A few weeks ago a challenge came across my Twitter stream – build an application that combines Twilio, a cloud communication platform, with AppHarbor, the easiest way to deploy and host .NET applications. This seemed like the perfect fit for an idea that’d been bouncing around in my head for some time. Five days later,  long after the Super Bowl ended, I submitted my entry.

Yesterday morning another tweet popped up on my desktop…my entry won!

And now…I’m proud to introduce Flxt.it – a simple tool to manage your Netflix queue.

The Idea

How many times have you been away from a computer and thought of a movie you don’t want to miss? This is where Flxt.it comes in – if you can send a text message, you can add movies to your Netflix queue. There are existing applications to accomplish this, but sending a text message is faster, and you don’t need a smart phone.

The Implementation

When you sign up for Flxt.it, your Netflix account is linked to your cell phone, and you’re given a phone number to send movie titles to. This number is provided by Twilio and it’s where the magic begins.

When Twilio receives a text message, it sends the information on to the web application, which is running ASP.NET MVC 3. In Flxt.it there is a single endpoint that receives the message, looks up your Netflix account information, takes care of business, and responds with a text message to let you know the movie was added to your queue.

public class Message
{
	public string AccountSid { get; set; }
	public string Body { get; set; }
	public string From { get; set; }
	public string FromCity { get; set; }
	public string FromCountry { get; set; }
	public string FromState { get; set; }
	public string FromZip { get; set; }
	public string SmsSid { get; set; }
	public string To { get; set; }
	public string ToCity { get; set; }
	public string ToCountry { get; set; }
	public string ToState { get; set; }
	public string ToZip { get; set; }
}

[ValidateTwilioSignature("YourTwilioAuthToken")]
public class SmsController : TwilioController
{
	[HttpPost]
	public ActionResult Search(Message message)
	{
		var user = db.Single<User>(u => u.PhoneHash == message.From.NormalizeAndHash());
		var movie = netflix.Search(message.Body, user.NetflixApiToken);
		if (netflix.AddToQueue(movie, user.NetflixApiToken))
			return Sms("{0} has been added to your queue!", movie.Title);

		return Sms("Unable to add to your queue.");
	}

	protected override void OnException(ExceptionContext filterContext)
	{
		Log.Write(filterContext.Exception);
		filterContext.Result = Sms("Whoops! Something went wrong. Please try again later.");
		filterContext.ExceptionHandled = true;
	}
}

MVC’s model binding turns all the parameters Twilio sends into an easy to use class. To respond to the incoming message there are two options – TwiML or REST. The former is the only option if you want to do more than one action, like send multiple SMS messages and redirect to another TwiML document. The later is the easier option when you just want to send a response – set your response’s content type to text/plain and Twilio will send the response body to the sender as an SMS message!

This was the approach used by Flxt.it. A custom SmsResult sets the content type and makes sure that the message doesn’t exceed 160 characters. If you don’t want to send a reply message simply send an empty response.

It’s also important to handle any errors properly so that Twilio always gets a valid response from your application. MVC makes this crazy easy without needing to wrap your entire action in a try/catch. By either overloading the OnException method or providing a custom filter to the action or controller you can return an SmsResult no matter what happens during the action.

Security & Privacy

We are all concerned about privacy, so handling phone numbers should not be taken lightly. Even in a simple application like this I want to take every precaution to keep users’ phone numbers safe.

The first, and most effective, precaution is Flxt.it does not store the full phone numbers. Because Flxt.it will always be responding to incoming messages, it will store a hash of the phone number and the last four digits and still be able to link your Netflix account to your incoming movie request.

The second way to protect the Twilio endpoint is to ensure that Flxt.it will respond to requests from Twilio and nobody else. In every request, Twilio will sign the request using your secret authentication token and send it in a HTTP header. To validate it you perform the same operation and if the request is valid you will get the exact same value.

The following is an example of how you can create an action filter in MVC to easily validate an action or every action in a controller. It’s based on John Sheehan’s most excellent presentation at mvcConf last week.

[AttributeUsage(AttributeTargets.Class|AttributeTargets.Method)]
public class ValidateTwilioSignatureAttribute : ActionFilterAttribute
{
    public ValidateTwilioSignatureAttribute(string authToken)
    {
        authToken.ThrowIfNullOrEmpty("authToken");

        AuthToken = authToken;
    }

    public string AuthToken { get; private set; }

    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        var request = filterContext.HttpContext.Request;

        var fullUrl = String.Format("http://{0}{1}", request.Url.Host, request.Url.PathAndQuery);
        var valueToHash = new StringBuilder(fullUrl);

        if (request.HttpMethod == "POST")
        {
            var sortedParams = request.Form.AllKeys.OrderBy(p => p).ToList();
            foreach (var param in sortedParams)
            {
                valueToHash.Append(param);
                valueToHash.Append(request.Form[param]);
            }
        }

        var sha1 = new HMACSHA1(Encoding.UTF8.GetBytes(AuthToken));
        var hash = sha1.ComputeHash(Encoding.UTF8.GetBytes(valueToHash.ToString()));

        var encodedHash = Convert.ToBase64String(hash);

        var twilioSignature = request.Headers["X-Twilio-Signature"];

        if (encodedHash != twilioSignature)
            filterContext.Result = new HttpForbiddenResult();
    }
}

One thing to note here is that when you are in a load-balanced environment like AppHarbor the web server your request is being served by is likely not the exact address that Twilio calls from the outside. Since it is part of the signature we need to be sure to use the host header value and not the raw URL as seen by ASP.NET.

Couldn’t Be Easier

In Flxt.it I’m barely scratching the surface of Twilio’s capabilities. In addition to sending and receiving SMS messages, they have an incredibly powerful platform for making and receiving phone calls. Best of all it’s available on a pay as you go basis – no contracts! You no longer need to be a Twitter-sized company to be able to add phone and SMS capabilities to your application.

Go ahead and try it out for yourself – you get $30 worth of credits just for signing up!

While this might be acceptable for a simple blog, I recently started hosting a few sites for others, including our local .NET Users Group and a neighbor’s business site, and the performance and uptime bar needed to be cranked up a bit. I needed something that was on a good, solid internet connection, gave me plenty of control, and was priced low enough to address the wife acceptance factor.

My new home: The Rackspace Cloud

After considering a variety of options, I finally settled on Rackspace’s Cloud Servers. I’d been tinkering with their services for some time and had been very impressed not only by the performance and capabilities, but by the price. For as little as $11 per month you can run your very own virtual Linux server with 256MB of RAM and 10GB of disk space. Need Windows servers? They start at about $29 per month for 512MB of RAM and 20GB of disk space. Need some short-term servers to handle capacity? You pay by the hour and there are no minimums or commitments! Their control panel is incredibly easy to use, and for more advanced scenarios there’s even an API for automatically scaling up and down. I could go on, but instead I’m going to recommend an excellent review at Social Cloud Now.

For my little setup I went with 2 Ubuntu servers and 1 Windows server – total damage is just over $50/month. This gives me an Apache web server, an IIS web server, and keep the database on its own machine. How does it perform? I think my Pingdom response time report says it all.

Moving up to the Rackspace cloud has cut my response time in half! Before the move my response time averaged close to 800ms, after it’s under 400ms (the brief spike was after I had migrated the database to the cloud but before I had migrated the web server). Those are the worldwide numbers – the US average is only 170ms!

A perfect fit

I couldn’t be happier with my move to the Rackspace cloud. Having great performance and availability, being easy to use, and affordably priced makes Rackspace my cloud provider of choice.

General

• SQL Server 2008 R2 – What Is StreamInsight Used For: Greg Low shares a simple explanation of what the upcoming StreamInsight product is.
• Lazy(T, TMetadata) Class in System.ComponentModel.Composition: David Hayden looks at how you can include metadata along with your lazily-loaded types.
• Overloading Dynamic: Justin Etheredge takes a close look at the behavior of the dynamic types in C# 4.0.
• Database Capabilities in a High-Volume Environment: Tim Ellis at Digg.com explains the different types of databases available today and what makes each unique. A great reference of the different technologies and the needs they address.
• My Java Experience: Oren Eini writes about his experience of learning Java for the sake of learning Java.
• Expressing Your Passion: Reinvigorated from CodeMash 2010, Ken Robertson shares how a developer’s passion can be their strongest quality.

Web Development

• How SparkFun (and 800.com) and Small Commerce or Startup Websites Can Scale: Scott Hanselman lists some of the fundamental techniques for scaling any website.
• ASP.NET MVC 2 – Strongly Typed Html Helpers: Scott Guthrie highlights the new strongly typed helpers that have been added to ASP.NET MVC 2. I sure hope they’ve addressed the performance issues now that it is in the core product.
• Web Security – Are You Part of the Problem: Christian Heilmann details the top vulnerabilities on the web and how to address them. A must read for any web developer!
• jQuery 1.4 Released: Kicking off the 14 Days of jQuery is none other than the official release of 1.4!
• [Required] Doesn’t Mean What You Think It Does: On the surface this is a good explanation of what exactly the [Required] attribute does in ASP.NET MVC, but be sure to read the comments where a great design discussion is brewing.
• Editable Routes: Phil Haack shows how you can easily change your routes without recompiling the application.

General

• Micro Optimization Decision Process: Oren Eini walks us through his process of identifying and addressing micro optimizations.
• Thoughts On EF vs. NHibernate Redux: Rob Conery shares his thoughts on the ongoing debate of which flavor ORM is better. (hint: it doesn’t matter!)
• Understanding Perceived Performance: Howard Dierking writes about users’ perceived performance, which can be more critical than if you can squeak another 10ms off your response time.
• The Common Principles Behind The NOSQL Alternatives: Nati Shalom discusses the common patterns behind the various NOSQL options available and shows how they address specific issues of database scalability.
• What Is The Difference Between An IoC Container And MEF: Jak Charlton explains the fundamental differences between an IoC container and MEF.
• .NET Serialization Performance Comparison: James Newton-King posts the results of some performance testing from the development of Json.NET – the results are quite impressive!
• 11 Strategies To Rock Your Startup’s Scalability In 2010: 11 fantastic tips on how to scale your application this year.

Web Development

• ASP.NET MVC 2 and Visual Studio 2010: Phil Haack explains why ASP.NET MVC 2 and Visual Studio 2010 have continued to be out of sync.
• Making Sense of ASP.NET Paths: Rick Strahl has posted a fantastic reference of all the path information available in the current request.
• Dynamic Types and ASP.NET MVC: Hadi Hariri has a quick and dirty walkthrough on how to use dynamic types as your view model in ASP.NET MVC.
• Walkthrough Using Autofac As Your IoC Container In An ASP.NET MVC Application: Darren Neimke shows how easy it is to use Autofac as an IoC container in you ASP.NET MVC application.

Take a look at the following Firebug stats:

There is literally no content on this page yet. I’ve got two static resources coming from the site, and I’m using the Google AJAX loader to pull in jQuery and the Maps API. Yet while even the slowest resource from Google takes a scant 144ms to load, the page and resources I’m pulling from my local machine are each taking just over a second!

Further testing showed that where Firefox and Chrome both exhibit this behavior, IE8 did not (or at least not by my seat-of-the-pants testing – the IE developer tools still don’t have a network profiler). Even stranger is that if I connect using 127.0.0.1 or localhost. (notice the trailing .) things improved!

Something isn’t right here.

The Culprit: IPv6 and DNS

With Windows Vista, Microsoft included the IPv6 networking stack by default. Under Windows 7 (and probably Vista) they’ve apparently left resolution of localhost up to DNS. As far as I can tell the slowness isn’t the browsers’ fault, but rather the system trying to resolve localhost using IPv6.

Fortunately the fix is easy. Fire up Notepad (or your text editor of choice) as an Administrator, and open up your system’s hosts file (typically C:\Windows\System32\drivers\etc\hosts). You should see that all entries are commented out. Simply uncomment (remove the #) from the IPv4 localhost entry only, save the file, and restart your browser.

Once this is done, things look much, much better when using Visual Studio’s development server. As we’d expect, the local resources are significantly faster than the external ones.

General

• Disk Based Data Structures: Mikael Svenson writes about utilizing memory-mapped files to access extremely large data structures.
• Lessons Learned (Part 2: Performance Testing and Garbage Collection): Patric Fornasier continues his series of posts about performance tuning with a good nugget about garbage collection.
• What Every Developer Should Know About Character Encoding: David T. explains the essential details of character encoding.
• PDC 2009 Videos: Didn’t make it to PDC this year? No problem.the sessions are available to download or viewing online!
• ReSharper Is Amazing, Take N: Ayende Rahien found a slick feature in the upcoming ReSharper 5.0.automatic pulling in the .NET Framework source code!
• The High Cost Of Losing a Developer: Dave Laribee points out how expensive it is to loose your best talent.
• I Just Cloned, Why Did Git Change My Files: Tim Barcz explains an important, but subtle, concept in Git that can be frustrating if you aren’t aware of it.
• Graffiti CMS Is Now Open Source: Telligent has done the right thing and Open Sourced Graffiti CMS!
• Git’s Guts – Branches, HEAD, and Fast-Forwards: James Gregory takes an in-depth look at branches in Git and how they are different from other popular VCS systems. He follows up with another post about merging and rebasing.

Web Development

• ASP.NET MVC 2 Beta Released: Phil Haack announces the release of ASP.NET MVC 2 beta. It’s loaded with a bunch of new features and a go-live license, but unfortunately isn’t compatible with Visual Studio 2010 Beta 2 (curses!).
• Silverlight 4 Beta – A Guide To The New Features: Tim Heuer has a massive post covering the major new features of Silverlight 4 (didn’t we just get Silverlight 3?).
• Developing and Managing Services with Windows Server AppFabric: Cliff Simpkins outlines some details of AppFabric, which offers technologies to help your IIS-based applications scale.
• PDC09 – ASP.NET MVC 2 – Ninjas Still On Fire Black Belt Tips: Watch Scott Hanselman’s presentation from PDC on ASP.NET MVC. He also links to some solutions to automate downloading all of the available PDC session videos!
• Useful Tips Every Web Designer Should Know About SEO: A great list of SEO tips from Antonio Fullone.
• What’s The First Thing To Learn About ASP.NET MVC: If you’re just now making the switch to MVC from WebForms, K. Scott Allen highly recommends the simple, but powerful, HTML form.
• Faster Apps For A Faster Web – Introducing Speed Tracer: A sweet new tool from Google that gives you insight into how your web sites appear and perform as seen through the eyes of your browser.

General

• Hello Tekpub: Rob Conery announces TekPub.com, a new site he’s launched with James Avery providing screencasts with content provided by the topic experts themselves.
• WPF 4 (VS 2010 and .NET 4.0 Series): Scott Guthrie shows off a bunch of new enhancements and features coming to WPF in .NET 4.0.
• Selective Unit Testing – Costs and Benefits: Steve Sanderson examines the different kinds of code that benefit from unit tests and the costs involved in unit testing.
• It’s All About The Delivery: Hadi Hariri breaks down dependency injection to the bare essentials.
• It’s Okay To Write Unit Tests: Justin Etheredge shares seven steps to writing better unit tests.

Web Development

• ClientIDMode in ASP.NET 4.0: Rick Strahl explains the new ClientIDMode in ASP.NET 4.0 that lets you give your WebForm controls fixed IDs rather than the default munged ones.
• Revisiting "The Fold": Jeff Atwood questions whether the age old rule about keeping content above the fold is still valid.
• Couple Neat Windows Azure Storage Related Announcements: Jim Nakashima passes along two Azure announcements – the Windows Azure CDN and custom storage domain names.
• Unit Testing ASP.NET MVC Routes: Thomas Weller demonstrates a way to unit test your ASP.NET MVC routes.
• ASP.NET MVC Wins With Simplicity, Not Features: Jeffrey Palermo concludes that ASP.NET MVC’s simplicity is why users, not Microsoft, are shouting its praises from the mountain tops – and as a user, I couldn’t agree more!

General

• VS 2010 and .NET 4.0 Beta 2: Scott Guthrie announces the highly anticipated Beta 2 of Visual Studio 2010 and .NET 4.0. In additional to all the great new stuff coming in 4.0, Beta 2 includes a go-live license!
• Mapping From IDataReader/IDataRecord with AutoMapper: Jan Van Ryswyck shows how you can use AutoMapper to help alleviate a lot of the tedious, repetitive code typically needed with straight ADO.NET.
• Treating User Myopia: Jeff Atwood offers some excellent UI design advice about how your users more than likely see your application.
• LinqLite: Jason Allor has put together a library to help with writing your own Linq providers.
• Using a Personal Kanban Board: Peter Microserf tells us how using a personal kanban board has helped him get organized and get things done.

Web Development

• VS 2010 Beta 2 From an ASP.NET MVC Perspective: Phil Haack focuses on what VS 2010 means to ASP.NET MVC developers.
• Using Visual Studio 2010 for Silverlight Development: Tim Heuer writes about how to develop Silverlight applications using Visual Studio 2010.
• The Minutes On 9 – Channel 9 Video Interviews with the ASP.NET 4 Team: Scott Hanselman interviews a bunch of ASP.NET team members about what’s awesome in ASP.NET 4.
• Using the New Microsoft Ajax Minifier: Stephen Walther demonstrates how to make use of the Microsoft Ajax Minifier.
• ASP.NET MVC View Model Patterns: Steve Michelotti shares the pros and cons of the various ways you can build your view models.
• MVC 2 Areas and Containers: K. Scott Allen shows an effective way of combining your favorite IoC container with the default controller factory in ASP.NET MVC 2.
• Modern CSS Layouts – The Essential Characteristics: Smashing Magazine examines key concepts for creating successful CSS layouts using the latest technologies, like CSS 3 and HTML 5, that are starting to be more and more supported by browsers.
• ClientIDMode in ASP.NET 4.0: Rick Strahl gets into the nitty-gritty details on what the new client ID mode is in ASP.NET 4.0 and how to use it.
• MVC Web Testing Strategies – Verifying Content: Jimmy Bogard investigates the challenges of testing rendered content and shows one possible approach.
• HTML 5, A 3 Minute Guide: Curious what all the fuss is over HTML 5? Check out this simple introduction to some key differences.

General

• Through the Eyes of Expression Blend: Check out these excellent step-by-step guides on using Expression Blend.
• Git# – First Public Release: Miguel de Icaza announces the first public release of Git#, a managed library for working with Git repositories.
• Technical Debt Quadrant: Martin Fowler explains the subtle, but important, differences between the many things we often classify as technical debt.

Web Development

• Implementing RESTful Routes & Controllers in ASP.NET MVC 2.0: Ben Scheirman shows how to easily implement RESTful APIs using the next version of ASP.NET MVC.
• ASP.NET MVC 2.0 Preview 2 – Areas and Routes: K. Scott Allen takes a look the ins and outs of the new areas functionality in ASP.NET MVC 2.0.
• Common Web.config Transformations with Visual Studio 2010: Scott Kirkland shares some examples of the new web.config transformations in Visual Studio 2010.
• CSS Differences in Internet Explorer 6, 7, and 8: A good reference to all the quirks we have to deal with when targeting the browser we love to hate.
• Announcing Microsoft Ajax Library (Preview 6) and the Microsoft Ajax Minifier: Scott Guthrie rolls out the preview of some really neat new ASP.NET AJAX components, including a client script loader and a script minifier.
• How the Script Loader in the Microsoft Ajax Library Will Make Your Life Wonderful: James Senior reveals much more awesomeness than I had originally expected in the new Script Loader.
• 10 Features Why ASP.NET 4.0 is Better For Public Website: Ronald Widha lists 10 new features that make ASP.NET 4.0 a great platform for public sites.

General

• Prefer Dependency Injection to Service Location: Steven Harman explains the difference between two common practices for using Inversion of Control containers and shares his opinion why one is better than the other.
• Make BDD Your BFF: Rob Conery has a great step-by-step guide to understanding Behavior Driven Design.
• Make It Easy to Refactor: Jak Charlton shares some thoughts on making your code easy to refactor.
• Understanding T4 – Preprocessed Text Templates: Oleg Sych explains T4 templates.
• Lazy<T> – On Demand Construction in .NET 4.0: Bill Wagner shows off lazy object instantiation in .NET 4.0; not only is it easy to use, it’s also dead simple to make thread safe.
• How to Code Better using AutoMapper: Maciej Gren demonstrates how AutoMapper can be a huge help when coding by automagically translating values between classes.

Web Development

• HTML Encoding Code Blocks With ASP.NET 4.0: Phil Haack highlights a great new feature coming in ASP.NET 4.0 – a new code block syntax for automatically HTML encoding output.
• Announcing the WebsiteSpark Program: Scott Guthrie announces WebsiteSpark, a new program for web development professionals that includes a lot of software to get up and running.
• Mutli-Browser or Cross-Browser Testing and Deconstructing Microsoft Expression Web SuperPreview: Scott Hanselman compares different ways to test your site in various browsers and shows off some really cool stuff you can do using Expression Web SuperPreview.
• ASP.NET MVC 2.0 Preview 2: Phil Haack announces the release of the second preview of ASP.NET MVC 2.0 and highlights a few of the major changes.
• Web Deployment Tool 1.0 Has Shipped: The Microsoft Web Deployment Team announces the 1.0 release of the Web Deployment Tool.
• JavaScript and Its Love For Zeroes: Sergio Pereira explains the intricacies of parsing strings into integers using JavaScript and provides a real-world example of where this could cause massive headaches.
• Unit Testing with jQuery using FireUnit & QUnit: Elijah Manor takes a look at unit testing your JavaScript code.
• Leveraging ASP.NET MVC 2 Futures “ViewState”: Maarten Balliauw shows how you can introduce ViewState-like functionality in you ASP.NET MVC 2 application (gasp!). The first real comment asks the obvious question, “Why???”.