codesecurely.org : General

Blogging from Microsoft Word

rudolph — Sun, 25 Feb 2007 05:01:00 GMT

Like I mentioned in my first post I prefer to limit the number of applications that are installed but more importantly running at any given time. Despite dual core processors and multi gigabyte hard disk drives it seems to me the more we have the more "stuff" we find to use up all that power. Anyways long story short, I like to be able to do my blogging from stuff I already have rather than using something like Live Writer or worse still something that is online only which defeats my ability to blog when stuck at the airport or on a plane waiting for a ground stop at Chicago to clear up. Anyways Word 2007 has this cool new feature that supports blogging to Community Server (which I use) and other blogs that implement the MetaWebLog API spec. You get the ability to post to your blog while still having all the editing and layout tools that Word 2007 has to offer (like SmartArt for instance).

Anyways, my first blog post went about fine from Word and I was all good. Now came the second post and I decided that to make my point I needed some pictures. So I looked through the blog configuration options in Word to see how I can get these uploaded automatically. Now for some history, turns out when this feature was built into Word (and from what I hear it was a last minute add-on), Community Server did not support the full MetaWebLog API - specifically support was lacking for the newMediaObject which allows you to upload media files such as images and videos as part of your blog post. Since then this support has been added but it was probably too late in the Office 2007 release cycle to be able to update the Word feature. What all this means is that when you select Community Server as your blog provider you only have three options with regards to media files:

Don't upload them through Word and do it on your own
Upload them using FTP (requiring you to upload you credentials in the Manage Accounts dialog in Word 2007
Use WebDAV

Now personally I don't like any of those three options perhaps most so because hey my blog does support newMediaObject so I have to make it work! So here's a screencast of how I finally got it to work:

Key things to note:

Don't use Community Server as your blog provider (I know you are on Community Server, just trust me)
Leave the images selection as "My Blog Provider"
Don't use spongebob / squarepants as your username and password J

Ok so we are almost done but not quite! Turns out I now ran into a different issue. Even with this configuration I was still having the post fail with Word complaining that the post was successful except that my images could not be posted. So fired up Google to do some research. Even posted to the Community Server forums but no response. Some more Googling finally pointed me to this which definitely seemed related. As the author of that post did, I quickly fired up my web application proxy (Fiddler and Paros) and right enough he was spot on. Sniffed the error messages back using Ethereal and it complained about a type mismatch. Checked with some folks at Microsoft and quickly confirmed this to be a bug. Now I had come this far and would be dammed if I were going to give up.

Paros has a neat little feature that lets you replace parts of the HTTP request or response header / body but me being me that would way too easy. Besides I have been wanting for a while to understand how Fiddler Scripts work. So when into Fiddler and hit "Customize Rules" under the Rules menu and that dropped me into the nice syntax highlighting enabled FiddlerScript Editor. Once there all it took was a few lines of code for me to replace the string type with an integer in the newMediaObject web service call. Here's the code (with the lines I added in italics):

public static RulesOption("&Workaround Word Blog Posting Bug")

var m_WorkaroundWordBlogPosting: boolean = false;

...

static function OnBeforeRequest(oSession:Fiddler.Session)

{

if ((null!=bpRequestURI) && (oSession.url.indexOf(bpRequestURI)>-1)){

oSession["x-breakrequest"]="uri";

}

...

if (m_WorkaroundWordBlogPosting && oSession.host == "www.codesecurely.org") {

oSession.utilReplaceInRequest("<int>my_blog</int>", "<string>my_blog</string>");

}

This gave me a nice little menu option under Rules that I can easily turn on and off and which will workaround the bug nicely and geekily if you will! Couple of things to note if you want to use this script, don't forget to change "my_blog" to whatever your blog is called. So now each time I want to post to my blog I fire up Fiddler, check my shiny new option under the Rules menu and then click Publish in Word.

(Hopefully this works for videos too – well we'll know soon enough, won't we? Let's hope the video above makes it! – bad news is it doesn't – I guess only images work for now which is fine since it tackles my most common use case but let's see if any geekery can help deal with videos!)

Okie it’s time to post and get this site off the ground!

rudolph — Fri, 02 Feb 2007 08:02:35 GMT

I have been working on this site for a while and given that this is my second attempt at blogging I am understandably nervous. In any case I decided I need to start at some point so here goes.

Who am I?
Well the answer to that is on the About page linked above so I am not going to spend much more time belaboring that point.
What am I going to talk about here?
Well for a while I considered maybe I should have a separate blog for work related stuff, another for my political views, another for my hobbies and interests (yes I do have those!) and maybe yet another for my rants. But then I realized I don't really have the time nor the inclination to post that many separate blogs and I heard about this wonderful thing called Tags and Tag Clouds so why not just start small! So in a nutshell, you are going to hear about everything under the sun that I think I should have an opinion about and some things that I know I should NOT have an opinion about but still do. It is mostly going to be focused around software security though. But I will also talk about some of my experiences with travel (which if you know me – I do a lot of – and no I don't mean that leisure travel!) and consulting in general besides all of the above.
How often will I be posting?
Well to answer that question I have to give you a little insight into my definition of blogging. In my world view there are two types of bloggers. Some bloggers basically thrive on links, linking to stories that interest them and their readers, nuggets of information and so on. Others take the time and effort to craft insightful posts which shed light for the rest of us over some topic that they are truly interested about. I plan to do a mix of both. I don't think I will be blogging every hour or two – in fact I would surprise myself if you ever see more than a couple of blog posts a day. But at the same time I will link often enough to other blogs, stories, videos etc that I think are interesting. And then every so often, I will make the time to write what I like to call an "opinion piece" on some topic (again probably most likely – software security related) offering what I hope will be some insight and outlook that could be useful on its own to readers. These will be the longer, well crafted posts as opposed to the speed linking.
What is that little Wiki link on the side?
Aah hah! That is probably the most important part of the site as far as I am concerned. To start with I plan on putting all the stuff that I have written for SoftwareMag, MSDN, Foundstone etc. up there – articles, white papers, webcasts - you name it. The long term plan though (and I am secretly conspiring with some other folks on this – shhhhhh) is to make it into a community effort – at which point this site will morph into a software security wiki and my blog and other personal artifacts will move elsewhere and certainly off the home page. The idea is to create a knowledge base around software security and a central repository for the vast amount of research and innovation that has gone on into this field of security. Currently, the wiki is setup so that you can only contribute if you are logged in and all users who sign up here have to be approved by me. That's just to keep the spammers away. I could use all the help I can get so if you feel like contributing shoot me an email or better still sign up and if it looks like a legitimate address I'll approve it. In any case if you don't hear from me after you sign up and your account doesn't seem like it is enabled definitely send me an email. There is also a sandbox area on the Wiki which we can use for collaboration if needed.
Over the next week or so I will start getting most of my work up onto the Wiki – unfortunately I have not found an easy way yet to go from Word to Wiki so it will have to be by hand for now unless one of you knows a better way. CS-Wiki is turning out to be amazingly easy to work with. Also did I mention that all of the content will be licensed under Creative Commons?
What is that picture above?
That, my friends, is the result of pain stakingly joining 9 pictures of the Yosemite Valley to create one panoramic image. Photography is one of those hobbies and interests I guarantee you will hear more about as time goes by. Yosemite National Park is certainly one of the most beautiful places I have been to and if anyone of you has not I suggest you get on the bus and head down there as soon as time permits. You will not be disappointed.
Acknowledgements
Three sets of people deserve a ton of praise for this site – firstly the folks at Orcsweb who are hosting this site, email and all – best technical support I have ever seen at any technology company period! Telligent and Rob Howard – Community Server what else can I say! Finally, Eric Falsken who created the CS-Wiki Community Server plugin that makes the wiki on this site possible. In fact if I have one complaint about the Telligent guys is that they don't have a wiki in Community Server (yet? ), but Eric has done great work to make up for that. One thing all three of these have in common is quick and responsive customer support. Man what a way to wow your customers!

By the way I am going to try and do most of my posting through Microsoft Word (yeah, yeah I know 5 zero days and all but I just don't like having a million different applications installed on my computer or on the web – so since I spend so much time with Office as part of my day job I might as well give it a shot, plus can I get a hoohah for spelling and grammar checking!) – let's see if it works out. If anyone has suggestions about a different publishing mechanism I am all ears – one critical feature I need though is offline editing capability so no web only editor is gonna work for me.

Finally, the usual yada yada disclaimer, all of the opinions expressed here are and always shall be (unless explicitly mentioned otherwise) my own and do not reflect on my employer in any way, shape or form (yawn :o)! I promise this is the last time you hear that – I am not going to right one line of a blog post and follow it with 10 lines of legal jargon that is mostly meaningless anyways!