Paul On Technology

We recently had a security consultant come in to give us some guidance. Since I am the developer, not the database or network engineer, I learned a few things but the one that really got me was the use of ports with Oracle instance setups. Hackers always look for the obvious, and usually that means default settings that never get changed.

We finally have a project that looks like a good candidate for web services. I have played around with some samples, but now I am looking for some meat. I have a basic understanding of what's going on but I am very concerned about security. I am aware that WSE is ready for release so I'll be looking into that.

Today I had to unit test a dll that will read the web.config file from my web app. Here is the setup

I have a web app that needs to work with a PowerBuilder app's database. This means sharing tables for user rights and other such things. The PB app uses Oracle's logons so the user id and password are passed in the connection string. To authenticate a user they are telling me to get the id and password and try to connect to Oracle and trap an Oracle exception if the connection fails because of invalid credentials.

Is there a better way to find out if the user is valid in the Oracle database? Our current database has our own table for  users so this is not an issue in the web app, but we are combining databases and would like to have the PB app maintain users, which means my tables wil go away. We don't want to maintain two ways of logging on.

I want to share two adventures which I would have thought were totally unrelated that I had recently in the hopes that I can save someone else some pain.

I am looking to have my business rules dll read a key from the web config file using ConfigurationSettings.AppSettings. So far my dll which is shared by two test apps seems to get the right value depending on the calling app. Are there any issues doing this?  I had the settings in the registry but now we are going to have two or more web apps using the library so I want to read a key out of the config file. I don't want the apps to have to pass this to the dll.

I'd like to get opinions on a way to build screens and generate dynamic sql. About 3 years ago my current client hired me to help his team build web apps based on their PowerBuilder GUI app. The team had no web or VB/ASP experience at all. The resulting concept was more of a prototype, I had no idea it would be carried forward. We were experimenting with ways to generate pages. My initial idea was to create objects to represent, say a customer, and have the business rules for customers contain the logic for the CRUD operations.

Frans has an issue with the "Invasion" of the Microsoft bloggers here. Maybe I am just naive but I don't see it being a big enough problem to have to leave (no flame intended Frans). I have been using MS development tools since VB 1.0 was in beta and I don't think I have ever seen MS out there with us developers like they have been lately.