.NETDJ's editor-in-chief Derek Ferguson Interviews Scott Guthrie, co-creator of ASP.NET

.NETDJ: How did you come to your current role at Microsoft?
SG: I run our Web Platforms and Tools team, which includes ASP.NET as well as Visual Studio .NET. I cofounded the ASP.NET team with Mark Anders in November of '97, right after we shipped IIS 4. Mark and I started the next generation Web application model project and spent a couple of months just prototyping things. I wrote the prototype of ASP.NET over the New Year's holiday of '97/'98. We showed off the prototype, got a lot of good feedback, and wound up creating a new team and staffing it from scratch.

.NETDJ: Why did you decide to rework ASP so radically, rather than continuing on incrementally?
SG: In '97, we were in a weird situation because we really didn't have any competitors - no JSP, no PHP. We had just integrated Microsoft Transaction Server into IIS with the NT Option Pack, so we were really the hands-down winners and had the first true application server. There were actually a lot of people who retired from Microsoft at that point simply because they couldn't imagine anything else that could possibly be done in that space. Everyone loved it, but - with research - we still found a few fundamental developer problems.

The code that people wrote for user interfaces was "write once, read never" - very cumbersome. At the business logic tier, administrators were telling us that stopping and restarting the server to make changes - or even having to register components at all - just didn't work for their deployment models.

Developer tools people didn't want to write tools that supported ASP's "spaghetti code" model - so that was leaving out developers who wanted tools for code creation beyond simple text editors.

Performance wasn't bad, but we wanted to make it five times faster, and that didn't seem likely using IDispatch COM interfaces. Also in terms of performance, when we saw people trying to cluster Web servers with the old ASP session model, their solutions were less than optimal.

So, at the end of the day, facing all of those challenges, we saw that we were in good shape for the next year or two, but something radically different would be needed after that. We needed to do a deep think about everything in the platform.

.NETDJ: What are your responsibilities now? Guru is a nebulous title; describe "a day in the life."
SG: I basically do three things. First, I'm responsible for the overall technology we are building across the platform and our tools - what are the things our customers need, how are we building them, how can we make them easier to use.... Second, I evangelize and develop our adoption strategies. I'm one of the people who kick-started the ASP.NET QuickStarts and www.asp.net Web site, including the forums and the Controls Gallery. We have about 160,000 users and 140,000 posts - and it has only been around for 6 months. We get about 900 posts per day. Third, I run the day-to-day operations of the ASP.NET team, hitting our goals and stress-testing the bits properly.

.NETDJ: Will Yukon have any impact on ASP.NET?
SG: When you look at the end-to-end model for building applications, with v1 we have the app server and a great front end. In the Yukon time frame you will be able to write managed stored procedures, triggers, and all of your data logic using managed code. You can have an end-to-end story where everything from the user interface all the way to the database can be written and debugged using the same tools and techniques. It is one set of skills to learn and apply in multiple places.

.NETDJ: When can we expect to see the next major release of ASP.NET - is it synonymous with .NET 1.2?
SG: .NET 1.0 happened in February, 2002. V1.1 is now the .NET Framework 2003, part of Windows Server 2003 - that is the next version of ASP.NET, more of an incremental release. Our next big release I'm kind of calling ASP.NET 2.0. I can't say too much at this point; we're still working on it. I will say that one of our very aggressive goals - that we think we're actually going to meet - is to reduce the number of lines of code between v1 and v2 by 70%. We think v1 was a huge jump from classic ASP, but we are looking to make an even more significant jump. When we look at IBuySpy now, we think that we will actually meet that goal. It should be a lot of fun for developers.

.NETDJ: In his interview with .NETDJ [Vol.1, issue 1], Anders Hejlsberg pointed out that C# and the rest of the CLI evolved together - unlike VB, which was obviously pulled along. How did ASP.NET fit into the initial construction of .NET?
SG: The CLR thing was starting at about the time we were working on the prototype. We started as two independent teams who really didn't know each other at all. They were heads-down trying to get the core CLI things done. We were trying to figure out the right programming model. Our prototype was C++ and JavaScript. Basically, for six months we spent a lot of time just trying to get a control-based server model with components that were declarative, that did common Web functions, and that were event driven.

In the summer of '98, we hired a lot of people and started writing the real product. For two weeks we wrote our production code in C++. Then we contacted the Lightning team [as the CLR team was then known] and started reviewing what they had done - and they didn't even have file I/O or COM Interop. We were a brand new project, so we didn't have a lot of stuff going - no one cared if we died. So we saw the opportunity to make a bet on .NET and threw away our two weeks' work to rewrite everything in managed code, except for our core processing architecture. We were the first team to bet on managed code.

If you look in the .NET SDK there is a compiler, called msc, that uses an abbreviated or slightly modified C syntax to generate MSIL. It is a very complete sample. The reason we actually have that is that we started off writing all of our code libraries using msc. It was 9-12 months until we converted to C#. We always knew that msc was a temporary stopgap before porting, though.

.NETDJ: What are some things that have changed in .NET 1.1 of which developers should be aware?
SG: A couple of things - a much richer integration with IIS 6, which ships with Windows Server 2003; a lot of performance improvements - a lot of output caching with the new Windows kernel cache. We also leverage the IIS process model that allows you to do per-application process isolation. We've added the Mobile Internet Toolkit that used to be a separate download directly into ASP.NET 1.1 - mobile development now works right out of the box.

We've added Code Access Security - CAS - directly to the server, which allows a lot more ISP hosting scenarios. CAS was available on the client in .NET 1.0, but you couldn't leverage it to have 10,000 applications all running on the server in their own sandbox.

One other feature that we've added support for is automatic client-scripting attack detection. For example, when users try to enter malicious scripts into a form that then gets read back onto browsers at some point in the future and thereby attacks. V1.1 actually screens all of the input sent to the server and will throw an error if someone tries to make this kind of an attack. It's all about reducing the work it takes for developers to build secure applications.

.NETDJ: Where do you draw the line between features that you ship "in the box" and ones that you leave to third parties?
SG: Often what we will do is leverage our community process as a part of a team to figure out what everyone is doing. When we see something that requires platform support or that everyone is trying to do, we put it into the box. Every time we put something into the box, one of the key things we do is provide extensibility hooks so that third-party developers can take it and extend it in ways that we haven't. There are 200-300 controls on www.asp.net that are a testament to how extensible our platform is.

.NETDJ: How did Web services evolve into such a key part of ASP.NET?
SG: In building ASP.NET, we had done a lot of XML and looked at XSLT before we went with our server control model. The idea of a Web site being able to expose XML that people could consume across the Internet was something that was very interesting early on.

There were a number of teams at MS looking at ways to exchange information in a more standardized way. People all over the Internet were starting to experiment with SOAP before us. Our innovation in v1 was basically to take a SOAP engine that someone here had built in managed code and come up with a very easy-to-use model for fitting it into ASP.NET.

.NETDJ: Who do you think has the most impressive ASP.NET site that you've seen so far?
SG: www.msn.com is the MSN portal and one of the 10 most frequently visited sites - 800,000,000 distinct users - a very, very high volume site. When they went live, they were able to reduce the number of servers from the previous technology by quite a bit.

Other sites I would say are impressive include www.dell.com - their online order system for configuring PCs is now written in ASP.NET, which processes billions of dollars in revenue every month - and probably the Home Shopping Network, just because it is likely the only application that my mom has heard of!

.NETDJ: How did the Mobile Internet Controls Runtime come about - after the CLR, or before it?
SG: We had the notion of having multiple fidelities for multiple browsers, so that the most up-to-date browsers would get advanced HTML and older browsers would get simpler HTML. That was a part of our original vision. Our original vision did not, however, include targeting mobile devices such as WAP phones or small PDA devices.

Thankfully, there was a team in Microsoft Research that was looking at adaptive UI technologies. They were trying to figure out how to build something that would target multiple devices. They became interested in ASP.NET and decided to build a suite of controls that leveraged our platform to build these mobile controls. After v1 shipped, we combined the MIT team and the ASP.NET team into one team. What you'll see in 2.0 is even richer mobile integration into the core platform.

.NETDJ: What are the three most cutting-edge ASP.NET technologies developers should be looking at today in order to prepare for tomorrow?
SG: Web Services Enhancements are adding richer support for the WS-I stack. I would look at the www.asp.net Web site, specifically the Starter Kit applications. And you can also now see the source control for the Internet Explorer controls.

Finally, I would look at Web Matrix - which is our free, easy-to-use ASP.NET development tool. Web Matrix gives you the easiest way to learn ASP.NET quickly. It's actually 1.2MB in size, fully WYSIWYG, and offers a built-in Web server and FTP deployment. You can build your first app within minutes of downloading it. For people who are new to ASP.NET, I strongly recommend downloading it and just giving it 15 minutes of your time. It is a very cool new technology. And non-neophytes who just want a light and quick installation really like it.

.NETDJ: Do you see ASP.NET as having helped to ease the difficulties inherent in having designers and developers working together on creating Web sites?
SG: One of the approaches that we've introduced, called "Code Behind," actually allows good separation between design and development. A lot of shops swear by it. I think that the whole declarative control model - as opposed to streams of code within the HTML - makes it a lot easier for developers to support. Dreamweaver MX even targets ASP.NET for that reason.

.NETDJ: How do you expect to see the ASP.NET Starter Kits used? Would any of them make good starting points for benchmarks, a la the Pet Store demo?
SG: The Starter Kits are more about learning. We are trying to show some best practices in terms of what we think the typical application does. But I think that there is a difference between a benchmark application and a traditional customer application. The community application is for the forums.xbox.com Web site, which has had over 800,000 posts for several months.

.NETDJ: What are the ASP.NET Starter Kits?
SG: The ASP.NET Starter Kits are five relatively complete samples that show off how to build ASP.NET apps. Specifically, there is a portal, an e-commerce sample, a data report sample for hierarchical drill-down, a time-tracking sample, and a community sample that shows how to build sort of an online community with forums, voting, etc. Each sample is available in both VB and C#. There will be Visual Studio samples and text-only samples that you can use with text editors. You can do whatever you like with it - download it, tweak it, change the logo and call it your own to impress your boss - whatever you like - just to make you immediately productive with ASP.NET. We think we have given people a great head start in terms of productivity.

.NETDJ: Will VB and C# remain your code sample languages of choice for the foreseeable future?
SG: VB and C# are by far the predominant languages being used for .NET. J#, for example, will be in Starter Kits shortly. People are free to port these Starter Kits to whatever language they like.

.NETDJ: What are your team's main forms of outreach to the developer community - apart from developer magazines such as this, of course!
SG: We perceive three forms of communication: e-mail-based list servers, online Web forums, and NNTP newsgroups. We support all three because we have found that different kinds of users prefer different kinds of media. Some people like the tight person-to-person communication on the list servers; others hate to get so much mail. Others like Web forums because they can access them anywhere in the world with archiving. Some people hate Web boards because they can't go offline. Newsgroups are good for this, but they aren't moderated, so you tend to have more junk. They also aren't searchable, and they aren't archived for a long time.

We have a room - nicknamed the "ASP.NET Community Love Shack" - that has three computers for each of those media. Everyone on the team spends two hours per week each answering these.

It's a great way for us to help people, as well as to get feedback about the questions and problems that people are experiencing.

.NETDJ: Do you find yourselves having to work any less closely with the IIS team at Microsoft, now that the CLR provides such a complete suite of services in and of itself?
SG: ASP.NET hosts the CLR inside of IIS. We communicate as an ISAPI. This requires a lot of work with the CLR team to identify managed/ unmanaged marshaling costs and deal with that appropriately.