#packtpublishing

These days I'm starting to work on the next edition of my ASP.NET Core and Angular book: if everything goes well, it will be the fifth (!) one. If the ASP.NET Core and Angular teams will respect their release schedule the new book will mostly likely deal with ASP.NET Core 6 and Angular 13, which are expected to get released in Q4 2021. Without further ado, here's a brief list of some new features that I plan to add to the 5th edition of the book: - Swagger. A brand new chapter dedicated to Swagger, the world's most popular design, development & documentation standard for RESTful APIs using the Swashbuckle.AspNetCore package. - GraphQL. A brand new chapter to explore GraphQL, the well known open-source data query and manipulation language for APIs using the GraphQL.NET SDK, Altair UI and the Apollo Angular client. - SignalR. A brand new chapter to introduce SignalR, an awesome open-source software library for Microsoft ASP.NET that allows the back-end server (ASP.NET) to send asynchronous notifications to the front-end client (Angular), thus adding real-time web functionality to web applications, using the ASP.NET Core SignalR library. - Protractor. A new addition to Chapter 9: ASP.NET Core and Angular Testing where we'll talk about Protractor, and end-to-end testing framework for Angular applications. And the list goes on: the new edition will also feature a full revamp of all previous chapters, an extensive overview of the many Entity Framework Core 6 new features, and much more! Together with Packt I have prepared a short survey to collect reader feedback on the latest edition: what topics you liked the most, what you would like to find in the next edition, and so on. If you feel like helping us you can do so using this link. Thank you for taking time to help us!

What's new in ASP.NET

ASP.NET Core 6 preview 6 has been released less than a week ago and is packed with many great new improvements. Here's a full list of what's new in this preview release: - Improved Blazor accessibility - Required Blazor component parameters - Efficient byte array transfers for JavaScript interop - Optional parameters for view component tag helpers - Angular template updated to Angular 12 - OpenAPI support for minimal APIs - Inject services into minimal APIs without  attribute - Configure the accept socket for Kestrel - IHttpActivityFeature - Long running activity tag for SignalR connections - WebSocket compression - SignalR WebSockets TestServer support - New OnCheckSlidingExpiration event for controlling cookie renewal ClientCertificateMode.DelayCertificate

What's new in Angular

The official Angular roadmap hasn't been updated for a while, however there are a lot of upcoming features that have already been announced this year: - Better Developer Ergonomics with Strict Typing. Implementing a stricter type of checking for reactive forms allows developers to catch more issues during development time. - Reduce Framework Overhead. Removing legacy View Engine for the smaller Angular conceptual overhead (lower maintenance cost, lower complexity of codebase, and a smaller package). - Improved Text Times and Debugging. Automatic test environment tear down improves test time and creates better isolation across tests. The goal is to change TestBed to automatically clean up and tear down the test environments after each test run. - Optional NgModulars. Optional NgModulars allow developers to develop standalone components and implement an alternative API to declare the component’s compilation scope. - Support Directives to Host Elements. Adding directives to host elements allows developers to augment their components with more behaviors without inheritance. - Angular Compiler as a PlugIn (tsc). When making this a reality, the developers substantially improve build performance and reduce maintenance costs. - Ergonomic Component Level Code-Splitting APIs. Applying a more granular code-splitting component level is one way to improve the initial load time.

Conclusion

Writing a programming book is a task that almost always proves to be much more difficult than expected, especially when dealing with mutable and unpredictable frameworks such as ASP.NET Core and Angular. Once again we had to wait for the release of the latest "final" version of Angular, just as already happened in 2017 with my previous book: Angular 5.0.0 version, initially scheduled for September 18th, was postponed for over a month ( October 23th) and then released on November 2 after no less than nine release candidates. After that experience we all thought we couldn't experience anything worse, but we were wrong: the latest major release of Angular experienced a delay of over two months (from December to February) and was further delayed by fourteen release candidates, thus arguably being a world record of some sort. Luckily enough, the wait is finally over: on the night between 6th and 7th February 2020, just over 24 hours ago, Angular version 9.0.0 was released on GitHub, thus allowing me to finishi the book in due time and the publisher - Packt Publishing - to honor the expected release date, which had been set to February 11th.

Now that the expected schedule has been successfully met, I would like to spend a couple words - well, maybe a bit more than that - to tell you about a rather odd experience I had this afternoon while surfing the web. Truth to be told, there's a high chance that you've heard similar stories already: however, I personally think that such kind of fun facts never gets old enough; other than being hilarious, they can also greatly help to understand how the web that we're browsing nowadays actually works. So, while issuing some search queries on Google to calculate the SERP indexing level reached by the sites that had the book available for preorder, I came across this strange twitter post:

There was no mistake there: the post was clearly mentioning my book, with matching ISIN, name, author and description; and it was also telling me to download it for free (in e-book format) my clicking on an unidentified link. Such truly incredible opportunity could be seized since February 4th, judging by the tweet's time stamp: 7 days before the book's planned release date, and - most importantly - 2 days before I've actually finished writing it (!) The twitter profile was just like you might expect from a fake account: owned by Christine H. McAndrews, a cute girl with zero followers, registered in January 2020, and only tweeting about forthcoming books and how to download them. Needless to say, each and every link was pointing to the same website.

Given such intriguing scenario, I couldn't avoid taking a look to the website itself. Eventually, I landed on a blatant scam page who looked just like a bulletin board system, where some (fake) users were enthusiastically talking about my book:

The page worked in a rather fun way that deserves a couple words: it was programmed to "dynamically" fill a series of placeholders with the book info (name, author, and so on) brought by the URL GET parameters: those placeholders were scattered within the page, thus trying to emulate a plausible "thread" of enthusiasts who were talking about the book. Such neat mechanic allows "Christine", who's obviously an automatic tweet-bot, to spam the same URL in her posts, filling the GET parameters with the metadata taken from the upcoming books she wants to "promote"; a great bait for any unwary twitter (or google) user looking to download them to no cost. (side note: the GET parameters also included the image URL for the book cover hosted on Amazon; unfortunately,  the fake page doesn't seem to have properly implemented it, since it's not showing anywhere). The fake thread developed by the page portrays a rather predictable scene, typical of online scams. The opening message is written by a user which is desperately looking for the book because he/she can't find it anywhere; a (fake) user responds to the request, suggesting a link to a "free e-book download" service (the actual scam website):

The scam attempt continues by staging the typical gimmick of the doubt dispelled by the denial, a trivial social engineering trick to win the trust of the potential victim and push her to perform a potentially risky call-to-action: the (fake) opening poster replies objecting that that site asks for a credit card ...

... but is immediately reassured by another (fake) user who confirms the authenticity and reliability of the service: "don't worry, it's all trusted: just put the card in and proceed with the download!"

The trust level is further raised by the original (fake) user , who confirms that everything went really well; the credit card was just a way to check it was a real user, just like a CAPTCHA: now everything makes sense!

The scene ends with another couple of users who confirm the authenticity of the site and praise the characteristics of the service: the scam is served.

In the unlikely case you want to take a look at the "scam forum thread" page, you can access it by copying the following URLand pasting it in your browser's address bar: https://toositego.ml/az.php?q=ASP.NET+Core+3+and+Angular+9+-+Third+Edition+-+Valerio+De+Sanctis&i=https://m.media-amazon.com/images/I/61kIIUNGgLL._AC_UY327_FMwebp_QL65_.jpg Needless to say, you should only do that if you know what you're doing: although the page currently doesn't host malicious scripts, nothing prevents the administrators (aka the scammers) from change such behavior in the near future; however, the real threat is inside the suggested "download link" that appears within the thread: be sure to not visit it, let alone enter your credit card or any other data anywhere.

Conclusion

Mancano soltanto pochi giorni all'uscita del mio nuovo libro e, come sempre, l'attesa è tanta. Ancora una volta abbiamo dovuto attendere il rilascio dell'ultima versione "final" di Angular, proprio come già accaduto in passato: la volta scorsa si trattava della versione 5.0.0, inizialmente prevista per il 18 settembre , quindi rimandata di oltre un mese (23 ottobre) e infine rilasciata il 2 novembre dopo ben nove release candidate. Dopo quell'esperienza pensavamo di averle viste tutte, e invece stavolta ci siamo superati, dovendo affrontare un ritardo di oltre due mesi (da dicembre a febbraio) costellato da quattordici release candidate, un vero e proprio record! Ad ogni buon conto, finalmente l'attesa è finita: nella notte tra il 6 e il 7 febbraio 2020, ovvero poco più di 24 ore fa, la versione 9.0.0 di Angular è stata rilasciata su GitHub, consentendo al libro di entrare in stampa e all'editore Packt Publishing di rispettare la data di pubblicazione, fissata pessimisticamente (neanche tanto, come poi s'è visto!) all'11 febbraio.

Tutto è bene quel che finisce bene, direte voi... e invece no! Effettuando alcune ricerche su Google per calcolare il livello di indicizzazione SEO raggiunto dal sito mi sono imbattuto in uno strano post twitter che menzionava il mio libro - con tanto di ISIN, nome, autore e descrizione - invitando a scaricare l'e-book mediante un link non meglio identificato.

Il profilo, intestato a una certa Christine H. McAndrews, sembrava ovviamente tutto meno che autentico, presentando anzi tutte le più evidenti caratteristiche del classico account fake: zero following/follower, iscrizione a gennaio 2020, e una sfilza di post recanti informazioni su come scaricare libri di prossima uscita, tutti corredati da link che puntano allo stesso host.

Il sito indicato dai link di "Christine" ha l'aspetto di un forum a carattere generale, ma è sufficiente una prima occhiata per comprendere che si tratta di una scam page che tenta di spacciarsi come una discussione di appassionati che parlano del libro.

La pagina è stata programmata in modo tale da riempire "dinamicamente" una serie di placeholder disseminati all'interno dei vari fake-post con il nome del libro e dell'autore presenti nei parametri della URL: questo consente a "Christine", che ovviamente altri non è che un tweet-bot automatico, di utilizzarla nei suoi post per ciascuno dei libri che l'autore di questa truffa ha intenzione di "promuovere", o per meglio dire di utilizzare come esche per attirare qualche navigatore sprovveduto desideroso di scaricarli a costo zero. Tra i parametri c'è persino la URL di un'immagine del libro presa da Amazon, che purtroppo è stata implementata male visto che - ad oggi - nella pagina non compare. Inutile dire che, nel finto thread sviluppato dalla pagina, un (finto) utente risponde alla domanda dell'opening poster suggerendo un servizio di "download gratuito di e-book" (all'interno del quale si consumerà la truffa vera e propria):

La truffa prosegue mettendo in scena la classica trovata del dubbio fugato dalla smentita, un classico espediente per conquistare la fiducia della potenziale vittima e spingerla a compiere una call-to-action potenzialmente rischiosa: un utente (finto) risponde obiettando che quel sito chiede la carta di credito...

... ma è subito seguito da una serie di altri utenti (anch'essi finti, ovviamente) che confermano l'autenticità e l'affidabilità del servizio: "non temere, è sicurissimo: metti la carta e potrai procedere con il download!"

Il messaggio viene reiterato dalla conferma dell'utente (finto) originario, che conferma il funzionamento del sito: veniamo così a sapere che la carta di credito serve solo a confermare che chi vuole scaricare l'ebook è una persona reale, praticamente un CAPTCHA:

La scenetta si conclude con un'altro paio di utenti che confermano la genuinità del sito e lodano le caratteristiche del servizio: la truffa è servita.

Nel caso in cui vogliate dare un'occhiata alla pagina in questione, potete accedervi copiando l'URL che trovate qui di seguito e incollandolo nella barra degli indirizzi del vostro browser: https://toositego.ml/az.php?q=ASP.NET+Core+3+and+Angular+9+-+Third+Edition+-+Valerio+De+Sanctis&i=https://m.media-amazon.com/images/I/61kIIUNGgLL._AC_UY327_FMwebp_QL65_.jpg Inutile dire che si tratta di un'operazione da compiere con cautela e facendo molta attenzione: la pagina al momento non contiene script dannosi, ma nulla vieta agli scammer che gestiscono il dominio di modificarne i contenuti nel prossimo futuro; quel che è certo è che non dovete per nessun motivo accedere al link contenuto (e più volte reiterato) all'interno del thread, men che meno inserire la vostra carta di credito o qualsivoglia altro dato.

Conclusione