Not yet ready for prime time?

[BradBrening]

I have been developing in VB since the early days of version 3. Years of experience have enabled me to work around many limitations inherent to the language, though not all. My problems with VB were:

1) No support for multithreading. I know, I know, there were/are some 3rd party solutions that work marginally at best, and there were always ActiveX EXE's - but come on, let's stay civilized here.

2) The necessity to redistribute the proper runtimes with your install package.

Now, as I said, I have been able to get around many of these issues, and have created some very functional applications with VB. But those problems continue to nag. So, I decide to look into the whole .NET strategy and see what benefits there are to me. Behold! One of my problems are solved, one of my problems are quadrupled and a whole new problem introduced (sort of). Continue with the new issues:

1) The necessity to redistribute/have the user download the proper runtimes with your install package. Same as before, yet now the runtimes are 23MB!!!!! (Microsoft .NET Framework Version 1.1 Redistributable Package) Holy Cow!!!!! The VB6 runtimes only added 1MB to my install package! There goes any expectation of my clients downloading my install via a dialup! Why should my client have to reconfigure their entire setup just to run my little freeware/shareware app?

2) VB.NET programs (or any program created for .NET) are EXTREMELY easy to decompile. Again, I know, so were VB6 programs, but at least you could purchase a good program like Armadillo that would make it nearly impossible to do so, for a reasonable price of around $90. Searching for a .NET obfuscator leads to many solutions, most of them starting around $1400!!!! What?!?!

Now these aren't just small issues, these are rather LARGE ones. Issues that tell me that creating applications in .NET that target a large audience isn't in the cards.

Further, and finally, I have another issue with the whole idea of .NET. One framework that is supposed to power not only all of these different languages, but web pages as well via ASP.NET? Coming from a company (Microsoft) that releases a new service pack/ security fix on a weekly basis, is this really such a good idea?

If you are going to have everything (all these developers applications, all these websites) depend on that one thing (the framework), then that one thing better be rock solid. Microsoft isn't particularly known for their ultra-secure, rock solid code. I know that Microsoft pledges to not break compatability between the different frameworks unless it is absolutely necessary, but look: they've already done so! Look at version 1.0 and 1.1! Or try to utilize the 1.1 version of the framework using VS2002! Ooops!

It appears that .NET eliminted a few issues and introduced a whole slew of new problems! Now, I am not particularly a pessimistic persion, but I don't see how .NET is yet ready to be a "big deal" in a real-world sense.

Opinions, thoughts?

Brad

[hellswraith]

OK, I think this will be my last thread on this subject that I reply to. I hear the same things all the time, and it really stems from not having knowledge of .Net. You can do a bunch of searchs on the net to help you with your quest for information on these topics as well. This information has been covered again and again.

1. Framework distribution. Here is the best answer: "You don't do it.". Microsoft Windows Update site has the framework on it for people to download and update. This is only your problem if you want it to be. Otherwise, ensure it is a requirement you specify for your application and tell the user where to obtain it. A lot of users already have the framework just because they do their windows updates. XP service pack 2 is coming out soon, and it is supposed to contain the framework. This is another point of entry to get the framework on machines. Last, EVERY OS that MS puts out from now on will have the framework on it. Microsoft believes in it so much that a lot of their next OS is built with .Net. If you still raise the issue that some people on dialup will have to download the framework, well, yes, they will. No getting around it. It is a choice that you as a developer need to make if you want to develop a .Net application.

2. Microsoft recognized the decompilation problem. In 2003 they included a obfusicator (sp?) in the IDE. There are more advanced products out there, but the bare essentials are there. You can also natively compile your application using the ngen tool. (do a search for the pluses and minuses).

3. Security...well, I can't tell you that everything is guarenteed perfect, no one can. I can tell you this, .Net is a more secure platform than I have ever seen. Microsoft planned for security from the very beginning of design. Spend some time reading about .Net security, and you will understand very quickly. Security can be set so tight on a machine that you can't even run a Hello World application. You and the user have total control. ASP.Net uses the framework, but that doesn't make it insecure. ASP.Net serves up pages, then receives requests and serves up more pages. This is pretty secure, it is the developers that open holes. Besides the update to 1.1 of the framework, I haven't seen a fix for the framework since then. So I think your argument is nothing right now, maybe in the future there will be one, but until then, it isn't a security problem.

4. Compatibility...You miss understand what is happening. Visual Studio 2002 was written to target the 1.0 framework. The 1.1 framework didn't even exist. Therefor, it doesn't know anything about 1.1, and never will. Visual Studio 2003 was written targeting the 1.1 version of the framework so you can write your apps against that. BUT, you can also use Visual Studio 2003 to create 1.0 targetted applications. I call that backward compatibility. Since side by side versioning exists in .Net, you can have both versions of the framework on your system, and no problems occur. Try that with COM! Anyway, I think your argument in this area is stemming from the fact that you are trying to use a tool that has no knowledge of a future product to try to write against that future product. I can't use Word 97 to write Word 2003 documents, but I can use Word 2003 to write Word 97 documents if I want. Understand?

Last thought...

As far as .Net eliminating a 'few' issues, it eliminated thousands of issues. I don't call that a 'few'. After working with it for longer than a brief introduction period, you will see that you will probably write half as much code to do the same things you did in VB6 and lower. The Anchor property of controls is worth upgrading alone. You don't have to write resizing code anymore if you don't want to. No more taking out the notepad and doing the calculations to figure out the scaling of controls. I don't miss that at all.

Give it a try, learn about the product some more, then make your decision. Asking questions like this is a start, but you really need to explore it and understand the technology before making the final decision. Good luck, which ever path you choose. If you have specific questions about .NET, I will try to answer them for you.

[Edneeis]

I also would like to point out there there is no more DLL hell in .NET and no requirement to 'register' certain files to make them work like in VB6. So although the framework is large you aren't constantly having to redistribute things or constantly making sure they have the right version. In fact most .NET applications don't really need an installer, if the framework is there the exe and any other files can be copied to the same directory and it'll just work. I'm with HellsWraith try it for a while and you wont regret it.

[mendhak]

I initially shared the same views on ASP.NET as you do. But once I got into it (I jumped into ASP.NET before VB.NET), I realized that for creating larger web applications such as the proejct I'm working on right now, it wouldn't be as fast, easy and efficient as with using ASP.NET.

ASP.NET does have its advantages.

[Cander]

An the most important point. All those concerns have been around for many years with Java and that is widely used today.

[BradBrening]

Don't get me completely wrong - I can definately see the advantages of programming with .NET. It offers many features that will make me more productive by natively supporting many of the things that I would have spent time in VB6 "hacking" around trying to accomplish. Further, it offers many features that VB6 could never offer no matter how much hacking around one did.

However, no matter how productive or happy .NET may make me as a programmer, that doesn't mean squat if I can't easily and reliably get my software product in the hands of an end user.

* (I overestimated the size of the framework above. I noticed that after I made a quick sample project and created an installer - optimized for size - the package came to 13 MB - still a substantial increase in the size of installation requirements)

Everyone does not yet have the framework installed, and I am sure we can discuss to no end about the percentage of users that actually do. Unless that number is approaching 80% or more of Windows users, that means that quite a few of any new customers downloading .NET version of my software will see their install grow from ~2.5MB to somewhere in the neighborhood of 16MB. Either that or I will have to tell them that they need to update their computer through Windows Update before they can use the software. That is bad practice - sending them off to another site (i.e. Windows Update) - and expecting them to return.

Now, here is where I may be getting a little confused. I have VS2002 EA. I realize the fact that I am stuck developing applications using the 1.0 version of the framework. Maybe I have my head still stuck in the "DLL Hell" days (as mentioned above), but does that mean that if Joe User already has the 1.1 version of the framework he will also need to download the 1.0 version in order to run my software? I certainly hope not! I mean, to utilize the analogy above, if I have Word 2000 and create/send a document to a user with Word XP, he can still read my document without having to install Word 2000.

Finally, I realize that VS2003 ships with a basic version of "Dotfuscator". The 2 problems with this is that it is a day late and a dollar short for VS2002 users, and it is not a commercial grade license. Their price for a commercial license is around $1400, a pretty stiff price! I did more research on obfuscators, and did notice an open source version called "QNDObfuscate" - does anyone have any experience with this?

I am all ready to jump on the .NET bandwagon - if for no other reason than to take advantage of the OOP nature VB now provides. Many people talk as if there is a strong learning curve to migrate from VB6 to VB.NET, and although I see a few new concepts it still feels like VB to me (albeit on steriods). I am anxious to migrate - just that I see these issues that look like roadblocks to me.

To recap:

1) If I develop using the 1.0 version of the framework, and Joe User already has the 1.1 version of the framework installed, does he now need to install the 1.0 version in order to run my software?

2) Does anyone have any experience with other, more affordable obfuscators (QNDObfuscate appears to be free and open source)?

Thanks for your great replies!

Brad

[PT Exorcist]

If you have 1.1 then you can run 1.0 programs from there but there is no guarentee it will actually work (as there are minor changes from one to another, bug fixes, etc)

ps: I still didn't get why everyone is so confused about spelling OBFUSCATION, it's not a hard word

[kleinma]

well if you distribtute on CD, then you have no problems..

if you distribute via the web, you simply make 2 installation packages, 1 for just your app and support files and another with them AND the framework. This way users with the framework will download the smaller package while users without it download the larger one... I am not positive, but there may even be some way to query the presence of the framework from your website using ASP.NET so you could just automatically provide them with the link to DL.

also in this day in age, 23MB is simply not a large file anymore...
if these people are on dial-up that is their own damn fault. MS is looking toward the future and the future is only going to bring faster transfer rates over the internet.. MS could not be focused on making small the framework tiny so people on AOL could download it faster. It needs to be that big because of its robustness.

and like others have said before, the number of people with the .net framework installed is going to do nothing but grow. Especially after XP SP2. so even if a lot don't have it now, that gap is slowly closing and will pick up speed with force soon

[nemaroller]

Originally posted by kleinma

I am not positive, but there may even be some way to query the presence of the framework from your website using ASP.NET so you could just automatically provide them with the link to DL.

Yes, there is a way.

In the HTTPRequest class, there is a Browser property which returns a HTTPBrowserCapabilities class... that has a property called CLVersion, which returns the version of the .Net framework on a visiting client (if they have one at all).


Anyway, my take on .Net distribution:
we distribute via CD's anyway, because our software costs $25 - 30,000 for the main server app and 5 client licenses.

On .Net decompilation:
Well, as much as we all like to think we're super duper programmers, that fact is, there is nothing ground-breaking in 99.99% of all apps out there, i mean, unless you just invented some new form of artifical intelligence, its all been done before, its just how its presented and executed.

And industrial strength obfuscators are worth the price if a software company is concerned about intellectual property.

[hellswraith]

Here are the two links that will help you out:

http://www.gotdotnet.com/team/change...1/default.aspx

http://www.gotdotnet.com/team/change...1/default.aspx

although I see a few new concepts it still feels like VB to me

The syntax looks familiar, but a lot of the concepts and the way you did things before should probably be updated. I urge you to look for ".Net" ways of doing the things you were doing in VB6. Chances are there are more efficient ways that require less code.

[hellswraith]

Here is another quote I found:

What are the compatibility problems for .NET Framework 1.0 and 1.1? Can you run both versions of the .NET Framework on the same computer? Some people might want to run both versions to avoid rewriting applications originally developed for 1.0. However, you can't run different versions of the .NET Framework on the same computer; Setup will tell you that the .NET Framework is already installed. And you don't necessarily need to support both versions of the .NET Framework. If you try to run a .NET Framework 1.0 application on a computer with .NET Framework 1.1 installed, the application will attempt to run. Only if .NET Framework 1.0 is installed will the application revert to the older version of the Framework. Applications written for 1.1 do require 1.1, however--they won't run on version 1.0 unless you explicitly edit their configuration files to enable them to use that version and unless they don't use any pieces found only in the 1.1 Framework.

So, there are some minor issues, and they are listed on the two links I showed you. If you be mindful of those, then you can create an application that works on both framework versions.

[BradBrening]

Originally posted by nemaroller

On .Net decompilation:
Well, as much as we all like to think we're super duper programmers, that fact is, there is nothing ground-breaking in 99.99% of all apps out there, i mean, unless you just invented some new form of artifical intelligence, its all been done before, its just how its presented and executed.

It isn't so much as trying to hide some "super duper" function that does something ground-breaking that I don't want others to see. Unless, of course, that function deals with the licensing/registration aspect of the program. What good is it to, say, utilize a hash function when your key is (very) easily viewed using (very) avialable tools?

Granted, it was even easier in VB6 - where all you had to do was open your executable in a powerful text editor and your string tables were there for the world to see. However, there were very inexpensive tools (i.e. Armadillo) that would make the "cracking" of your code next to impossible.

In this instance, I was wondering of there were better alternatives to the $1400 Dotfuscator program out there that would accomplish close to the same thing. I mean, if you are going to distribute your software to the masses, then you need to try to lock the software down as best you can to avoid the issue of piracy.

It is some of these issues that make me think that for Enterprise or Corporate applications, VB.NET is a snap. In that instance you are creating applications that are targeted more use "in-house" and not as a tool to generate applications following a "pay for use" model. When you try to apply VB.NET as a tool to generate applications that you are going to sell, some of these issues become more pronounced.

hellswraith:
Thanks for that blurb about .NET framework compatibility. That was one of my concerns. In fact, I installed 1.1 on my Windows 98 test box and tried to run my simple little test app made in VS2002 (1.0). It seemed to do fine. We'll see if that is still the case as the applications become more complex.

In any case, I appreciate all the comments, links, etc from this thread, I will reserve my final opinion until I can plow through some of the links provided. I really, really want to get into this .NET environment, I am just not sure that it is ready to become a tool for creating software for sale to the masses.

[hellswraith]

If you are worried about assembly cracking, I think you could do an install, and in the installer use ngen to natively compile your app, then delete the .net assemblies when done...I have never done this, and it is purely fantasy in my mind right now. I am wondering if there is a problem with doing this?...something to research when the time is right...

Anyway, you can look at what the ngen tool does by following the link:
http://msdn.microsoft.com/library/de...torngenexe.asp

[kleinma]

also windows update (and I imagine XP SP2 and future OS releases) contain both versions of the framework...

[BradBrening]

Originally posted by kleinma
also windows update (and I imagine XP SP2 and future OS releases) contain both versions of the framework...

Both versions? Are you sure about that? I don't have any test machines without the framework installed...

[kleinma]

Originally posted by BradBrening
Both versions? Are you sure about that? I don't have any test machines without the framework installed...

I know I got both versions VIA windows update

[DevGrp]

Originally posted by BradBrening
I have been developing in VB since the early days of version 3. Years of experience have enabled me to work around many limitations inherent to the language, though not all. My problems with VB were:

1) No support for multithreading. I know, I know, there were/are some 3rd party solutions that work marginally at best, and there were always ActiveX EXE's - but come on, let's stay civilized here.

2) The necessity to redistribute the proper runtimes with your install package.

Now, as I said, I have been able to get around many of these issues, and have created some very functional applications with VB. But those problems continue to nag. So, I decide to look into the whole .NET strategy and see what benefits there are to me. Behold! One of my problems are solved, one of my problems are quadrupled and a whole new problem introduced (sort of). Continue with the new issues:

1) The necessity to redistribute/have the user download the proper runtimes with your install package. Same as before, yet now the runtimes are 23MB!!!!! (Microsoft .NET Framework Version 1.1 Redistributable Package) Holy Cow!!!!! The VB6 runtimes only added 1MB to my install package! There goes any expectation of my clients downloading my install via a dialup! Why should my client have to reconfigure their entire setup just to run my little freeware/shareware app?

2) VB.NET programs (or any program created for .NET) are EXTREMELY easy to decompile. Again, I know, so were VB6 programs, but at least you could purchase a good program like Armadillo that would make it nearly impossible to do so, for a reasonable price of around $90. Searching for a .NET obfuscator leads to many solutions, most of them starting around $1400!!!! What?!?!

Now these aren't just small issues, these are rather LARGE ones. Issues that tell me that creating applications in .NET that target a large audience isn't in the cards.

Further, and finally, I have another issue with the whole idea of .NET. One framework that is supposed to power not only all of these different languages, but web pages as well via ASP.NET? Coming from a company (Microsoft) that releases a new service pack/ security fix on a weekly basis, is this really such a good idea?

If you are going to have everything (all these developers applications, all these websites) depend on that one thing (the framework), then that one thing better be rock solid. Microsoft isn't particularly known for their ultra-secure, rock solid code. I know that Microsoft pledges to not break compatability between the different frameworks unless it is absolutely necessary, but look: they've already done so! Look at version 1.0 and 1.1! Or try to utilize the 1.1 version of the framework using VS2002! Ooops!

It appears that .NET eliminted a few issues and introduced a whole slew of new problems! Now, I am not particularly a pessimistic persion, but I don't see how .NET is yet ready to be a "big deal" in a real-world sense.

Opinions, thoughts?

Brad

Seems like you already made up your mind not to use .NET but you're looking to be convinced otherwise. Just get a book and start coding. You'll never look back and VB 6.