The Infinite Loop

Plain-text passwords: Will it ever end?

Sat, 24 Mar 2012 18:31:39 GMT

Sometimes you just have to wonder how long computer security professionals will have to keep screaming “Don’t store passwords in plain-text” before people take notice. Getting an email like this from MasterCard really freaks me out:

I wonder if they store PINs in plain-text, too. It’s just sad when a credit card company’s policies allow something like this to get pushed in to production.

Yes, SIM Cards Must Die

Fri, 23 Mar 2012 14:26:48 GMT

I like this idea.

The author thinks carriers won’t support it because it will prevent them from locking in customers. I think they should support it because it also prevents competitors from locking in customers.

Read the original post at http://ilyabirman.net/meanwhile/2012/03/23/1/

Opening hours

Sun, 15 Jan 2012 18:26:36 GMT

I really wonder why the Indian Railways, arguably one of the most active e-commerce sites in the country, needs to be offline for an hour every day.

Seriously!?

I run a few web apps of my own and I’ve had only 50 minutes of downtime in an entire month. Yes, I know my app is nowhere near as complex as a railway reservation system. And yes, I know, those of you that are measuring up time in 5 nines are laughing at me, but give me a break – my services are in beta. Still, why does the IRCTC need an hour off every single day? Sure, as a customer, I’m somewhat inconvenienced, but as a developer I’m really curious as to what they’re doing in that hour.

Turn off the complication!

Sun, 08 Jan 2012 05:06:40 GMT

Surely, we’d all be better off if we would just turn off “complications” in our system settings.

Priority #1 for 2012: Exercise

Wed, 04 Jan 2012 10:42:38 GMT

2011 has been a very interesting year for me. It’s the year I found out that my body is in far better shape than I give it credit for. The fact that I’ve done almost nothing to aid that over the last 30 years is, however, somewhat troubling. So, for 2012, I’ve decided that the biggest priority for me is to get more exercise.

The funny thing about exercise is that you don’t really need to do a lot of it to start experiencing the benefits. And, you don’t really need to splurge on a gym, either. Just go take a walk. It really is that simple. If you’re getting absolutely no exercise right now, stepping up to nothing more than a brisk 30 minute walk every day will do wonders for your body. Assuming you’re already eating in a relatively healthy manner, a regular walk is all you really need to start burning off fat, increase your energy levels and generally feel better every day.

Walking for half an hour isn’t difficult. What’s difficult is making it a habit. This video is what got me to finally turn this into a real priority for 2012. I hope it does the trick for you, too.

23 and 1/2 hours: What is the single best thing we can do for our health?

Perspective

Tue, 03 Jan 2012 04:23:32 GMT

When Windows 95 shipped, my primary machine was a 486/DX50 with 8MB of RAM. My test machine was a 386 with 4MB of RAM. The combined computing power and storage capacity of all the machines in my office is now exceeded by your cell phone.

-- Raymond Chen, Microsoft.

Interesting stuff I read last week #2

Sun, 23 Oct 2011 14:38:55 GMT

Programming/technology

Are 9 to 5 programmers looked down upon?

There are many kinds of ugly

What kind of attacks against home router’s NAT do exist?

What were the reasons why Windows never had a decent shell?

Official Usability, User Experience and User Interface Guidelines from companies

Google+ gets a +1 for browser security <—Good checklist for web projects

Just some other awesome CSS3 buttons

Essential jQuery plugin patterns

Ask HN: Open-source alternatives of Gmail?

List.js: Sortable, searchable HTML lists

Lytro camera <—Wow, I want one of these

State of .NET image resizing

Startups

How to build a web startup – lean launchpad edition

Why are hand-written signatures still so commonly used?

The coffee shop fallacy <—”Enjoying the product is the luxury of the customer, not the producer.”

Want something? Make it easy to say yes

Beautiful vs. Usable

Mon, 17 Oct 2011 12:23:27 GMT

I like Chrome. I really do. It’s a lovely browser. Fast, clean, minimal. But every so often I run into minor irritations like this, which is why I still use Firefox as my main browser.

Take a look at what Chrome’s tabs look like once you have a lot of stuff going on:

Now compare that to Firefox:

The way I see it, at this point Chrome’s tabs are as useless as they are beautiful. Firefox shows you less tabs in one go, but at least I can use what I see and I can scroll through the tabs with my mouse’s scroll wheel.

Interesting stuff I read last week

Sun, 16 Oct 2011 13:38:35 GMT

Here are some of the more interesting things I’ve read over the past week.

Programming/technology

Hacked! <— Important stuff. Turn on two-factor authentication in gmail if you haven’t done it already.
When to use C over C++, and C++ over C?
Can touching any hardware inside a running PC be dangerous for you?
Hiding your data in plain sight – USB hardware hiding
Expresso 3.0 -- The premier regular expression development tool
Undo History - Why limit it?
Why is not all internet traffic encrypted?
SSL And The Future Of Authenticity
How do mashups work with same-orgin policy?
Dizzying but invisible depth
There is only one Cloud Icon in the Entire Universe

Health/medicine

Miscellaneous

Disconnect, Disable and De-stress: How I'm learning to sit down, think clearly and get stuff done

Tue, 11 Oct 2011 18:21:28 GMT

The recent Onion article on the death of Steve Jobs really struck a chord with me:

Jobs will be remembered both for the life-changing products he created and for the fact that he was able to sit down, think clearly, and execute his ideas

If you really think about, that's a superhero power – the ability to sit down, think clearly and execute. I've always known that I have trouble finishing things. For as long as I can remember, I've always been a starter. I love the rush of embarking on a new project. The initial brainstorming and roughing out the first prototypes really give me a high. Unfortunately, after that I just fizzle out. The actual process of moving things from prototype to real world product always seems to bore me. Somewhere along the way, I generally lose interest and shelve things. As a result, I now have around 10,327 half-finished things.

That sucks.

Reading that piece on The Onion, however, made me take a good hard look at myself and I decided to make a few changes. One of the things I quickly noticed during my introspection was that I'm distracted very easily. Whether I'm writing code, watching television, reading a book or even trying to fall asleep, my mind is always buzzing with a million different thoughts. I'm not quite sure when that started happening, but now I find that it takes a serious effort for me to focus on a single train of thought for an extended period of time.

There are just too many distractions. Too many devices crying for attention. Too many emails to process. Too many blogs to read. And the worst thing is that the default on every device or app is to let you know instantly when something happens. The list is just endless:

Email
RSS
Twitter
Facebook
Hacker News
etc., etc., etc.

This stuff is Kryptonite.

So, as the first step to regaining my superpowers, I've now decided to turn off every notification on every device or app that I own. That's right, everything. Hell, even my phone now makes noises only for incoming calls. No more "you've got mail", twitter alerts, Facebook messages or blog alerts to get in my way. Zero alerts. Period. No exceptions. Nada. Not on the phone, laptop or desktop.

And you know what? The world suddenly seems like a more peaceful place. It's only been two days since I started doing this and already I can feel my thought process improving. Not only am I getting more work done, but I'm doing a better job at it than before.

Try it, people. Turn off the notifications. There's important stuff to be done. Don't let a new tweet or email take your eyes off the ball.

Essential Geek Skills: Automating incremental snapshot backups on Windows with rsync

Sun, 09 Oct 2011 10:40:07 GMT

I just finished setting up a fully automated incremental snapshot backup regime on my Windows 7 machine. Every night, my script creates an exact replica of my data and retains 3 days of snapshots. This means that I can go “back in time” for three days in case I need to recover something quickly. More importantly, the data isn’t hidden away in some obscure, proprietary file format – it’s sitting there just like a bunch of normal files. This makes it really easy to recover from a catastrophic failure of my main drive.

Note: The process I’m about to describe is for geeks only. If you’re not a geek, maybe you should just buy a decent backup application and save yourself the trouble of doing this manually. If, on the other hand, you’ve got an hour to spare and you’re OK with dealing with things like Cygwin, ntrights and the Task Scheduler, read on!

The core idea is to use rsync to make a backup of your data and use hardlinks to create the snapshots, as described by Mike Rubel.

What you’ll need:

Cygwin (we’ll be using rsync to make the backups)
Windows 2003 Resource Kit (We need a copy of ntrights.exe to do this on Windows 7 Home Premium)
A spare hard disk that’s at least the same size as the drive you want to backup

Step 1: Install Cygwin

Get the installer from the Cygwin site. Be sure to install the rsync package by selecting it from the installer:

Step 2: Prepare your backup disk

Format your disk and create the following files:

1) backup.sh

This file creates the actual backup and manages moving around the snapshots. Just be sure to replace /cygdrive/d/* with your source (the location with the data you want to backup) and /cygdrive/e in the following script to point to your backup drive.

rm -rf /cygdrive/e/backup.3
mv /cygdrive/e/backup.2 /cygdrive/e/backup.3
mv /cygdrive/e/backup.1 /cygdrive/e/backup.2
cp -al /cygdrive/e/backup.0 /cygdrive/e/backup.1
rsync -a /cygdrive/d/*  /cygdrive/e/backup.0/

2) cygrun.bat

This is the file that will startup a bash shell and run our backup script. We’ll be calling this from a scheduled task. The credit goes to Zenovations.com for this script:

@echo off
rem set HOME=c:\
if "%DEF_PATH%"=="" set DEF_PATH=%PATH%
set PATH=c:\cygwin\bin;%DEF_PATH%
set myargs=%*
if "%myargs%" == "" goto noarg
rem echo %myargs%
bash --rcfile "%HOME%/.bashrc" -i -c "%myargs%"
c:
rem pause
sleep 1
goto exit
:noarg

rxvt -e /usr/bin/bash --login -i

:exit
exit

Step 3: Create a scheduled task

Nothing special about this, just set up a standard scheduled task. I’ve set mine to trigger at 4:00 AM every day. The action should look like this:

Step 4: Making it work on Windows 7 Home Premium

If you choose to run this task as a non-administrator user, you will need to ensure that your user account has the “Logon as a batch job” privilege. Unfortunately, Windows 7 Home Premium doesn’t give you an easy way to do this. So get yourself the Windows 2003 Resource Kit and use the ntrights.exe tool that comes with it to assign the privilege from the command line. Credits to Daniel for this tip.

ntrights -u COMPUTER\User +r SeBatchLogonRight

And that, my dear readers, should be it. You should (hopefully) have a fully automated, scheduled, incremental snapshot backup running of your important data.

FileSystemWatcher is (almost) always a bad idea

Thu, 29 Sep 2011 08:08:01 GMT

Using the FileSystemWatcher to watch a folder for changes usually turns out to be a bad idea. From missing notifications to IOExceptions when trying to copy files, I’ve just given up on using FileSystemWatcher to do anything useful. I find that using Quartz.NET to set up a simple scheduled task that polls the folder occasionally is a more reliable and robust solution. Just remember to use stateful jobs to ensure your tasks don’t overlap.

Adding custom log levels to log4net

Wed, 28 Sep 2011 18:38:17 GMT

Logging is a critical piece of infrastructure for any application. On most of my projects, I use log4net because it’s a tried and tested framework that does exactly what it says on the box and stays out of your way. Today, I wanted to start logging security events in an application I’m building. By security events, I mean things like users logging in and out, changing passwords, and so on.

I’m currently using text files to hold all my logs because I think logging infrastructure should be as simple as possible. For all the benefits of using a database to hold logs, I think it adds too many points where things could go wrong, potentially resulting in lost or missing log data. Now, when you’re keeping your logs in plain-text, you need to be careful to structure the log output so you can parse the data easily. The most straightforward way to do this without having to pepper your log data itself with magic strings is to use appropriate log levels.

Out of the box, log4net provides five different log levels:

Debug
Error
Fatal
Info
Warn

I wanted to add things like “Login” and “Logout” to this list. It turns out that this is relatively straightforward to accomplish with log4net.

The first thing you need to do is to create and register your new levels with the LogManager like this:

log4net.Core.Level authLevel = new log4net.Core.Level(50000, "Auth");
log4net.LogManager.GetRepository().LevelMap.Add(authLevel);

It’s important that you do this before configuring log4net.

Adding some extension methods makes it dead simple to start using the new log levels:

public static class SecurityExtensions
{
    static readonly log4net.Core.Level authLevel = new log4net.Core.Level(50000, "Auth");

    public static void Auth(this ILog log, string message)
    {
        log.Logger.Log(System.Reflection.MethodBase.GetCurrentMethod().DeclaringType, 
            authLevel, message, null);
    }

    public static void AuthFormat(this ILog log, string message, params object[] args)
    {
        string formattedMessage = string.Format(message, args);
        log.Logger.Log(System.Reflection.MethodBase.GetCurrentMethod().DeclaringType,
            authLevel, formattedMessage, null);
    }

}

And that’s it – now I can start using my new “Auth” logging level on any instance of ILog like this:

SecurityLogger.AuthFormat("User logged in with id {0} from IP address {1}", id, Request.UserHostAddress);

Getting the latest MVCContrib, NHibernate and Castle to play nicely

Wed, 28 Sep 2011 18:38:17 GMT

I’m using the latest versions of NHibernate (3.0.0), MVCContrib (2.0.96) and Castle Windsor (2.5.1) in a new project I’ve just started. Sometimes when you’re playing with the cutting edge releases of open source products, things don’t always work well together.

After putting everything together, ASP.NET gave me a Yellow Screen of Death:

This is the framework trying to tell you that one of your dependencies is looking for a specific version of a library and the runtime is unable to find that particular version.

Quick Tip #1: How do I figure out what the dependencies are?

Use ildasm to open up the assembly and take a look at the assembly manifest. This will tell you exactly what the dependencies of an assembly are. Looking at the dump for the latest release of MVCContrib.Castle tells us that it needs an old version of Castle:

Ordinarily, you would resolve this by doing what’s called an Assembly Binding Redirection by sprinkling some magic dust that looks like this in the <runtime> section of your application configuration file:

<assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
  <dependentAssembly>
    <assemblyIdentity name="Castle.Windsor" publicKeyToken="407dd0808d44fbdc" culture="neutral" />
    <bindingRedirect oldVersion="2.1.0.0" newVersion="2.5.1.0" />
  </dependentAssembly>
</assemblyBinding>
<assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
  <dependentAssembly>
    <assemblyIdentity name="Castle.Core" publicKeyToken="407dd0808d44fbdc" culture="neutral" />
    <bindingRedirect oldVersion="1.2.0.0" newVersion="2.5.1.0" />
  </dependentAssembly>
</assemblyBinding>

With this in your config file, the framework will now force dependencies to use the newer version of the library.

Unfortunately, in this particular case, using this workaround only leads to another Yellow Screen:

In case you haven’t figured it out yet – now you’re really in trouble.

This message is telling me that MVCContrib is using a method that is no longer available in the newer release of Castle Windsor. At this point, you have three options:

Don’t use the latest versions of everything. Go back to earlier releases of all your dependencies until you find a sweet spot where everything works well with everything else.
Wait for all the libraries you’re dependent on to catch up with each other and use the official releases
Tweak the code and roll your own release

Of course, I went with option three.

I got the latest code from the MVCContrib Mercurial repository. A quick look at the project tells me that the problem is in the WindsorExtensions.cs file in the MVCContrib.Castle project. I also notice that the MVCContrib.Castle project is dependent on a couple of other Castle components:

I downloaded these off of the Castle website and copied over the framework 3.5 binaries to the bin folder in the MVCContrib source tree. I did a recompile at this point and the build was broken. This is a good thing because it means it’s picking up the new files that I just copied.

The project was broken in two places – one was WindsorExtensions, which is what I want to fix. The other was WindsorModelBinder. I have no use for this, so I just took it out of the project and went back to fixing WindsorExtensions. A quick update to the RegisterControllers method got everything to compile again:

public static IWindsorContainer RegisterControllers(this IWindsorContainer container, params Type[] controllerTypes) 
{ 
  foreach(var type in controllerTypes) 
  { 
    if(ControllerExtensions.IsController(type)) 
    { 
      container.Register(Component.For(type). 
          Named(type.FullName.ToLower()). 
          LifeStyle.Is(LifestyleType.Transient)); 
    } 
  }

  return container; 
}

Now I took the new binary, popped it into my project’s dependencies folder, crossed my fingers, and ran the project. Everything works! So, after an hour of digging through the dirt I now have a project that uses the latest versions of MVCContrib, NHibernate and Castle to work with each other.

Adobe Kuler

Wed, 28 Sep 2011 18:38:17 GMT

Adobe Kuler is a really great app to have in your toolkit if you spend any time designing. It's a simple service where you can contribute, rate and share colour schemes. It's a brilliant source of inspiration for design.

In fact, the entire redesign of my blog's theme started off after I saw the Wintery Casual colour scheme on Kuler.

You can use it on the web, or download it as an AIR app.

Whose data is it anyway?

Wed, 28 Sep 2011 18:38:17 GMT

Last week, Yahoo! put Delicious on the chopping board. Delicious, if you haven’t ever heard of it, is a social bookmarking service that more or less brought on the whole idea of tagging stuff mainstream.

Delicious has always been an instrumental part of my web browsing experience. Even if I never really used it to discover new content or to do any research, I’ve always valued the ability to have my bookmarks accessible from anywhere. I’ve been using the service for years now and I have a stack of interesting links saved up from over the years. Many of those links are probably not even active anymore, but it’s still nice to have an “Internet memory” of sorts. The thought of losing that data made me sick.

Needless to say, when I saw the first tweets about Yahoo’s decision my first instinct was to export the data from their servers.

When companies pitch customers about the benefits of cloud computing, one of the really strong points they make is about the safety of your data – that it’s reliably backed up, redundant and always accessible. Until the provider goes out of service or decides to cut you off, that is. This got me thinking about the various other online services that I depend on and I started wondering how I would move on if they ever disappeared.

I evaluated three things about each service:

What are the alternatives?
Are there any other services that could give me the same functionality at the same price range? Is there an open source product that I can host myself? Will existing tools work with the new solution?
How easy is it to backup all my data?
Does the service give you any way to export all of the data that you own?
Is the data portable?
Will it be easy to transition the data to another service?

Email

I have three email accounts that I use daily – one work account, one personal account, and a generic Gmail account. The work account and personal account are using Google Apps for Domains. The email addresses are on my own domain. This gives you a lot of options. If Google were to deny me service, or even go out of business (yeah, yeah, I know you’re rolling your eyes now, but just remember that stranger things have happened), I can easily maintain the continuity of my email. I could run an email server at home, or even rent a virtual machine online and run a server there. Sure, I would miss the awesome Gmail user interface, but I would still have an active email account and, for the most part, life would be the same.

The Gmail account is a whole other story. I don’t control the gmail.com domain, which gives me exactly zero options with that email address. This is a bad thing. If your primary email account is on a domain that you don’t control, you should be be very, very scared. With services like Google Apps and Microsoft Office Live, there really isn’t any reason why you shouldn’t be owning your own domain and email accounts.

Continuing the email service is one thing, but what about the emails themselves? It’s pretty easy to keep a full backup of your data in your own hands. Just configure an good old email client like Mozilla Thunderbird, Microsoft Outlook or Windows Live Mail to sync your email and keep it offline.

Alternatives	Many
Portability	Excellent
Data backup	Very easy

Blog

This blog is already self hosted, so I don’t have much to worry about here. If you’re using a blogging service like WordPress, Blogger or something else, you should take a good look at your options for importing and exporting your posts and comments.

Alternatives	Many
Portability	Good
Data backup	Very easy with the popular services like Blogger and WordPress

Bookmarks

I’ve been using Delicious to handle all my bookmarking needs. There are a few alternatives out there, but I’ve been considering rolling something of my own to do this instead. After all, I’ve never really used any of the “social” aspects of Delicious anyway so this would be an ideal candidate for a wholly self hosted solution. Thankfully, Delicious makes it very easy to export data.

Alternatives	Few
Portability	Not obvious
Data backup	Very easy

Facebook

Facebook is the real elephant in the room when it comes to data portability. How do I export my messages, status updates and “likes”? I’m not even sure it’s possible. Even if I could export all of this data, there’s no alternative social network I can move to with it anyway. Even so, the walled garden that is Facebook worries me.

Alternatives	None
Portability	Irrelevant
Data backup	Impossible / very hard

Twitter

I’ve been sharing some useful links and quips on Twitter. I’m not really too concerned about backing up my tweets at this point, but it’s comforting to know that there are ways to do this if I wanted to. My biggest gripe here is that Twitter doesn’t have a straightforward “export my data” option but there are ways to do this with the API and a whole bunch of third party services have cropped up to fill the void.

Alternatives	None
Portability	Irrelevant
Data backup	Easy

StackOverflow

Arguably the best backup option of all the services listed here, because they give you a sanitized database dump of the entire site on a regular basis. Doesn’t get much easier than this.

Alternatives	None
Portability	Irrelevant
Data backup	Very easy

The bottom line is this – there’s always an inherent risk when you decide to keep your data on somebody else’s servers. The lesson I’ve learned from the Delicious episode is that for any service where I’m creating content, I’ll now be paying close attention to how easy the service makes it to get my data out of their servers.

Nice footer

Wed, 28 Sep 2011 18:38:17 GMT

I really like the look of this footer from good.is. Very clean, organized, and excellent use of colour.

Blog reboot

Wed, 28 Sep 2011 18:38:17 GMT

I think I've neglected blogging for too long. This is something I used to enjoy doing and somewhere along the way I completely forgot about it. So last week I decided to get back to it and started designing the new theme that you see here. I upgraded my blog engine (dasBlog) to a newer version that I downloaded and compiled.

You'll notice that some of the content has disappeared. That's because I cherry picked the content while migrating. I've retained all posts that had comments or some level of traffic.

A company is born

Wed, 28 Sep 2011 18:38:17 GMT

Why did we do it? Subroto Bagchi explained it best in his book, The High Performance Entrepreneur: Golden Rules for Success in Today's World:

"… starting a company is like deciding to have a baby. Ask most women and they will tell you that there can never be a rational enough reason to get into the problems of bearing a baby. It is a very difficult task, full of discomforts and sacrifices. Yet, when the time comes, a woman would give up everything in the world to bear her child. No pain, no discomfort, no change in lifestyle daunts her from becoming a mother.
Starting your own enterprise is a little like motherhood. You know it when the time has come and you waive all caution and comfort to embrace the little sign of life deep inside you and you would do everything – everything – to bring it to the world."

On the 31^st of August, 2009, I, along with a few good friends, brought TetraStorm Technologies Private Limited to life. There's an inexplicable sense of accomplishment that I get every time I see my name in the list of directors in the Memorandum and Articles of Association. Yes, I know this is just the beginning and there's a lot of hard work ahead of us.

But you know what? We're a bunch of explorers with backpacks. We've got a map that we think will lead us to a pot of gold. We've got a heart full of passion and an ounce of skills. We've got vision and we're stubbornly determined. We have our eyes set on the horizon and our feet firmly on the ground. How can we be so sure of success? We're too young and too foolish to even imagine that failure is a possibility. And did I mention we have a map?

Implementing ActiveX events that can be used in JavaScript

Wed, 28 Sep 2011 18:38:17 GMT

Recently I came across a requirement to create an ATL ActiveX control that could be used from JavaScript in the following manner:

o = new ActiveXObject("Test.MyControl");
o.OnStateChanged = MyEventHandler;

I figured this would be pretty simple -- just implement an ActiveX control with connection points. Unfortunately, it doesn't work. Internet Explorer complains thus:

This is because JavaScript can't sink COM events. This seemed odd to me, because the same approach works when you try to use the XMLHttpRequest object. As it turns out, XMLHttpRequest doesn't implement "events" as COM events at all. They're actually properties that accept IDispatch pointers. JavaScript functions are marshalled to ActiveX as objects that implement IDispatch and having a method named "call".

Simply put, this is what we need to do to enable ActiveX events to be handled by JavaScript using the syntax shown above:

1) Implement a property in the ActiveX control that accepts an IDispatch pointer.

STDMETHODIMP CTestCtrl::putref_OnStateChanged(IDispatch* newVal)
STDMETHODIMP CTestCtrl::get_OnStateChanged(IDispatch** pVal)

2) Get the DISPID of the "call" method by calling GetIDsOfNames like so:

newVal->GetIDsOfNames(IID_NULL, &szMember, 1, LOCALE_SYSTEM_DEFAULT, pDispId))

3) When you want to invoke the event, construct a VARIANTARG containing the parameters you want to pass to the event in reverse order. Add a pointer to your own IDispatch implementation as the last element in the array.

DISPPARAMS dispParams;
VARIANTARG args[2];

VariantInit(&args[0]);
args[0].vt = VT_BSTR;
args[0].bstrVal = ::SysAllocString(L"The event says hello!");

IDispatch* pDisp;
HRESULT hRes = this->QueryInterface(IID_IDispatch, (void**)&pDisp);

VariantInit(&args[1]);
args[1].vt = VT_DISPATCH;
args[1].pdispVal= pDisp;

memset(&dispParams, 0, sizeof(dispParams));
dispParams.rgvarg = args;
dispParams.cArgs = sizeof(args)/sizeof(args[0]);

EXCEPINFO excepinfo; 
UINT uArgErr;

pEventHandler->Invoke(*pDispId, IID_NULL, LOCALE_SYSTEM_DEFAULT, 
    DISPATCH_METHOD, &dispParams, NULL, &excepinfo, &uArgErr);

4) Clean up when you're done by calling VariantClear on both elements of the args array.