java the language (platform wise is a little less clear cut). But C# is essentially the child of Java/C++ and VB so that makes sense.

You might now be thinking that I’m another MS zealot and I hate open source software. I’m not! I’m also a Java Certified Programmer (for all that means) and a reasonably competent (albeit rather rusty) PHP developer. I run several OSs including XP, Vista, Ubuntu, Debian and Centos and I’m happy compiling kernels (if I have to)

I really believe the worst thing you can be in life is a zealot, it’s important to think rationally about decisions you make and not just do something because Microsoft is evil or Open Source is hard to use and ugly. If you do this you’re not going to end up with the best solution for you or your client

Bigotry is bad, mmmk

/Technology /Rants, /Technology

Hmmm, haven’t quite managed to blog as much as I’d hoped due to work commitments (hard work getting back into working a full day after 4 months of i can tell you) and a couple of interesting side projects (setting up a media center pc and one I can’t tell you about).

Anyway on with the point of this blog… I’ve finally found time to put my little linux server back together. I decided to pull the harddrive out of my old backup server and put both drives in the more powerful box. This seemed like a sensible point to reinstall (it was running an ancient Debian install).

The first big logistical challenge I ran into is that I don’t have a spare CD drive kicking about and I’m way to lazy to pull one out of my other computers. So this leaves me with trying a USB memory key install, trying to find my USB floppy drive (and hoping my mini-itx mobo will boot from it) or PXE. Since my iPod shuffle died and the low probability I could persuade my machine to boot from USB I decided to try PXE again.

My intitial run in with PXE was several years back and there was a lot of tutorials on how to set it up onlinux but almost nothing about how to get it working on a Windows machine. This time a quick visit to google turned up Ubuntu PXE install via Windows. A quick download of an ftp client (Smart FTP, very impressive bit of software by the way) and grabbing the ubuntu installs and I had a directory looking like this

 Directory of C:tftp 

04/05/2007  04:34 PM    <DIR>          .
04/05/2007  04:34 PM    <DIR>          ..
20/10/2006  05:42 PM         8,315,725 boot.img.gz
20/10/2006  05:42 PM         8,849,408 mini.iso
20/10/2006  05:42 PM         8,381,337 netboot.tar.gz
20/10/2006  05:44 PM            13,156 pxelinux.0
04/05/2007  02:48 PM    <DIR>          pxelinux.cfg
22/04/2007  02:53 AM           192,512 tftpd32.exe
04/05/2007  02:42 PM    <DIR>          ubuntu-installer
               5 File(s)     25,752,138 bytes 

 Directory of C:tftppxelinux.cfg 

04/05/2007  02:48 PM    <DIR>          .
04/05/2007  02:48 PM    <DIR>          ..
20/10/2006  05:42 PM             1,799 default
               1 File(s)          1,799 bytes 

 Directory of C:tftpubuntu-installer 

04/05/2007  02:42 PM    <DIR>          .
04/05/2007  02:42 PM    <DIR>          ..
04/05/2007  02:46 PM    <DIR>          i386
               0 File(s)              0 bytes 

 Directory of C:tftpubuntu-installeri386 

04/05/2007  02:46 PM    <DIR>          .
04/05/2007  02:46 PM    <DIR>          ..
04/05/2007  02:46 PM    <DIR>          boot-screens
20/10/2006  05:42 PM         6,850,004 initrd.gz
20/10/2006  05:43 PM         1,574,481 linux
20/10/2006  05:44 PM            13,156 pxelinux.0
04/05/2007  02:46 PM    <DIR>          pxelinux.cfg
               3 File(s)      8,437,641 bytes 

 Directory of C:tftpubuntu-installeri386boot-screens 

04/05/2007  02:46 PM    <DIR>          .
04/05/2007  02:46 PM    <DIR>          ..
20/10/2006  05:42 PM               301 boot.txt
20/10/2006  05:44 PM               880 f1.txt
20/10/2006  05:44 PM               723 f10.txt
20/10/2006  05:44 PM               740 f2.txt
20/10/2006  05:44 PM               807 f3.txt
20/10/2006  05:44 PM               416 f4.txt
20/10/2006  05:44 PM               806 f5.txt
20/10/2006  05:44 PM             1,004 f6.txt
20/10/2006  05:44 PM               916 f7.txt
20/10/2006  05:44 PM             1,066 f8.txt
20/10/2006  05:44 PM               766 f9.txt
20/10/2006  05:44 PM             8,023 splash.rle
              12 File(s)         16,448 bytes 

 Directory of C:tftpubuntu-installeri386pxelinux.cfg 

04/05/2007  02:46 PM    <DIR>          .
04/05/2007  02:46 PM    <DIR>          ..
20/10/2006  05:42 PM             1,799 default
               1 File(s)          1,799 bytes

A quick change of the bios settings to persuade it to boot from the LAN and … nothing. It took a fair amount of fiddling with the settings in tftp to get it to work. This is what I ended up with

The important bit seemed to be the “ping before assignation”

If all is well you should end up with something like this in the tftp log window

Rcvd DHCP Discover Msg for IP 0.0.0.0, Mac 00:40:63:C9:E7:70 [05/05 08:37:28.716]
Client requested address 0.68.101.74 [05/05 08:37:28.716]
DHCP: proposed address 192.168.0.15 [05/05 08:37:28.716]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac 00:40:63:C9:E7:70 [05/05 08:37:30.700]
Previously allocated address 192.168.0.15 acked [05/05 08:37:30.700]
Connection received from 192.168.0.15 on port 2070 [05/05 08:37:30.708]
Read request for file <pxelinux.0>. Mode octet [05/05 08:37:30.708]
Using local port 49564 [05/05 08:37:30.708]
<pxelinux.0>: sent 26 blks, 13156 bytes in 0 s. 0 blk resent [05/05 08:37:30.752]
Connection received from 192.168.0.15 on port 57089 [05/05 08:37:30.768]
Read request for file <ubuntu-installer/i386/boot-screens/boot.txt>. Mode octet [05/05 08:37:30.817]
OACK: <tsize=301,> [05/05 08:37:30.817]
Using local port 49575 [05/05 08:37:30.817]
<ubuntu-installeri386boot-screensboot.txt>: sent 1 blk, 301 bytes in 0 s. 0 blk resent [05/05 08:37:30.820]
Connection received from 192.168.0.15 on port 57100 [05/05 08:37:30.821]
Read request for file <ubuntu-installer/i386/boot-screens/splash.rle>. Mode octet [05/05 08:37:30.821]
OACK: <tsize=8023,> [05/05 08:37:30.822]
Using local port 49576 [05/05 08:37:30.822]
<ubuntu-installeri386boot-screenssplash.rle>: sent 16 blks, 8023 bytes in 0 s. 0 blk resent [05/05 08:37:30.883]
Connection received from 192.168.0.15 on port 57101 [05/05 08:38:02.012]
Read request for file <ubuntu-installer/i386/linux>. Mode octet [05/05 08:38:02.013]
OACK: <tsize=1574481,> [05/05 08:38:02.030]
Using local port 49577 [05/05 08:38:02.030]
Connection received from 192.168.0.15 on port 57102 [05/05 08:38:05.132]
<ubuntu-installeri386linux>: sent 3076 blks, 1574481 bytes in 3 s. 0 blk resent [05/05 08:38:05.132]
Read request for file <ubuntu-installer/i386/initrd.gz>. Mode octet [05/05 08:38:05.132]
OACK: <tsize=6850004,> [05/05 08:38:05.132]
Using local port 49578 [05/05 08:38:05.132]
<ubuntu-installeri386initrd.gz>: sent 13379 blks, 6850004 bytes in 13 s. 0 blk resent [05/05 08:38:18.362]

/Technology /Technology

I’ve been meaning to blog this for ages…

When we switched from our own server (living under my monitor) to a hosted server in the US (by the way we’re using Eapps and they are fantastic and great value too) I discovered they use mbox format on their server rather than Maildir. “Easy” I thought, “a quick google search will sort that out”. Well it turns out I was very wrong and all the scripts are going the other direction (a much more sensible direction I have to say but I wanted an easy to administer server so I didn’t want to change anything unless I had too).

Eventually I stumbed upon this script (maildirtombox.sh which worked admirably. I’m afraid I can’t remember where I found it but it was written by a guy called Joerg Reinhardt (thanks by the way) so he deserves all the credit.

/Technology /Technology

I’ve been working over the last few days to switch over to a proper hosted server (rather than an underpowered box on my desk)! This will solve the downtime problems we’ve been having recently. I’ve also upgraded to the much smarter Pebble 2. Things may be a little weird as the DNS change propogates. If anybody is interested you can take a sneak peek.

/Technology /Technology

Get required software

1. Java SDK (JDK) from Sun (you should already have this)
2. Java Wireless Toolkit (WTK) also from Sun
3. Optionally get and install Ant and Antenna to allow you to automate your build (I’d strongly recommend these)

Import an existing certificate (if you have one)

1. If you’ve purchased a certificate from Verisign (or another provider) you need to import the certificate into your J2SE keystore.
2. Try using the following command keytool -import -alias {myalias} -file {mycertificate} (I haven’t been able to test this since I don’t have a proper certificate)
3. Run keytool -list to see your new certificate
4. Next you must export the certificate so you can import it to your phone
5. Run keytool -export -alias {myalias} -file mycertificate.crt
6. Import the certificate into your phone (see below for details)

Create and import a new (test) certificate

1. You need to use keytool (from the JDK)
2. I used the following command keytool -genkey -alias {myalias} -keyalg RSA -validity 365
3. This will prompt you for a keystore password, enter your keystore password (if you have an existing keystore) or the one you want to use if you don’t have one yet
4. Fill in all the prompts about location/company name etc.

   C:\j2sdk1.4.2_08\bin>keytool -genkey -alias company -keyalg RSA -validity 365
Enter keystore password: password
What is your first and last name? [Unknown]: My Name
What is the name of your organizational unit? [Unknown]: company
What is the name of your organization? [Unknown]: company
What is the name of your City or Locality? [Unknown]: location
What is the name of your State or Province? [Unknown]: location2
What is the two-letter country code for this unit? [Unknown]: GB
Is CN=My Name, OU=company, O=company, L=location, ST=location2, C=GB correct? [no]: yes
Enter key password for (RETURN if same as keystore password):

5. Run keytool -list to see your new certificate
6. Next you must export the certificate so you can import it to your phone
7. Run keytool -export -alias {myalias} -file mycertificate.crt
8. Import the certificate into your phone (see below for details)

Build and package the application

1. Use javac to build your MIDlet paying special attention to your classpath and bootclasspath options (otherwise preverification will fail). I also set target to 1.1 and source to 1.3
2. Generate your JAD file the critical attributes in the JAD are MIDlet-Jar-URL, MIDlet-Jar-Size, MIDlet-Permissions we also included MIDlet-Icon, MicroEdition-Configuration, MicroEdition-Profile, MIDlet-Name, MIDlet-Push-1, MIDlet-Icon, MIDlet-Description and MIDlet-Version
3. Generate the MANIFEST.MF file based on your JAD, you must remove MIDlet-Jar-Size and MIDlet-Jar-URL
4. Both these tasks can be completed using the wtkJad Antenna task
5. Package and preverify the app using the wtkPackage Antenna Task you must set the classpath and bootclasspath properties correctly otherwise Preverification will fail

Sign the application

1. Sign the Application using jarsigner
2. Run jarsigner -keystore {mykeystore} -storepass (mypassword} {myjar} {myalias}
3. Now you have a signed jar you need to update the MIDlet-Jar-Size in your JAD
4. Now add the certificate to the JAD using JadTool.jar from the WTK
5. Run java -jar JadTool.jar -addcert -alias {myalias} -storepass {mypassword} -keystore {mykeystore} -inputjad {myinputjad} -outputjad {myoutputjad}
6. Now add the signature to the JAD again using JadTool.jar
7. Run java -jar JadTool.jar -addjarsig -alias {myalias} -jarfile {myjar} -storepass {mypassword} -keypass {mypassword} -keystore {mykeystore} -inputjad {myinputjad} -outputjad {myoutputjad}

Deployment

1. Deploy this to a web server with the MIME types set correctly and download it to your phone and it will be a trusted 3rd party application
2. You can also deploy applications to phones by sending the JAR & JAD to the phone over Bluetooth or Infrared or a cable depending on your phones features. On Nokia phones the files
   appear in your SMS Inbox

Installing the Certificate on the phone

1. Import the certificate into your phone, in Windows XP SP2 I could do
   this by right clicking the file and selecting "Send to Bluetooth Device",
   you should be able to send files by cable or Infra Red (IR) too. NB: I
   haven’t found anyway of importing a certificate on a Series 40 phone
2. Once the certificate is installed it needs to be authorised for
   "Application Installation". On my phone (Nokia 6680) this is under
   Tools->Settings->Certificate Management->Trust Settings, I turned on
   everything but I think "Application Installation" is all you need

Common Problems

1. Application not installed using the JAD: The application is only trusted if it is installed using the JAD, the application will still install from the jar but it won’t be trusted.
2. Application trust settings not set: Once your application is installed you need to specify how much trust to give it (it doesn’t get all permissions by default). On a Nokia Series 60 phone these are found under the App. Manager.
3. Root certificate missing from phone: The Java Verified certificate and/or Verisign certificates are missing from some phones check under Tools->Settings->Certificate Management for the relevant certificate
4. Authorization Failed: - There are a whole host of possible reasons behind this here are the ones I’ve come across
   1. Certificate missing from phone, double check your certificate is installed and has been marked as trusted for application installs in Certificate Management
   2. Reboot: Uninstall the application completely then reboot your phone try taking the battery and SIM out too, often things get themselves in a twist, especially if you’ve been re-installing a lot without uninstalling first
   3. JAD/JAR mismatch: Double check the application size in the JAD, remember it’s the number of bytes that is important NOT the size on disk
   4. Browser cache: If you’re installing over the air make sure you clear your browser cache before installing
   5. I’ve heard but not verified that line breaks in the MIDlet-Permissions can cause problems but it seems ok to me on Nokia 6680/6630/6230i (could be firmware dependent?)
   6. The MIDlet-Permissions attribute is the cause of a lot of problems (especially since the documentation is often wrong/missing or different depending on the phone), try leaving it out first and add permissions in one at a time. Some phones will complain about permissions they don’t support, some will ignore them
5. There is a bug in some early Nokia 6600 firmwares that stop the install of trusted MIDlets
6. Certificate not valid yet: If you generated the certificate yourself it may have a start validity date of tomorrow, also if your PC and phone dates are different you may be outside the period of validity of the certificate
7. No certificate management on Series 40 phones, you can install a signed application but behavior is strange with self signed certificates
8. JadTool problems: I haven’t experienced any of these issues but lots of other people have
   1. "I have issues if I try to use the jadtool manually. I have a certificate chain and can’t seem to get the second certificate added to the JAD file using any WTK jadtool. The interesting part however is that I can successfully sign the midlet using any of the same WTK GUI interfaces - they add the second certificate correctly. My steps:
      1. Use 1.4.2_06 jarsigner.exe to sign jar
      2. Use WTK (2.2 or 2.3 beta) jadtool to addcert with certnum 1
      3. If I call jadtool to addcert with certnum 2 the same certificate is inserted as cert 1-2 I’m assuming I am doing something incorrectly since the WTK gui seems to be working just fine"
   2. "I received a post on the KVM news group on the topic that states there is a bug in the jadtool and the author claims to have filed a bug report and posted a patch: http://archives.java.sun.com/cgi-bin/wa?A2=ind0508&L=kvm-interest&F=&S=&P=9858 One interesting note that was also posted was that the cert JAD params are static so once you get them from the WTK correctly you can put them statically in the ant script."
   3. "I am trying to sign a MIdlet for Nokia 6620 device. I am using a Verisign Code Signing certificate that actually contains two certificates (User and Intermediate CA). I am using the WTK 2.2 signing tool. Do you know if this tool support two certificates when signing ? The signature is added to the JAD file with two certificates but I have been getting security error when installing. I have checked on the device and there are different root certificates installed for Verisign but it still fails !
   4. "If you want, you can download the sprintpcs developer kit as it supports dual certs (http://developer.sprintpcs.com). However, I never got that cert to work on the Nokia (6620/cingular) phone, although it does work on sprint phones (with developer root enabled). Ultimately, I only got things to work by creating the cert as described in this blog and installing that on the phone. Bizarrely, even though the root cert for my versign-signed cert *was* on the 6620 phone, it still would never install my MIDlet as you would think it should."
9. Old phones (6230/i, 6682) don’t support x509 certificates, WPKI has been suggested as a possible solution but I haven’t investigated this
10. Socket connections can be problematic (http://discussion.forum.nokia.com/forum/showthread.php?t=68306 ) possibly due to the WAP infrastructure and the services provided by an operator. HTTP is a much safer protocol to use
11. "Go online and check application validity": Yes/No. If I click on yes button the phone I get the following error: "Certificate revoked for this application" and the installation fails. To rectify this go to Tools -> Manager -> Menu -> Settings -> Online Certif Check [ On / Off / Required] There is also a Default address setting. If the online control setting is required, the check will fail, if there is no default address. see http://discussion.forum.nokia.com/forum/showthread.php?t=71071

Trust Domains

1. There are 4 different trust domains in MIDP2 (manufacturer, operator, trusted third party, and untrusted). Trusted Third Party is the only one of any use to us really.

   It gives the following options on my Nokia 6680 (Vodafone UK):

   Network Access: Not Allowed, Ask every time, Ask first time
Messaging: Not Allowed, Ask every time App
Auto-Start: Not Allowed, Ask every time, Ask first time
Connectivity: Not Allowed, Ask every time, Ask first time, Always allowed
Multimedia: Not Allowed, Ask every time, Ask first time
Read User Data: Not Allowed, Ask every time, Ask first time, Always allowed
Edit User Data: Not Allowed, Ask every time, Ask first time, Always allowed

2. These settings are defined by the operator and the phone manufacturer and therefore vary between phone, manufacturer and operator.

Unresolved Problems

1. I managed to sign the JAD with this format using J2ME WTK utilities, but when trying to install it on the device I get a message "Application authentication failed 909".

Sample JAD

MIDlet-Jar-URL: MyApp.jar
MIDlet-Jar-Size: 201365
MIDlet-Name: MyApp
MIDlet-Vendor: EC1M
MicroEdition-Profile: MIDP-2.0
MicroEdition-Configuration: CLDC-1.1
MIDlet-Icon: logo.png
MIDlet-Push-1: sms://:6553,net.ec1m.MyApp.midp.MyAppMIDlet,*
MIDlet-Description: MyApp MIDlet
MIDlet-Permissions: javax.microedition.io.PushRegistry,javax.microedition.io.Connector.sms…
MIDlet-Version: 1.0.67 MIDlet-1: MyApp, logo.png,net.ec1m.MyApp.midp.MyAppMIDlet
MIDlet-Certificate-1-1: MIICODCCAaECBEKqpfswDQYJKoZIhvcNAQEEBQAwYz…=
MIDlet-Jar-RSA-SHA1: EUsAch/…/hEZOsJsiCjBOhNs/3FSw4=

Sample Manifest

Manifest-Version: 1.0
MIDlet-Name: MyApp
Created-By: 1.4.2_05-b04 (Sun Microsystems Inc.)
MIDlet-Push-1: sms://:6553,net.ec1m.MyApp.midp.MyAppMIDlet,*
MIDlet-1: MyApp, logo.png, net.ec1m.MyApp.midp.MyAppMIDlet
MicroEdition-Configuration: CLDC-1.1
Ant-Version: Apache Ant 1.6.2
MIDlet-Icon: logo.png
MIDlet-Vendor: EC1M
MIDlet-Permissions: javax.microedition…
MIDlet-Version: 1.0.67
MicroEdition-Profile: MIDP-2.0
MIDlet-Description: MyApp MIDlet

Sample Ant Build File

I’ve put our EC1M ant build file up on our website to (hopefully) make all this a little easier for you.

Other Resources

This FAQ on the Nokia Forum is worth a read. (Thanks chortya for the link)

/Technology /Technology

Ugh, I’ve given up and turned on moderation so it’s going to take a little longer for comments to appear I’m afraid. The upside is people won’t get blasted with meaningless junk anymore!

/Technology /Stuff, /Technology

Wow! Pandora is a really fantastic use of technology. It’s taken the Music Genome Project and allows you to find and listen to new music!

I started off with Interpol as a seed artist. It then went on to play the following songs

1. Obstacle - Interpol
2. Atlantis Nights- Hudson Bell
3. Come Rest Your Head- Tonic
4. Narc - Interpol
5. Through the Hedge - The Bevis Fund
6. Spin - Lifehouse

I think I’m going to check out some more stuff by Lifehouse and The Bevis Fund

/Technology /Stuff, /Technology

I was chatting to a colleague yesterday and he mentioned he’d been looking for some C# books to recomend. He started off by looking at my two previous book related posts ( Really great IT books and Good OO Books). Where there is a bit of a shortage of C# specific books. I’ve been reading a lot of C# books recently so I though it was time to rectify the omission

• Windows Forms Programming in C# - Chris Sells A really good overview of all the areas of Windows Froms coding, a must read
• Framework Design Guidelines - Krzysztof Cwalina, Brad Abrams I haven’t finished this yet but it’s shaping up to be a really useful book on designing good APIs. A lot of this is obviously useful ouside of the API coders world
• Essential .Net Volume 1 - Don Box, Chris Sells One of the best books covering the language rather than the APIs
• Advanced .Net Remoting - Ingo Rammer, Mario Szpuszta IIf you do find yourself having to do any remoting, this is the book to buy
• The Best Software Writing I: - Joel Spolsky Ok, ok not a C# book but an interesting look at software development in general
• Shared Source CLI Essentials - David Stutz, Ted Neward, Geoff Shilling This is a tough read but then what do you expect from a book about compilers and framework internals
• Visual C# 2005 A Developer’s Notebook - Jesse Liberty Useful to get up to speed in the new features in VS 2005

/Technology /Technology