Wow.  If this is what a "Professional" is now expected to know, I'm sad for .Net.

[more]

Last month an alert went out from Microsoft about a severe vulnerability in ASP.Net.  A quick workaround was stepped through but the kernal of the issue remained.

I just got this email blast from the DotNetNuke folks (very very nice of them even as I am no longer a Nuke user) about the official patch now being available as direct download AND NOW Windows Update.

No matter your OS, if you run ASP.Net you should get the updates.  If money is on the line then of course you have to check the fine print and scan the comments of Scott Guthrie's blog post and do extra testing ASAP in case you are doing some off-kilter code that hits a boundary of the patch. 

Just got an e about ELMAH.  Yes, I think its pretty fine.  Saves a lot of time, does fine with vs2010 asp.net4 for us so far... but let me tell you why we took the plunge.

Need to reduce those one-off cookies, session vars or visible query strings?  This is a library that I trust (and I trust very very few these days)

Remaking this site to run on IIS... ELMAH quickly reminded me of that IIS issue:  ignoring custom error handling when spaces or hijack scripts are in the url.

Mostly these come from those cute little korean/slav/russian php scripties, you know the ones, all the variations of: http://[domain]/page%20/index.php?errors=http://www.imajerkwithasmallpenis.tjdhosp.co.kr/1.txt?

IIS and web.config customErrors will take care of most odd url requests.. but embed a space and your customError configuration section won't get called... you need to handle it in the olde Global.asax

The logs show that your pages are redirecting correctly... but a spider type test app shows everything as being status 200 OK... dagnabbit, don't forget that one little property

(by smith first published in Feb 2000 Visual Basic Programmers Journal)

 Need the same simple power in .Net? Use Process.Start([mailto string as described below])

One of the most used lines of Win32 API code is ShellExecute.   It's great because you can pass any file name and if the file's extension is associated to a registered program on the user's machine, then the correct application will open and the file will be played or displayed.

It's almost common knowledge that ShellExecute also has internet power.  If you pass a URL, the user's default 32bit web browser will open and connect to the site. If you preface an email address with "mailto:" then the user's default 32bit eMail client will open a new email with the address filled in.