We recently started to sign every ORF PE binaries digitally—you know, trust, integrity and all. For signing the files, we use Microsoft’s signcode that offers a command-line interface for Authenticode signing. All we need is to pass the .SPC file (Software Publisher Certificate), the .PVK file (Private Key), the binary file and maybe the public timestamp service URL of Verisign. It is quite simple:

signcode -v spc mycert.spc -v mycert.pvk -t http://timestamp.verisign.com/scripts/timstamp.dll mybinary.exe

Alas, it quickly turned out that signcode does not play very nice with build scripts. The private key is password-protected and signcode does not support specifying the password as a parameter. Instead, it prompts for the password in a dialog every time a file is signed. Apparently, I am not the only one who think it is a problem.

The best solution I found on the Microsoft newsgroups is to find the password dialog window by its title and send the password as keyboard messages. I do not know what you say, but simulating user input makes me hiccup and also anything that pops up a dialog can hardly be called ‘unattended’.

By further research, now for an API, I found that Microsoft’s CAPICOM 2 can do the signing very easily and also allows specifying the private key password. It wants a .PFX (PKCS #12 certificate) file instead of an .SPC and .PVK, but Microsoft offers another utility call pvkimprt that can combine the .SPC and .PVK into a .PFX as:

pvkimprt -pfx mycert.spc mycert.pfk

This will invoke a wizard for making the .PFX export. Once you have the .PFX, you can continue with signing. The following JScript code snippet demonstrates using CAPICOM 2 for code signing:

var Signer = new ActiveXObject("CAPICOM.Signer");
Signer.Load("mycert.pfx", "mypassword");

var SignedCode = new ActiveXObject("CAPICOM.SignedCode");
SignedCode.FileName = 'filetosign.exe';
SignedCode.Description = 'Here Be Dragons';
SignedCode.Sign(Signer);

By adding the following line the above code, you can also timestamp the file.

SignedCode.Timestamp('http://timestamp.verisign.com/scripts/timstamp.dll');

And that’s all.

SECURITY WARNING: It is quite obvious that signcode lacks the password option for security reasons. Microsoft is absolutely right about private key security—your code signing certificate and password are worth a lot more than the few hundred bucks you paid for them, so you really want to store it securely. Hardcoding the password into a script is definitely not secure, but probably you could make use of the above when you have to sign a couple of files at once.

We have closed our latest recruiting period the other day and I am delighted to report that we hired two new developers – for a small ISV like Vamsoft, that’s actually a big number.

Recruiting new devs is particularly hard here for a couple of reasons, because the market is small and because we were looking for specific knowledge and attributes that reduce the numbers further. The point is, that we are looking for developers instead of programmers. Erik Sink defines a developer as someone “who will contribute in multiple ways to make the product successful“. That is correct. If your company is large enough to hire specialists to cover every aspect of the development, you can probably afford hiring coding specialists (programmers) who do nothing but translate design to code. A small ISV, by definition, is small, so you need people who can do more than writing code.

But how do you know if one is a developer? We believe that the answer lies in live interviews, which include a test to measure the knowledge and free discussion to measure other qualities. Of course, live interviews take up lots of time (1-1.5 hours usually), so we could not invite everyone, so in the first round we filtered out those who did not caught our attention (see advices below) and we asked for a source code snippet of a personal project from the rest.

The good developers I know have their own consistent coding style. It may be very different from how our code looks like, but it should be reasonably clear and quite possibly elegant. Lack of these qualities are pretty bad signs. Also, note the “personal project” part. I can hardly imagine any good developer to have no personal code and even if she does not and she cares about taking our job, she could write something in half an hour that impresses us. Our experience shows that this filter works extremely well.

As for catching the attention, we received a bunch of poor CVs and had rather mixed experience on the interviews. I collected a few random advice that could have made it better, so the rest of the article is for the job seekers out there.

Dear Job Seeker,

The person who reviews your CV will spend only a short time with it, probably less than one minute: write your CV with this in mind. You probably have to spend a couple of hours with tweaking, but the difference that a good and a bad CV can make is enormous. If you wonder what can make your CV better, read a few random thoughts below. Some may sound obvious, but I should note that these are built on actual experiences.

• Get the grammar in your CV right. As a software developer, proper grammar is probably not the most important asset that you can offer, but the fact that you did not clean up typos and grammar mistakes from your CV tells us that you do not care. Companies want people who care for the quality of their work. Use a spell checker or ask someone to help.
• Less is more. If you tell us that you are proficient programmer in x86 assembler, Pascal, Delphi, C, C++, Java, C#, Perl, Python, PHP, Lisp, Ada and Eiffel, we will think you are proficient with none of them. Taking a half year class in C# will not make you an experienced C# coder and if you do not know that, you obviously do not know what it takes to be proficient in any language.
• Talk about your achievements. It is nice to know that you worked for this or that company as a software developer, but if you also tell us you that wrote a middleware solution based on your own implementation of XML-RPC with MIME binary transfer on HTTP, we will be much more impressed.
• HTML is not a programming language. It’s called a markup language. If you list it as a programming language, we will think that you have no idea.
• Little lies are still lies. The term “Intermediate English” does not translate to “I hardly speak a word in English”. And no, it is not a good idea to lie about that. 96,8% of programming materials are available in English only and yes, I just made that number up.
• Limit your CV to two pages. It is not that you should compress your CV by 8pt Times New Roman or by tricking with line height or margins (actually, such tricks render your CV unreadable on screen and you reduce your chance by 195%). Instead, customize your CV for the given position. Shrink the irrelevant experiences and emphasize relevant ones, so when the position requires excellent Delphi skills, focus on Delphi and not on C++.
  Also, shrink your CV by omitting needless words.
• Format counts. For bonus points, send your CV as .PDF and not as .DOC. First, we might have an older version of Word than you have and it may not deal with newer formats very well. Second, if you use non-default fonts, there is a good chance that we will not have them on our system and your CV will look ugly. PDFs have necessary font subsets embedded.
  Also, do not send your CV compressed. We will open your CV several times and doing Save-Extract-Open every time is bothering. If you still feel that your responsibility is to cut back our storage costs, send ZIP. Windows XP supports it natively and no, we do not have WinRar.
• You don’t have to wear a suit, but… “casual dressing” for an interview is not slippers, shorts and your favorite 10-years old Suicidal Tendencies T-shirt either. A clean shirt, jeans and regular shoes will do.

Thank you for listening.

We have stopped offering the ORF “CD On Demand” service with ORF orders. Although almost everyone purchased it with new ORF licenses, we think it was confusing, because people might have expected an “official” CD, just without the printed manual and the box, like with Windows OEM licenses.

Actually, “CD On Demand” is a share-it! service that they added to our product offerings automatically and it was just the registered ORF build binary burned to a CD. It generated no extra income for us, but if only a few customers were disappointed because they expected an “official” CD, we should have stopped this long ago.

According to The Register, Borland is near to full completion of the sale of its Developer Tools division to a buyer not specified yet. Wow. I can only hope that the new owner of Delphi will restore the fading shine of this otherwise once-excellent development tool. Quickly, if I may. I have a couple books C# stacked up on my shelves.

Two days ago version 3.0 was released. It took 10 months and 4 days, 17 820 new and at least twice as much changed lines of code, but finally it is ready for production use. Great :)

As for the future, we discuss the strategic questions these days, so there is little information to be leaked. We already decided to extend the ORF team with new devs and to update the ORF identity and web site design (it’s so 90’ish!).