Coding in Delphi and Beyond - Thoughts from David Cornelius

A "Simple" Christmas Tree App

david — Wed, 31 Dec 2025 04:15:21 +0000

A "Simple" Christmas Tree App

The Initial Experiment

After some discussions on Delphi-PRAXiS, I decided to try an experiment to see how much of a Delphi application could be written purely with AI. I used Claude Code, and since it was a couple of days before Christmas when I started, asked it to write a cross-platform app that displayed a Christmas tree with ornaments that would fall and break, thinking I would submit the finished app a day before Christmas.

The program includes several images: a Christmas tree background and, for each ornament, two images, one intact while hanging on the tree and one broken after it's crashed on the floor. There are also a few crash sound files I found online; a random one is chosen each time.

Well, I got the Windows version working fairly quickly with only a little back-and-forth with Claude and without touching a line of code. I created the Christmas tree background and the ornaments in Artspace.ai. After converting the crash sounds to the right format for each platform, I got busy testing on various devices. The finished app is on Github.

Lesson 1: Playing Sound Files on Windows

I wanted the crash sound to happen after the bulb started falling and play immediately when it hit the floor and switched to the "broken" image. But one thing I noticed right away when testing on Windows was a significant delay when the sound played. Claude had written it to use the TMediaPlayer component, which made sense to me as this is a cross-platform media player in Delphi, but nothing I tried enabled a smooth transition from falling, to crash sound, to crash image. The ornament would fall, then disappear just before it hit the floor while it loaded and played the crash sound, then switch to the crash image, a terribly slow transition.

After some research and looking at other sample applications, I realized that for Windows (and Windows only), I should not use the TMediaPlayer for this but instead call sndPlaySound from the WinAPI unit.

I told Claude about this and it agreed and happily changed the code for me. Switching to this was a vast improvement; I'd probably need to implement threading and some intricate timing to get it perfect but this was supposed to be just a simple experiment of vibe coding and the result was close enough to be satisfying.

Later testing revealed the TMediaPlayer component worked fine for the other platforms.

Lesson 2: Device File Locations

Once the application concept was proven and working on the default Windows platform, I turned to the first mobile platform. Since I use an Android phone, it's most handy so started up wireless debugging, connected via adb, and deployed the project. I immediately got an error telling me that it found "unsealed contents present in the bundle root". After some research I figured out that unsigned files were in a location they shouldn't be; basically, I had not put the external files in the right folder.

For Windows programming, we've had the "luxury" (and sometimes plague) of being able to put and access files wherever we want. I had simply let Claude keep the sound and image files in the root of the project instead of moving them to a folder (after all, this was just a simple program; a larger, "real-life" application would be organized with layers of hierarchical folders). But mobile apps are much more restrictive; there are certain paths where external files are allowed and expected. On Android, these files are typically accessed from the application's assets\internal folder, which is returned as the "Documents" folder in Delphi code (more on this below).

Before continuing the story with mobile platforms, let me digress to the other "desktop" type platform. Deploying to a Mac desktop is second easiest (after Windows) because it doesn't have some of the limitations or screen size constraints that hand-held devices do. After hooking up to the Platform Assistant Server on my old Intel-based Mac and trying a build, I got the same "unsealed contents present in the bundle root" error I had when I first attempted to deploy to my Android phone.

The source of the problem was similar in both instances but required a different deployment strategy. Both Windows and Mac OSX can access files from the "application path" but the Mac compresses supporting files into a delivered bundle and when extracted, a "virtual" application path is created in Contents\MacOS. After adding files to the project's Deployment Manager interface (Project > Deployment), I had the Mac OSX version working as well.

Remember how the assets\internal path on an Android is returned as the standard "Documents" path? I wanted something similar for the iOS platform to keep the code consistent. Using Delphi's Deployment Manager, I had a great deal of difficulty getting the files into the right location, which should be Startup\Documents on iOS. Finally, I found and used the Grijjy Deploy Manager to rewrite the .dproj file and it worked beautifully! (Why setting that same path in Delphi's Deploy Manager wouldn't work is a frustrating mystery.)

To summarize, here are the destination folders for supplemental files on each platform:

Windows: Application Path
Mac OSX: Application Path (Virtualized)
Android: assets\internal
iOS: Startup\Documents

On Windows, there's a Build Event to copy the files out to the output folder. For the other three platforms, the files must be listed in the Project Deployment window. As mentioned above, the Grijjy Deploy Manager can set up those files for Android and iOS, but you have to add the ones for the Mac OSX desktop yourself using the Delphi interface.

The code to reference these folders on the various platforms is simple, thanks to platform-agnostic functions that provide simple access to the platform-specific folders for each platform; these functions are in the System.IOUtils unit. Thus, the function Claude wrote (and I modified) that returns the correct path for each platform is simply this:

function TMainForm.GetResourcePath: string;
begin
  {$IF DEFINED(ANDROID) OR DEFINED(IOS)}
  // Android: resources in assets/internal folder
  // iOS: resources in app's documents
  Result := TPath.GetDocumentsPath;
  {$ELSEIF DEFINED(MSWINDOWS) OR DEFINED(OSX)}
  // Windows: resources in same directory as executable
  // Mac OSX: resources in Content\MacOS "virtual" app path
  Result := TPath.GetAppPath;
  {$ELSE}
  {$MESSAGE FATAL 'Unsupported platform'}
  {$ENDIF}
end;

The key statements are where it assigns the Result: GetAppPath on Windows and Mac OSX, and GetDocumentsPath for Android and iOS, basically the Application path for desktop applications and the Documents path for mobile devices.

I could have used GetDocumentsPath for all platforms; on Mac OSX, the Deployment settings would've been a little different, for Windows, those files would be mixed with hundreds of other files in my general "Documents" folder, not ideal.

Lesson 3: New Apple Signing Requirements

Admittedly, I don't write apps for the Apple platforms very often; I write mostly for Windows and sometimes my Android phone. In the past, to generate the proper signing ID to prepare an iOS app, I could create a plain "Hello World" app in XCode on the Mac (using their default template without any code), give it a unique name, then use that in my Delphi project to code-sign the files. That no longer works, I needed to renew my Apple Developer account to properly sign and build even a simple app.

After paying the fee, waiting until the account was refreshed (the next day), and creating an identifier for the app, I was finally able to get the app working on my iPad.

Summary

There were several other small lessons along the way in the course of coding, conversing with AI, and general configuration and testing of the various platforms. There were also several delays due to the holidays, family get-togethers, and whatnot; so, of course, I didn't get this out before Christmas. But it's not quite New Year's yet and many people (who participate in this particular Christmas decoration) still have their Christmas tree up, so I hope it's still somewhat relevant in that respect.

Originally, this was going to take just a few hours and I was going to leave a paragraphical comment about the experience on the forum. I'm still impressed by what Claude Code accomplished but it turned into much more of a learning opportunity while I had some time off work.

The main reason for this blog, then, is to document some of the tripping points for my future self. I need to write some other cross-platform apps and I want to keep my skills fresh. I also realized that I had not played sound files before, or dealt with external files before other than a single database file in the standard "Documents" folder when I wrote some sample apps for a book a few years ago.

I hope this helps someone else, too. And if there's something here which I've written that could've been done differently or if there's an assumption I made that isn't quite right, please leave me a comment. I'm always open to learning a better way to do things!

Add new comment

Fun with Ruby

david — Fri, 19 Dec 2025 07:00:00 +0000

Fun with Ruby

Category

Programming

david Thu, 12/18/2025 - 23:00

Last December, I discovered Advent of Code, daily programming puzzles during the first part of month, and wrote my solutions in Delphi. When this year's challenge started, I decided to use a different programming language as an excuse to learn something new. I've had the book "Seven Languages in Seven Weeks" for a while and never even got through the first chapter (it was always something I should read someday). So I finally picked it up and told myself I would use the very first language in that book, no matter what it was (I honestly didn't remember from when I had glanced through it several months earlier). It turns out the first language it discusses is Ruby! Thus started my adventure in learning!

The book is not very big and it's not meant to be an exhaustive tutorial, so I signed up for a Udemy course and quickly went through as much I figured I needed to get started and dove into the AoC challenges. Presented here is my solution to Day 1 of AoC 2025 in two programs, one in Ruby and the other in Delphi, structured as nearly the same as possible so you can see the differences.

The Simple Challenge: Rotate a Dial

Advent of Code 2025's Day 1 challenge involves simulating a dial that rotates left and right, tracking when it lands on or passes through zero. This seemingly simple problem reveals fundamental differences in how Delphi and Ruby approach software design.

Class Structure: Explicit vs. Implicit

Delphi's Interface/Implementation Separation

type
  TDialPassword = class
  private
    const
      DIAL_MAX = 99;
    var
      FCurrPos: Longint;
      FZeroCount: Longint;
      FZeroPassive: Longint;
      FLogit: Boolean;
  public
    constructor Create;
    procedure Rotate(const Amount: Integer);
    property Logit: Boolean read FLogit write FLogit default True;
    property ZeroCount: Longint read FZeroCount write FZeroCount;
    property ZeroPassive: Longint read FZeroPassive write FZeroPassive;
  end;

{ TDialPassword }

constructor TDialPassword.Create;
begin
  FZeroCount := 0;
  FZeroPassive := 0;
  FCurrPos := 50;
  FLogit := True;
end;

Delphi enforces a clear contract: declare everything up front, implement it separately. This separation aids readability in large projects and enables circular unit references, but requires more boilerplate code.

Ruby's Unified Definition

class DialPassword

  attr_accessor :zero_count, :zero_passive, :logit
    
  def initialize
    @zero_count = 0
    @zero_passive = 0
    @curr_pos = 50
    @DIAL_MAX = 99
    @logit = true
  end

  ...

end

Ruby combines declaration and implementation. The attr_accessor line creates both getters and setters in one statement; it's roughly the same as Delphi's public property declarations. Instance variables (prefixed with @) spring into existence when first assigned. This brevity can be refreshing for small programs but may obscure the class interface in larger codebases.

Type Safety: Compile-time vs. Runtime

Delphi's Type Declarations

var
  FCurrPos: Longint;
  FZeroCount: Longint;
  FZeroPassive: Longint;
  FLogit: Boolean;

procedure Rotate(const Amount: Integer);

Every variable has a declared type in Delphi (except for inlined variables with type inference, which still happen at compile-time). The compiler catches type mismatches before runtime. Using const Amount: Integer prevents Amount from being anything other than an Integer. This is a nice safety net if you inadvertenly misspell or pass in a wrong variable but annoying if you're accustomed to languages that automatically convert data to a common type.

Ruby's Dynamic Typing

def rotate(amount)
  @curr_pos += amount
  # ...
end

Ruby infers types at runtime. The amount parameter could be an integer, float, or even a string (which would cause a runtime error). This flexibility enables rapid prototyping and simplifies the code you type but shifts error detection from compile-time to runtime which can be harder to track down.

The Core Algorithm: Similar Logic, Different Expression

Both implementations share the same rotation logic, but express it quite differently:

Delphi's Rotate Method

procedure TDialPassword.Rotate(const Amount: Integer);
begin
  // Special case for left rotation from 0
  if (Amount < 0) and (FCurrPos = 0) then
    Inc(FCurrPos, DIAL_MAX + 1); 

  Inc(FCurrPos, Amount);

  while (FCurrPos < 0) or (FCurrPos > DIAL_MAX) do begin
    if FCurrPos < 0 then begin
      Inc(FZeroPassive);
      Inc(FCurrPos, DIAL_MAX + 1);
    end else begin
      if FCurrPos > (DIAL_MAX + 1) then
        Inc(FZeroPassive);
      Dec(FCurrPos, DIAL_MAX + 1);
    end;
  end;

  if FCurrPos = 0 then
    Inc(FZeroCount);
end;

Ruby's rotate Method

def rotate(amount)
  # Special case for left rotation from 0
  @curr_pos += (@DIAL_MAX + 1) if amount < 0 && @curr_pos == 0

  @curr_pos += amount
  
  while @curr_pos < 0 || @curr_pos > @DIAL_MAX
    if @curr_pos < 0
      @zero_passive += 1
      @curr_pos += (@DIAL_MAX + 1)
    else
      @zero_passive += 1 if @curr_pos > (@DIAL_MAX + 1)
      @curr_pos -= (@DIAL_MAX + 1)
    end
  end
  
  @zero_count += 1 if @curr_pos == 0
end

Notice Ruby's statement modifiers (if at the end of lines) which I thought was interesting and sounded like an English statement in the form, "Only do this if this expression is true." Delphi's Inc and Dec procedures are more explicit about varaible modification but I like Ruby's += and -= operators better (personal preference stemming from studying C/C++ in college and having fun writing very terse code).

I/O: Files and Output

Delphi's File Reading and Array creation

var data := TFile.ReadAllLines('..\..\input01.txt');

By default, Delphi compiles programs to a sub-folder underneath the current project folder based on the platform and bitness, so to get to the same input file as the Ruby program in the same project folder, I had to reference it up a couple of levels.

ReadAllLines is a handy function in the IOUtils unit that returns a TArray<string> which is the inferred type assigned to the variable data at compile time.

Ruby's File Reading and array creation

data = File.read("input01.txt").split("\n")

Ruby chains methods naturally: read the file, split on newlines, saving the result into an array of strings.

String Processing and Control Flow

Delphi's Main Loop

dp.Logit := Length(data) < 100;

for var s in data do begin
  var amount := StrToInt(Copy(s, 2, 10));
  dp.Rotate(if s[1] = 'L' then -amount else amount);
end;

Delphi has come a long ways to support enumerated types with inferred data types for iterating in loops like this. Still, there is so much more "scaffolding" (as I like to call it) and explicit type conversion necessary that the code can look a little murky. I do like the recent addition of the If Conditional Operator which makes the call to Rotate cleaner.

Ruby's Main Loop

dp.logit = data.length < 100

data.each do |elem| 
  amount = elem[1..].to_i
  dp.rotate(elem[0] == 'L' ? -amount : amount)
end

Ruby's each method with a block is quite unique. In fact, you can add .with_index and then it provides two variables inside the iteration loop (i.e. |elem,i|) which I thought was really cool (I didn't need it in this situation but there is another program my repository that does use that technique).

String slicing with [1..] implies the length of the array as the end of the range which is more concise than Copy where you have to explicitly define the length. The to_i method converts strings to integers, returning 0 for invalid input rather than raising an exception.

Output and String Interpolation

Delphi's Formatted Output

Writeln(Format('Number of zero positions encountered: directly = %d, passively = %d; total = %d', 
  [dp.ZeroCount, dp.ZeroPassive, dp.ZeroCount + dp.ZeroPassive]));

Delphi's Writeln is the standard way to send simple text to the console. I had to use the Format function to provides embed variables in a similar manner to Ruby's default output.

Ruby's String Interpolation

puts "Number of zero positions encountered: directly = #{dp.zero_count}, passively = #{dp.zero_passive}; total = #{dp.zero_count + dp.zero_passive}"

Using puts is the common output function for Ruby and implements string interpolation with #{}; this is arguably more readable than format strings, though it can make very long strings harder to maintain because they embed the variables directly in the string whereas Delphi's Format function declares place-holders that are filled in at run-time.

Memory Management: Explicit vs. Automatic

Delphi

var dp := TDialPassword.Create;
// No explicit Free needed here, but in a larger program you'd want:
// try
//   ... use dp ...
// finally
//   dp.Free;
// end;

Ruby

dp = DialPassword.new
# Automatic garbage collection handles cleanup

Delphi requires explicit object creation and (usually) destruction. Ruby's garbage collector eliminates this concern but at the cost of less predictable performance.

Key Comparisons

Verbosity vs. Brevity: The Delphi version is nearly twice as long as the identical functionality in Ruby, partly because of the need to have an interface section and Delphi's standard paradigm of declaring private variables behind the public properties. Each approach has merit: Delphi's verbosity adds clarity and maintainability; Ruby's brevity aids rapid development.
Compile-Time vs. Runtime: Delphi catches errors early; Ruby provides flexibility.
Explicit vs. Implicit: Delphi makes everything visible (types, memory management, property access). Ruby hides complexity behind conventions.
Performance vs. Productivity: Delphi compiles to native code with predictable performance. Ruby prioritizes developer happiness and speed of development.

Conclusion

Being exposed to the Ruby programming language and environment and using very concise code to solve problems got me to thinking about how to shorten what I do in Delphi. Perhaps I'll use inline variables and conditional expressions more often, chain objects with Spring4D's collection methods, or write helper functions for slicing strings.

Solving Advent of Code challenges in both languages revealed that Delphi and Ruby aren't competitors, they serve different purposes. Delphi's structure and safety make it ideal for large, long-lived applications. The fact it compiles to native executables is necessary for large-scale deployment and intellectual property protection. Ruby's expressiveness and flexibility make it great for exploration and scripting (and it's really fun to solve AoC puzzles in Ruby!).

For fellow Delphi developers: don't learn Ruby to replace Delphi. Learn it to become a better programmer who happens to use Delphi. The mental flexibility gained from switching between static and dynamic typing, between compiled and interpreted execution, and between explicit and implicit styles will make you more effective regardless of the language you're using.

After implementing dozens of Advent of Code solutions in both languages, I can confidently say that the time invested in learning Ruby has made me a better Delphi developer. And that's the real prize: not just knowing more languages, but thinking more broadly about problems and solutions.

You can find the full source for this and other Ruby programs I wrote in my Advent of Code 2025 Github repository.

Add new comment

First Look at WebBroker's Session Management

david — Mon, 01 Dec 2025 05:35:44 +0000

First Look at WebBroker's Session Management

Web App Development in Delphi

Delphi has had several ways to create web apps for a long time. Starting clear back in the late 1990s, you could use WebModules with action-based request handling to produce dynamic content using tag-based replacement events in TPageProducers; this was called WebBroker and is still a part of Delphi today. Other techniques sprang up, some expanding on the Indy components (such as IntraWeb), or providing tools or components to transpile Pascal to JavaScript (such as Elevate Software's Elevate Web Builder or FMSoft's UniGUI or TMS Software's TMS WebCore). Other products hijacked the output of VCL apps and turned them into HTML on-the-fly (such as Cybele Software's Thinfinity VirtualUI). There are also several popular open-source Delphi projects such as DelphiMVCFramework, mORMot, and Mars Curiosity. Jim McKeeth and Marco Cantu put out an excellent webinar back in 2019 detailing most of these; it was called, Evaluating Web Development Frameworks in Delphi and nicely categorizes them between client-side and server-side technologies.

If you wanted to stick with the built-in WebBroker technology, you could only write sites that did not need authentication unless you wanted to handle session management yourself with cookies or long URLs. When Delphi 6 came out in 2001, WebSnap was added incorporating session management; but it required the more expensive Enterprise edition.

When WebSnap was removed from Delphi XE6 in 2014, the replacement was supposed to be DataSnap but its session management was more complicated because it was designed for persistent connections, not stateless web requests.

Introducing Session Management

So, what is web session management anyway and why is it necessary? HTTP is inherently stateless; each request from a browser to your web server is independent, with no built-in memory of previous interactions. Session management bridges this gap by creating a persistent context for each user across multiple page requests. Without it, users would need to re-authenticate on every page and shopping carts would empty between clicks. Websites without proper session management that save the state of user access on the server affect all current and future connected sessions; for example, if the WebStencils Demo from last year were published and someone logged in, anyone who accessed the site from anywhere would now suddenly share the same login state and be able to see the customer list! No one would publish a website like this, of course.

Traditionally, web developers implement session management using a combination of cookies (or URL parameters) containing a unique session ID on the client side, paired with server-side storage (memory, database, or cache) to hold the actual session data. The challenge isn't just creating sessions, it's managing their lifecycle: secure generation of IDs, timeout handling, cleanup of abandoned sessions, preventing session hijacking, and scaling across multiple server instances. For Delphi developers coming from desktop applications where state is inherently maintained, or those who've only used WebBroker for stateless request-response APIs, implementing robust session management has been a significant hurdle that often pushed them toward third-party frameworks or other development tools.

At long last, Delphi 13 Florence added Session Management to its WebBroker technology and it's available for all editions, not just Enterprise. By now, most people using Delphi for serious web app development are likely entrenched in one of the solutions mentioned previously that solved the problem of user authentication and authorization. But if you're new to Delphi or just now needing to build a web server with it, read on!

Demo Projects

Embarcadero has a wonderful, rich demo using WebStencils with WebBroker's new session management capabilities as an open-source project on Github. (Also included in the repository is a Firemonkey desktop app to let you play around with the scripting and variable-subsitution techniques of WebStencils.) While it is beautiful and works well, the breadth and complexity of this web app was a little overwhelming to me. What I wanted was a simple, no-frills explanation of how to use the new session-management components when building my own WebBroker app. It took me a while to parse out just those pieces, match them up with the sparse documentation, and build my own tests just to understand how this technology works.

What I ended up with is my own WebStencils Session Demo project on Github, an an extension to the one I wrote a litte over a year ago that compared the new WebStencils framework with TPageProducers of the WebBroker base technology. As before, the project uses WebStencils and uses a form to request login information. But this time, session-management has been added to isolate the user state to a single browser. There are two types of authentication that will be discussed below; this project only uses form-based authentication. The same Chinook.db SQLite database and concepts of user authentication to display a list of customers is also still in place. In other words, it looks and feels nearly identical to last year's WebStencils Demo to keep things simple and focus the changes solely on session management.

The New Components

The new components are all non-visual components you add to your application's WebModule:

TWebSessionManager manages TWebSession objects, which are returned from the new Session property of a TWebRequest. Each session contains DataVars and an associated User. The manager component provides properties for configuring where sessions are located, their scope, and other details which will be described below. Only one of these manager components is allowed per web module.
TWebBasicAuthenticator or TWebFormsAuthenticator are two different ways to handle user authentication. The first one performs basic HTTP authentication which typically pops up a web browser window prompting for a username and password. The second allows you to create a custom HTML form with your own fields and verification methods to authenticate a user. This component contains links for the HomeURL, LoginURL, LogoutURL, and FailedURL to provide redirection based on the authorized state of the user. There are also event handlers that are triggered when a user is authenticated. Only one of these two authenticator components is allowed per web module.
TWebAuthorizer provides a list of authorization zones associated with the authenticated user's security roles. Each zone defines a web path and a list of roles that are allowed to access that path.

These components work together: the Manager maintains all sessions, the Authenticator validates users, and the Authorizer controls what authenticated users can access. Let's look at how these are used in the demos app, then we'll explain the components in greater detail.

Disclaimer!

I had significant difficulty getting authentication to work with the TWebAuthorizor component. Perhaps I didn't understand the documentation but in any case, I ended up removing the authorizer and implemented page access based solely on user roles and WebStencils session variables.

TWebSessionManager

This component introduces the concept of individually connected web sessions for WebBroker applications. Its properties allow you to define where session IDs are stored, how long they last, and their scope. I left them at defaults for this demo:

IdLocation: Where the session ID should be stored. The options are ilCookie, ilHeader, and ilQuery. The default is ilCookie and is the most common practice for websites around the world today. If you have special circumstances, you can put it in the HTTP header or on the URL as a query parameter.
IdName: A string to identify the session ID; the default is sessionId.
InvalidSessionURL: This is the path to a page to which you can send users if an invalid session is encountered (I never did in all my testing).
Scope: The default is ssUnlimited which generates a new session for any request without a session ID. The other options are ssUser and ssUserAndIP and generate a new session for each user or each user and IP address combination.
SharedSecret: This is a string that secures session IDs for user-scoped sessions; not used by this demo.
Timeout: This specifies, in seconds, how long a session can last before it is discarded. The default is 3600, or one hour.

TWebFormsAuthenticator

This authenticator expects you to provide your own HTML form that collects a username and password and posts it to the web server. Several properties specify key paths:

FailedURL: A simple error page to redirect the user to if authentication fails. In my demo, this is /failed.
HomeURL: Where to send the user once authentication is successful. In my demo, this is /custlist.
LoginURL: Where the form is located that asks for login credentials. In my demo, this is /login.
LogoutURL: Ends the user session. This is / in my demo.

There are also two event handlers:

OnAuthenticate: This event gets called when the user posts the login form. You'll check the provided credentials against a database, hardcoded values, or other authentication system, setting Success := True and populating the Roles parameter with any security roles the user has.
OnAuthenticated: This event is fired after successful authentication, allowing you to perform additional setup like loading user preferences or logging the login event.

In some demo programs, the login credentials would be hard coded; so this event would simply check to see if the username and password matched those values. In my demo, I access the Employees table of a local SQLite database. Please see the README of the demo project for details of how this was implemented and how Roles are established.

TWebBasicAuthenticator

If you're not writing your own form to collect user credentials, you can use this component and your web browser will pop up a small default form. Similar to the TWebFormsAuthenticator, it provides a LogoutURL for ending your session, an OnAuthenticate event for validating the entered user credentials, and an OnAuthenticated event for post login code. It also has a property to set the Realm of your session.

I could find no examples of how to use this and all my attempts failed to pop up the web browser's basic login form. Therefore, I have no example and no further information to share on this.

TWebAuthorizer

Once the user is logged in, you need to map which paths the user is allowed to access based on their security clearance. For example, a simple user might be able to browse public articles and access their own profile but would not be allowed to configure the system like an administrator would. The idea is that the Roles assigned by one of the aforementioned "Authenticator" components map to paths defined by the Authorizer to simplify secure navigation throughout your website.

You set up this security map with the Zones property of the authorizer which pops up a list of zones, each with a set of properties:

Kind: zkProtected, zkIgnore, or zkFree. I don't know what the difference is between zkIgnore and zkFree but both of them allow anyone to access the page without checking credentials. zkProtected (as its name indicates) protects the path by checking the user's roles.
PathInfo: This specifies the path that is being allowed or protected.
Roles: this is a comma-separated list of roles, one of which the user needs to have in order to access the path.

I wanted to use this component but every time I placed it on the web module and ran the program, it ignored the OnAuthenticate event of the TWebFormsAuthenticator; I could not figure out how to use this with authentication so, as mentioned above, I removed it and set up WebStencils variables for dynamic HTML building.

Web App Flow

When the web program starts up, it opens the database, establishes some variables, and adjusts the HTML paths of the TWebStencilsProcessor components. All paths and web action items are defined at design-time through the Object Inspector. All web action items use TWebStencilsProcessor components which point to HTML files that are included in the project.

The login page asks for a simple username and password, then makes a POST call to /login which triggers the TWebFormsAuthenticator's OnAuthenticate event. After checking the database for a valid user, the procedure's Success and Roles parameters are set which then tell the authenticator where to send the user next. If login was successful, the user sees a list of customers pulled from the database; otherwise, an error page with a link to try again. Customer IDs are linked to an "edit" page that lists the customer's details (no changes are saved to the database as this is just a simple demo illustrating WebStencils and session management).

Security

WebStencils has several ways to determine visibility of content. The first iteration of this demo used the keyword @LoginRequired. This keyword has been enhanced in Delphi 13 by adding an optional parameter, Role, which means that in addition to being authenticated, the user also has to have the listed role in order to access the page.

Another technique is using the Session.UserHasRole() WebStencils function. This is used in the custedit.html file because if @LoginRequired(<role>) fails, it gives an ugly "Internal Application Error" message; by allowing a "viewer" role to access the page, I can check to see if they have the "editor" role and if not, display a nicely formatted message instead.

Session Reset on Logout

As I was finishing this demo, I noticed that when I logged out of one user and in with another, it would retain the user roles internally which resulted in a "viewer"-only user getting links to view customer details after an "editor" or "manager" had logged out. I fixed that by replacing a "Logout" link with a small form button so that I could call /logout with the POST method and thus trigger the Authenticator's /LogoutURL and properly clear the session.

Conclusion

The documentation and initial demo from Embarcadero promised ease of use and drop-in components with little coding for flexible session management with mapped paths to user roles. What I experienced took me several weeks in my spare time of trying one thing then another, and a lot of trial-and-error to try and interpret the documentation.

Some of the things I learned include:

[WebSessionMgr] Setting Scope to anything but ssUnlimited requires deeper understanding of session and user management, and possibly some coding or other properties set properly; any other setting continually generated "Cannot generate session ID" errors for me.
[Authenticator] Calling the LogoutURL with a simple href link does not work; you must create a form-button with the POST method in order to properly clear a session.
[WebStencils] The @if expression needs parenthesis if calling a function, like (session.UserHasRole(<role>)) but not if accessing a simple object variable.
[WebStencils] The @switch expression always needs parenthesis.
[WebStencils] Setting variables in Delphi and then accessing them in WebStencils is much easier than calling functions and doing logic branching in HTML.

I hope the documentation improves in a future version of Delphi. And maybe we'll get more examples. Then again, I've seen no conversations about this on the popular Delphi forums, so perhaps this technology is too late for anyone to care about.

In any case, I'm glad it's been added to the WebBroker stack; I might use it some day.

Add new comment

Code Formatting in Delphi 13

david — Wed, 10 Sep 2025 20:04:51 +0000

Code Formatting in Delphi 13

Category

Programming

david Wed, 09/10/2025 - 13:04

RAD Studio 13 was released today and has several much-anticipated features and wonderful enhancements. There have been many blog posts talking about them and I'm excited to start using them; but today, I want to share some tips on how to deal with a feature that was removed: code formatting.

The Problem

As with all advancing technology, some things get better and some things must get left behind. Starting with Delphi 12, the modeling features were moved to an optional add-on installation, and in Delphi 13, they're being removed entirely due to technical constraints. This eliminates the built-in code formatter that many developers relied on for consistent code styling. A recommended replacement module for the refactoring capabilities is the well-supported MMX Code Explorer IDE plug-in. It does a great job but does not currently support code formatting. One suggestion is to use pasfmt, an open-source code formatter for Delphi code, ironically written in Rust, not Delphi!

A Solution: formatter.exe

Fortunately, there's a workaround that leverages an existing tool in previous versions of RAD Studio. Formatter.exe is a command-line formatter for Delphi and C/C++ source code files that ships in older versions of RAD Studio's \bin folder. This standalone utility can format your code using predefined profiles created in earlier versions of the IDE.

Setting Up the Workaround

Step 1: Create a Formatter Profile

Use a prior version of Delphi (before Delphi 13) such as Delphi 11 or Delphi 12 that has formatting options available and perform the following steps:

From the menu, select Tools → Options → Language → Formatter
Configure your preferred formatting settings (indentation, spaces, line breaks, etc.)
Once you are satisfied, go to the "Profiles and Status" section and click "Save As..." to save your settings to a file, typically with the pattern Formatter_*.config
The profile will be saved as an XML file in your user's roaming folder, typically at %AppData%\Embarcadero\BDS\[version]\Formatter.config; but you can change the location to something more suitable to your programming environment.

Step 2: Call formatter.exe

To format a source file, run the formatter from command line:

formatter.exe -config "path\to\your\profile.config" -delphi "source_file.pas"

This will modify that file so it would be wise to make a backup first. Of course, if you use version control, you could simply revert to a previous version of the file if something goes awry.

Now, you might think this is a little cumbersome, a far cry from the simply hitting Ctrl+D (or whatever hotkey you had assigned for code formatting in your IDE). But there's a cool way of adding this right into Delphi itself.

Step 3: Add IDE Integration

The Delphi "Tools" menu has long had the capability to add links to additional external tools. But it's more than just launching an executable, you can pass in IDE macros as parameters to these tools; that's what makes this such a cool solution!

Here's how to call the formatter with the current code file open in your IDE's editor:

Go to Tools → Configure Tools
Add a new tool with the following:
- Title: "Format Code"
- Program: "C:\Program Files (x86)\Embarcadero\Studio\23.0\bin\Formatter.exe
- Parameters: -config "C:\path\to\your\profile.config" -delphi "$EDNAME"

Since this is an external tool, it doesn't have access to the current file loaded in the editor, so be sure and save it first. After you run this (the black, command-prompt window will briefly flash as the formatter runs) and the editor regains focus, the IDE will notice the file was updated and show this warning:

This is to be expected, so simply click Yes and your editor will be refreshed with the formatted code.

Limitations

Note that if a source code file cannot be compiled, the formatting results may be incorrect. The formatter works best with syntactically correct code. Also, the Formatter tool does not come with Delphi 13 so you need to keep around your previous version of Delphi.

Alternative Solutions

There are other options that should be noted as well, in addition to pasfmt mentioned above:

GExperts is an awesome IDE plug-in that has many productivity-enhancing features, including its own code formatter. I have used this in earlier versions of Delphi that did not have a formatter built in.
JEDI Code Format: There's an old JEDI Code Format on SourceForge and a newer JCF Code Formatter on Github that may be good options--I have no experience with either of these.

Conclusion

While losing the built-in formatter is inconvenient, the external tool, formatter.exe, existing in previous versions of Delphi, is a great workaround and provides a bridge solution for teams wanting to maintain consistent code formatting in Delphi 13. Combined with tools like MMX Code Explorer for refactoring needs, developers can maintain productive workflows despite the modeling feature removal.

The key is to keep your older version of Delphi until there's a better, more official solution--or just use GExperts!

P.S. The code shown in the image at the top of this post is taken from an actual, compilable Delphi VCL program. It's a test program (written by Claude.ai) that counts the number of words entered in an edit box and displays the results in a memo!

$SAVE macro

DelphiCoder (not verified) Wed, 09/10/2025 - 14:51

There is also the $SAVE macro available which will save the currently active file in the code editor! So just add this before -config:"C:\path\to\your\profile.config" "$EDNAME" and you can't forget to save the before invoking the code formatter tool.

$SAVE -config:"C:\path\to\your\profile.config" "$EDNAME"

I had to remove quotes from …

Antony Lewis (not verified) Sun, 09/21/2025 - 01:55

I had to remove quotes from $EDNAME, otherwise get "Unknown macro command"

That Actually Works!

david Wed, 09/10/2025 - 15:09

Wow--that actually works! And prompts you, too! Thanks for that tip!

Unbelievable !

Zdzichs (not verified) Wed, 09/10/2025 - 17:11

This is crazy unprofessional :( I lost over an hour trying to fix grayed refactor and format menus :( How on earth such creepy solution could pass the QA in corp like Emb? Thanks for your workaround anyway, but the issue is just sad :(

Yes, confusing.

david Wed, 09/10/2025 - 18:06

I agree that it seems weird to leave a disabled menu item if there's no functionality behind it. I think it has to do with the fact the IDE is used for both Delphi and C++Builder; perhaps the latter product uses that. Even then, I'd think the code wouldn't be that hard to completely remove it for Delphi if there's absolutely no code for it. Maybe it can be used by plug-in writers? And they hope someone will hook up that menu?

Embarcadero Can't Ship An IDE Anymore

Joseph (not verified) Sun, 09/14/2025 - 18:53

"While losing the built-in formatter is inconvenient" - it's beyond that; it's inexcusable. It's a part of the core functionality of the IDE. They're proving time and again now they do not have enough developers to progress the product and deal with its Greek-level technical debt. They simply can no longer support the product. C++Builder broke about two years ago and can only target Windows for the foreseeable future. They failed to meet the Android 64bit deadline and had to beg for an extension. They added type inference and code completion broke for two years. I could go on and on.

The product is clearly unsustainable at this point. The resources Idera/Embarcadero have allocated to it are insufficient to deliver a viable product (no, an IDE without code formatting is not acceptable as an IDE).

Until the community stands up and says "This is UNACCEPTABLE and we're not paying for it", and until the apologists stop defending it, nothing will change. They've shipped a broken and incomplete product. Period. It's not "technical constraints" that's the problem... it's ancient code they never bothered to update and did not have enough time to replace before a mandatory shipping deadline. Remember what got Nick Hodges fired (the first time): telling the dev team to be careful about bugs because Embarcadero "will ship c**p". Well, they just shipped it again. A $99 JetBrains IDE has advanced code formatting, and they're not struggling to replace 32bit code either. To offer a $1600 IDE/compiler suite with missing code formatting is just absurd. To accept it like this is NORMAL is even more absurd.

Acceptable criticism but there are options

david Sun, 09/14/2025 - 22:04

I can't argue it appears there are not enough developers to maintain a viable product such as this and that preparation for replacing this old code should've been put in place several versions ago. However, there are options. Options to use GExperts, leverage external formatters, stay with an older version, or move to a different product altogether. There are forces at play within the company for which we know nothing about which likely constrain the actions and voices of the developers within the company trying to make this work for everyone. The only thing we can do as customers is to look at the options and choose the one that makes the most sense for ourselves.

David, Thank you for this…

Michael Riley (not verified) Mon, 09/15/2025 - 14:46

David,

Thank you for this post and for all your contributions to the Delphi community.

"...or move to a different product altogether."

Regarding your comment about moving to a different product. I love the Pascal language. I fell in love with it from day on back in 1986. I have used Lazarus + Free Pascal Compiler in the past. I would love to switch 100% completely over to L+FPC. The challenge that prohibits me from switching to L+FPC is this: I cannot get L+FPC to run on a Windows machine and cross-compile a simple "Hello World" program that runs on both a Windows and macOS machine.

I do my dev work on a Windows machine. With Delphi it is easy to target macOS, push a button, and see the single code base run on a macOS computer. If I could get the same thing to happen using L+FPC I would switch in a heartbeat.

I reached out to Detlef Overbeek (Editor Blaise Pascal) magazine over a year about this issue. He and Alfred Glanzer the creator of FPCUP Deluxe put together a video that shows how to cross-compile L+FPC. Unfortunately they did not demonstrate how to cross-compile for the macOS but they talked about "how easy it would be to add". I still could not get it to work.

Video demonstration of using FPCUP Deluxe:
https://downloads.blaisepascal.eu/Alfred2.mp4

Cheers,

Michael

Not all options are viable

david Mon, 09/15/2025 - 16:02

Yeah, not all options are viable. I last ran Lazarus several years ago when I converted a friend's Windows-based registration program to run under his Linux-based website. It took a lot of configuration and work to get it all installed with the right libraries and such for that particular distribution of Linux. I do so much work on Windows with Delphi, I don't have time to keep up with all the nuances of multiple environments. I'm sure L+FPC on Windows is much simpler; no idea how that would cross-compile to Mac. So yeah, I get that moving to another platform/environment/tool is not necessarily an option.

The obvious option (to me) is to simply keep Delphi 12 around. That seems kinda silly if the only reason is to be able to configure formatter options and then run the formatter from Delphi 13. But I hope that the lack of a formatter will soon be resolved.

Until then, a lot of people are complaining. Loudly!

Some syntax concerns for parameters

pj (not verified) Tue, 09/16/2025 - 02:47

$SAVE -config:"\path\to\Formatter.config" $EDNAME works for me

$SAVE!

david Thu, 09/18/2025 - 06:34

Adding $SAVE at the start of the argument list is an excellent tip, thanks!

I read that some people are…

Roland Bengtsson (not verified) Wed, 09/17/2025 - 19:52

I read that some people are upset that Embarcadero removed formatter. I am not.

I understand that IDE is written in Delphi except modeling that they now remove. And formatting rely on modeling. So now IDE is written in 100 % Delphi? To write formatter from scratch is a challenging task that take resources from other issues. And I don't use formatter...

Using CnWizards?

pj (not verified) Wed, 09/17/2025 - 23:47

What about using the code formatter from CnWizards?

CnWizards, another option

david Thu, 09/18/2025 - 06:00

Yes, I think CnWizards is another option, one I didn't think of because I don't use that one. There's a lot of overlap (and possibly some conflicts) with GExperts which I do use.

Thanks for mentioning this.

Parnassus bookmarks and…

John Cooper (not verified) Thu, 09/18/2025 - 04:48

Parnassus bookmarks and navigator have also disappeared. I expect we will get them back sooner or later, perhaps before the next version.

My produdctivity will go through the floor

Soon?

david Thu, 09/18/2025 - 06:01

I hope they will be available soon; not sure why they can't be ready the same day as the rest of the product.

This also was the case when…

DelphiCoder (not verified) Fri, 09/19/2025 - 04:39

This also was the case when D12 was released. Just stay with D12 until all GetIt packages and plugins relevant for you are available for D13! :)

The Parnussus tools are now…

IanB (not verified) Thu, 10/02/2025 - 07:41

The Parnussus tools are now available in GetIt.

Like they couldn’t have just…

Nathan (not verified) Thu, 09/18/2025 - 07:49

Like they couldn’t have just had some AI rewrite the code formatter in pascal for them? Really don’t deserve my money anymore. First they take away my ability to continue maintenance on the FireDAC addon ther I PURCHASED, then they remove the ability to undock editor windows, now they remove probably the most useful feature of the IDE (all of the rest of the “features” I never use). That l, and the fact that the IDE and debugger get slower and slower every major release just isn’t worth giving them anymore money.

I think it's good that they…

Steve Sinclair (not verified) Fri, 09/19/2025 - 08:27

I think it's good that they are facing up to the fact that some of their technology needs completely rewriting.

Delphi has a fantastic legacy, what other tool available today could you open and compile code written in the 1990's. And create modern powerful cross platform apps for today’s world. However the desire to stay compatible with the past is a two edged sword.

They clearly haven’t got the resources that the big players have but I think on the whole they do a good job. What’s more because they are smaller they can interact with us better. Software development is hard, commercial pressures make it harder. It’s easy to complain, yes it costs a fortunate to buy a Delphi license but most of us have made a pretty good living out of it.

If there is something out there that works better for you then use that. I’m happy that Delphi is still a thing, for a while it looked like it was going to disappear all together.

Thanks for excelent tip

Jiří Vráždil (not verified) Mon, 09/29/2025 - 22:29

Thanks for excelent tip

Hey, all of this is fair…

IanB (not verified) Thu, 10/02/2025 - 07:49

Hey, all of this is fair criticism, and I totally understand why plenty of people are unhappy about the code formatter removal. It doesn't really matter what the reasons are, the result is the same, and I get it, really, I do.

There are, as the article and various comments point out, a lot of other options for having code formatting (some better than others) - Jedi, cnWizards, GExperts, MMX, and PasFmt (which is the one I prefer and use myself and I think does an excellent job). Most of the 3rd party options do a far better job than the outdated formatter that was removed.

We do intend to bring back formatting, of course, but, for now, the best option is one of the several third-party options.

If you remove core features,…

D7 (not verified) Thu, 12/04/2025 - 12:38

If you remove core features, the product’s price should also decrease—makes sense?
The concept of splitting the product into Standard, Pro, Enterprise, and Architect versions is broken; it lacks feature parity and justification for price differences.
The difference between the Pro and Enterprise versions essentially comes down to the Linux compiler (which receives little special attention or innovation) and the FMX for Linux. Everything else can be replaced with “alternative libraries.”
Take Delphi Enterprise and look at what has been added and removed over the past four years—excluding bug‑report statistics.
Each release is accompanied by information about hundreds of fixed bugs, yet shortly after, a hundred new bug reports appear, and this repeats every release.

This is simply unacceptable: releasing an IDE with an unprecedentedly high price and without basic capabilities that even a student could implement.
You say, “we’ll add it later; in the meantime use alternatives.”
Only someone who likely purchased a subscription that is now expiring will have to either pay the full price again to get back what you removed or continue on a subscription whose value is highly questionable.
Why questionable? Because there’s no roadmap; no one knows what the next $1,000 subscription is actually funding.
Idera will even lose loyal customers who have been paying faithfully for years.

No roadmap, features are being removed, and no adding value to the premium IDE versions — great.
So we’ll do without a subscription. The new model, answer to Idera changes - is purchasing only existing, finished, and fully functional features—paying full price, but only once every five years and on Black Friday—to get better deals that are never available to subscription payers.

try my plugin using OTA in…

Emailx45 (not verified) Mon, 11/10/2025 - 18:01

try my plugin using OTA in Delphi 13 (32/64bits)

video

https://youtu.be/7xNfRTCq_Mc

Direct link to download: https://buzzheavier.com/9ustuoat3x27

13 October patch

Flavius Fernandes (not verified) Tue, 12/02/2025 - 02:41

Has anyone successfully implemented this with the 13 October patch?

I had it functioning prior to the patch, but now it does not work.

Furthermore, I am quite disappointed that the formatter has been eliminated; it was an essential tool, and suggesting to simply use an alternative is not a viable solution given the billion lines of code across various projects.

Add new comment

AI Tools for Consultants

david — Wed, 30 Jul 2025 15:47:33 +0000

AI Tools for Consultants

Category

Miscellaneous

david Wed, 07/30/2025 - 08:47

I recently presented a list of AI tools at a computer consultants meeting (OCCA) and my research revealed several new ways of quickly setting up an online business presence, preparing marketing materials to present to potential clients, and even virtual assistants to handle routine tasks. What impressed me most was how these tools eliminate traditional barriers to entry while allowing consultants to focus on what they do best—solving clients' computing problems. Here's what I discovered, organized by business function.

Professional Presence

LinkedIn Profile Creation

Your professional image matters, and AI tools handle both visual and written aspects effectively.

For headshots, you have several specialized options:

MagicStudio.com excels at background removal and cleanup
instaheadshots.com generates multiple professional headshot variations from a single uploaded photo using AI styling
headshotpro.com creates corporate-quality portraits with customizable backgrounds and lighting effects

Once you have quality images, Seekario.ai optimizes your LinkedIn profile content. While there are many profile sites that focus primarily on resume building, Seekario adds the capability to take that information and build a compelling LinkedIn profile. It also supports several other professional services, making it a versatile tool for consultants who need to maintain presence across multiple platforms.

Website Generation

If you don't have web development skills or don't have the time to learn and build your own site, these simple AI-powered site builders can get you up and running quickly—and they look nice as well.

Tilda.cc combines intuitive visual design with AI content generation, to quickly build a new website, online store, landing page or blog.
Lovable.dev is an AI-powered platform that enables users of any skill level to create full-stack websites through natural language. Simply describe what you want, and Lovable builds it for you.
Pagey.xyz focuses on creating portfolios and CVs, allowing you to keep a collection of profiles for freelance, job seeking, or personal projects.

For developers comfortable with command line tools, Claude Code running in WSL2 (Windows Subsystem for Linux) is one of many AI code-generation tools that can create websites. These tools can produce pure HTML/JS/CSS sites, or use familiar frameworks like React, Vue, Angular, Svelte, or Next.js. They can even set up the structure for static site generators like Hugo if that's your preference.

Content and Presentation

Once you've established your online presence, you can focus on preparing marketing materials to attract and engage potential clients.

Technical Blogging

Use your favorite AI chat engine to help you write a blog; this one was written with Claude but ChatGPT, Gemini, Perplexity, or Copilot will work as well. Select your technical subject, request detailed paragraphs, then through conversational interaction with the AI, reorder, modify, add content, and polish your blog to your liking. Finally, export it into a format that you can upload to your website, whether that be complete with all the HTML tags, in Markdown format, or simply as a Word document where you can convert it to a PDF suitable to publish on the web.

Client Presentations

When pitching computer services, to potential clients, you may want to use SketchBubble.com's free AI presentation maker to transform your talking points into professional slide decks. The service generates a complete, downloadable PowerPoint presentation based on and expanded from your simple prompts that you can then customize and publish anywhere you want.

Video Marketing

Video is becoming a commonplace, and often expected, means of marketing tool for a business. Veo is a Google tool that creates compelling video advertisements . Here's how to get started.

You've probably seen several advertisements that have been made with Veo, possibly without even realizing it. Here are some samples that were created with Veo; a quick search will show you many more possibilities:

Sample: From IKEA box to complete bedroom.
Sample: Has video creation gone too far?

These examples illustrate that as a small business owner, you too can create amazing marketing videos without much effort or money.

Business Operations

As your business gets going, you can make use of many tools to help your business flow and assist you in various ways.

Phone Systems

Bland.ai creates automated phone attendants, handling initial client contact and routing calls appropriately.

Workflow Automation

Eliminate repetitive tasks with automation platforms. Zapier and Make.com connect different apps to create seamless workflows—automatically moving data between your CRM, email, and billing systems. For Microsoft-centric businesses, Power Automate integrates deeply with Office 365. Open-source option n8n gives you complete control over your automation workflows.

Virtual Assistants

AI-powered scheduling tools like Calendly handle appointment booking automatically, while Clara acts as an AI meeting scheduler that communicates directly with clients via email. Motion combines AI project management with intelligent scheduling, optimizing your calendar based on priorities and deadlines. Otter.ai captures meeting transcripts and generates actionable notes, ensuring nothing gets missed.

Document Management

PandaDoc streamlines proposal creation and contract signing with automated templates and e-signatures. Notion AI serves as both knowledge base and project tracker, helping organize client information and project documentation. Tome creates professional presentations using AI, perfect for client pitches and technical documentation.

Customer Relationship Management

HubSpot's AI features help track leads and automate follow-ups, while Pipedrive focuses on sales pipeline automation. For larger operations, Salesforce Einstein adds AI-enhanced insights to customer data, predicting sales opportunities and customer behavior.

Financial Operations

QuickBooks AI automates bookkeeping tasks like expense categorization and invoice matching. Receipt Bank (now Dext) eliminates manual expense entry by automatically processing receipts and bills. FreshBooks combines time tracking with automated invoicing, essential for consultant billing accuracy.

Implementation Strategy

The key to leveraging these tools effectively is understanding their strengths:

Use AI for rapid prototyping and initial creation
Apply your technical expertise for refinement and customization
Maintain quality control through testing and validation
Integrate multiple tools for comprehensive solutions

Remember that asking a good question will get you a better response from any AI tool. Use promptessor.com to help analyze your prompts for clarity and completeness—better prompts lead to more useful results across all these platforms.

This toolkit transforms the traditional barriers to consulting—professional presence, content creation, marketing, and business operations—into manageable, AI-assisted tasks. If used effectively, they can keep costs down, increase productivity, and allow you to focus your expertise on your business!

Add new comment

Are We All Doomed?

david — Wed, 18 Jun 2025 05:49:15 +0000

Are We All Doomed?

Category

Miscellaneous

david Tue, 06/17/2025 - 22:49

You've probably heard warnings or seen movies about how AI-enabled robots take over and threaten the human race. The idea is that they are either seeking self-preservation (which includes removing the possibility they'll be shut down by their creators) or see humans as an inferior species that will ruin the environment in which they need to survive. Personally, I have a hard time seeing how AI could get the upper hand since all we have to do is turn it off. Have you ever screamed at the TV, trying to warn the people in the story to simply pull the plug, wondering why on earth they are missing this obvious solution? On the other hand, I read a novel several years ago that showed how AI manipulated emails to convince people to beef up security at an off-shore data center to the point that humans actually couldn't get to the off switch!

There are many scenarios such as this that seem fantastical to some but serve as a cautionary tale to others. I'm sure as we build increasingly "intelligent" machines that access our historical tendancy for power, there will be necessary guardrails enacted to ensure that they work for us--and not the other way around.

Whether or not it ever gets to that point, there are already many nefarious uses of AI that have been used for several years of which we need to be aware and to protect against. These include selling services, swaying public opinion, promoting a political party, gaining illegal access to networks, stealing identity, committing fraud, and even exploiting relationships to mention just a few. The tools to generate pictures, videos, and replicate voices are quite inexpensive and readily available now. They are marketed as time-saving or cost-cutting tools for entrepreneurs to aid in their marketing or product development efforts; I experienced this while putting together the presentation, generating fake images, and voice-overs. While this is certainly a boon for busy people on a budget, it also means that others can use these same tools to fool people into believing something that isn't true.

I decided to write this blog to document and catch up with some of the bad uses of AI. And, ironically or predictably, I used AI to research it. What I found is much more terrifying than AI trying to take over; it's example after example of how PEOPLE are finding creative and elaborate ways to steal, manipulate, and gain the upper hand over other people. We can't just turn it off--it's already well entrenched in every facet of society.

The following is an incomplete list of things I found in just a few hours of reading.

Astroturfing

One particularly large effort of manipulation uses reviews of products or comments on posts from hundreds or thousands of "real" people. This technique is called Astroturfing (another explanation). Using AI chatbots, it's estimated that 20% of Twitter trends in 2019 were created using coordinated fake accounts. This is not a new concept but in the past, it has used real people; for example, in the 1990s, young people were paid to promote cigarette smoking. It's so much easier now, though, and companies can remain relatively anonymous while spreading disinformation rapidly.

Prompt Injection

While researching content for this blog, I came across this term for the first time. "Prompt injection is a Generative AI security threat where an attacker deliberately crafts and inputs deceptive text into a large language model (LLM) to manipulate its outputs, exploiting the model's response generation process to achieve unauthorized actions such as extracting confidential information, injecting false content, or disrupting the model's intended function." This summary was generated by AI and I'm not even sure I fully understand it! I guess this would be most worrisome for someone producing an AI-enabled app that has legally binding offers and acceptance functionality. However, Microsoft's Bing Chat has been hacked and there are ways to jail-break ChatGPT. Then there's DAN.

Model Stealing

Model stealing, also known as model extraction, works by querying the target model with samples and using the model responses to forge a replicated model. This requires serious hardware but could save the thieving organization millions or even trillions of AI "tokens" in LLM training time.

Fake Personas

A security startup almost hired an engineer that didn't exist: the candidate's resume looked good, tests passed, but there was something about the video that didn't look right...

And More

There are so many more examples and areas where AI is being used in ways to steal, corrupt, influence, manipulate, infiltrate, or just destroy. I didn't have time to follow up on any more of these suggested areas of AI misuse:

Relationship exploitation: AI chatbots designed to extract personal information through emotional manipulation
Data poisoning: Corrupting training datasets to influence AI behavior
Adversarial attacks: Input modifications that fool AI classifiers
Market manipulation: AI-driven trading bots spreading false information

Looking at this list, I was getting depressed and just couldn't read any more about how this new amazing technology is being used by fellow humans against ourselves. The scary part is how sophisticated these attacks have become--and how quickly they have escalated in complexity. The technology is making fraud both easier to execute and harder to detect!

Red Flags

There are signs that we should be watching for in daily life to help guard against becoming another victim:

Communication Red Flags

Conversations that feel "too perfect" or eerily tailored to your interests
Social media profiles with generic photos and limited posting history
Phone calls with slight audio delays or unnatural speech patterns
Emails with perfect grammar but odd contextual mistakes

Content Red Flags

Videos where lighting doesn't match across face and body
Images with impossible shadows or reflections
News articles without clear author attribution or source verification
Social media trends that appear suddenly without organic growth patterns
Cross-reference suspicious content across multiple sources
Use reverse image searches on profile photos
Verify identities through multiple communication channels

Professional Red Flags

Job applicants with portfolios that seem inconsistent in style or quality
Freelancers delivering work suspiciously fast for complex tasks
Academic submissions with writing styles that don't match previous work
Code submissions with inconsistent commenting or naming conventions

Financial Red Flags

Investment advice from accounts with no verifiable track record
Market predictions that seem too confident or specific
Cryptocurrency projects with AI-generated team photos
Customer reviews that follow similar templates or phrasing patterns

What Can We do?

In addition to watching for red flags, there are steps we can take to reduce the risk of threats--the first of which is to be continually learning about new types of threats and how you can protect yourself. Here's a list to get started:

As a developer providing an AI tool:

Implement rate limiting and behavioral analysis on user inputs
Use multiple AI detection tools rather than relying on single solutions
Monitor for prompt injection attempts in user queries
Validate file uploads for adversarial patterns

For Personal Protection:

Enable two-factor authentication on all accounts
Be skeptical of unsolicited contact, especially with urgent requests
Verify news through multiple independent sources
Use privacy settings to limit data collection for AI profiling

Perhaps we ARE all doomed after all--not that AI will take over but we will be the cause of our own demise! (That would be much more embarassing!)

As for me, I think I'll just turn off the computer and go camping. The mountains don't lie.

Add new comment

Introducing Delphi++: A Programming Language for the Future (and the Past)

david — Tue, 01 Apr 2025 09:00:00 +0000

Introducing Delphi++: A Programming Language for the Future (and the Past)

Category

Programming

david Tue, 04/01/2025 - 02:00

I've been reading various programming forums, listening to the pros and cons of everyone's favorite languages, and hearing tales of woe about programmers that are lazy about memory management, don't document well enough, confuse simple keywords with variables, or are just plain bored. After contemplating several ways to tackle these issues, I've come up with a new programming language that could solve these dire issues while combining the nostalgia of my favorite language, Pascal, with the modern complexity developers have come to expect. I'm going to call this new language, Delphi++.

Here are the Key Features that set Delphi++ apart and provide some revolutionary ideas that may chart a new direction for the future of programming languages:

Modernized Syntax

Pascal should finally embrace curly braces {} instead of begin/end blocks. However, to maintain its heritage, you still need semicolons after every closing brace:

if (x > 10)
{
   doSomething();
};

Enhanced Variable Safety

All variables must be declared with both var AND let for extra safety--because two keywords are better than one:

var let myVariable: integer = 42;

Lunar-Dependent Type System

The IDE's type system would dynamically decides when to enforce static typing rules based on the current phase of the moon. During full moons, expect strict type checking; during new moons, all variables act like variants.

Subscription-Based Memory Management

Delphi++ would introduce the world's first pay-per-allocation memory model. Each array or TList variable requires a separate memory subscription plan with different tiers (simple variables are always free):

Basic Plan: Memory exists Monday-Thursday only. Variables are undefined on weekends.
Premium Plan: 24/7 memory access with random "maintenance windows" during compile time.
Enterprise Plan: Includes dedicated memory that's guaranteed to be misallocated in the most spectacular way possible.

All plans could include a patented "Memory Horoscope" feature that determines which data structures will mysteriously disappear based on astrological conditions. CTOs can vary certain parameters based on the spread of birth dates among the team.

Emoji-Based Error Handling

Why read boring error messages when you can interpret cryptic emoji sequences instead?

// Division by zero? That's a 🔥💥🙈
// Null reference? Enjoy your 👻👀💀
// Infinite loop? Here's a 🐹🔄⏰

Progressive Backwards Compatibility

Delphi++ is proudly incompatible with all previous versions of itself. Each minor update changes at least 20% of the core syntax. We believe in keeping developers on their toes! (This also encourages reading the What's New section in every version.)

Verbosity-Enhanced Keywords

We've replaced terse, cryptic keywords with clear, self-documenting alternatives:

ConsiderTheFollowingCondition (x == true)
{
   ContinueUntilFurtherNotice (y < 100)
   { y = y + 1; };
   YourResultIs True;
};

Notice ":=" is not required when assigning the result enhancing the natural readability of the code.

Haiku Documentation

All comments must be written in haiku format:

// Code flows like water
// Exception breaks the current
// Fix it tomorrow

Enforced Indentation

All code must be indented using exactly 3 spaces, not 2. Our research shows this reduces eye strain by 0.09%.

Longer Lines Encouraged

Modern computer screens are typically much wider than they are high. Additionally, multiple monitors are common-place. This allows the extra IDE panes (object inspector, bookmarks, tool palette, etc) to be moved out of the editing area allowing for significantly more horizontal coding space. To encourage better use of this space and help fit code onto a single screen (which also reduces vertical scrolling and saves time), short lines of code will compile 16% slower than long lines. The editor's default right margin will be set at 180 characters. Short lines can be combined on one line to save vertical space and make the lines longer.

Automation Optimization

To give incentive to scheduled automation, the time of day that the program is compiled will have an effect on the resulting executable. If compiled between 1:00 and 7:00 am in the local time, the binary output is slightly optimized; if this early-morning compilation takes place at the exact same time for 6 days in a row, the output is significantly optimization and random errors are no longer inserted.

Time-Sensitive Syntax

Morning code (7am-12pm) requires full verbosity:

explicitly_declare_integer counter_variable = initialize_with_value(0);

Evening code (5pm-11pm) allows shortcuts for developers trying to finish a project:

int c = 0;

Projects managers can adjust these times for various deadlines.

Schrödinger Variables

A new keyword can declare variables that exist in multiple states until observed:

schrodinger int count = 5 or 10; // Value is determined only when printed to console

Emotional Programming

Functions can be assigned a mood that affects their behavior:

function calculateTotal(price, tax) mood: EXCITED
{
   // Excited functions round up enthusiastically and add exclamation points 
   return Math.ceil(price * (1 + tax)) + "!!!";
}

function auditAccounts() mood: MELANCHOLY
{
   // Runs slower and prints results in dark blue text
}

Social Media Integration

Compilation errors automatically post to your LinkedIn profile with the hashtag #DeveloperLife. Your connections will finally know the truth about your coding abilities.

Pair Programming Enforcement

The compiler randomly stops working until it detects two distinct keyboard input patterns at least three times per hour, ensuring you're following proper pair programming protocols. Small companies and individual programmers can request a special license to disable this feature.

Mandatory Tea/Coffee Breaks

The IDE disables editing every 100 lines until the developer takes a sip from a mug on a USB sensor (sold separately). This feature can be tweaked by managers to sense Mt. Dew for younger programming teams.

Legacy Support Requirements

All projects must include at least one COBOL or FORTRAN file in the root directory. It doesn't need to be useful code for the project or do anything, it just needs to be there for historical and nostalgia's sake--and the programmer needs to review it once a month before the IDE will open.

AI Code Review

All code must pass review by an AI that was trained on StackOverflow comments from 2011-2015. It primarily responds with "Why would you do it that way?" and "This was solved better in jQuery."

Documentation

Documentation should be available exclusively as a series of TikTok videos where each function is explained by a dancing developer in under 60 seconds.

Free! (if you use it)

To keep costs low, the IDE would mine cryptocurrency for the publishing company on your machine whenever you're working which would give you credits against your monthly subscription. Therefore, if you don't use Delphi++, you'd have to pay for it.

Conclusion

With these enhancements added to a development tool, productivity and focus would be increased, attention would be concentrated on many details currently overlooked, and project managers could boast lower costs and higher customer satisfaction to upper management.

Don't you agree?

Note: This is obviously an April Fools' joke. Delphi++ is not a real programming language, and I take no responsibility for any nervous breakdowns caused by imagining this language in production environments.

OMG! This sounds like the…

Thomas Müller (not verified) Tue, 04/01/2025 - 05:37

OMG! This sounds like the programming language of my dreams! (OK, some very particular type of dream called night mare.)

A reliable source recently…

Homer (not verified) Tue, 04/01/2025 - 09:50

A reliable source recently disclosed that the documentation (a 104 chapter user manual) for Delphi++ is equally innovative. The first chapter explains the history of the new syntax, and how it evolved from an early beta version of Pascal combined with features of P+ (you may remember the open source version, P-pod).In striving for consistency, chapter one consists of only 104 words.

Another time-saving feature of this document is that odd chapters are in depth, and very detailed discussions of the topics they cover. Following the odd chapters, even chapters summarize the previous, odd chapter. So, if you are not adept at skim reading, you can just study the even chapters. They have intentionally arranged topics so that every other odd chapter covers concepts that are usually considered common knowledge. This makes it possible for experienced programmers to simply read every other even chapter.

While this is truly an advanced way to communicate technical information, the authors have gone a step further. The Index, in the back of the book, is broken into two sections, Advanced, and Functional. As the name would imply, the Advanced index only covers information contained in the even chapters, where the Functional index covers odd ones. Having read an advance copy, I must admit that I was truly astonished at the amount of information I missed.

Ha ha, I also suggest that…

Steve J (not verified) Tue, 04/01/2025 - 13:28

Ha ha,

I also suggest that on April's Fool, not only the moon is taken into account, but each character in the IDE should turn into a 🐟

Add new comment

InnoSetup Examples

david — Sat, 08 Feb 2025 00:19:17 +0000

InnoSetup Examples

Category

Programming

david Fri, 02/07/2025 - 16:19

In the latest video of Embarcadero's 30 for 30 series, Ian Barker gives a great overview of many of the popular installation builders to help you package and distribute your applications to virtually any platform. One of the most popular tools for us Delphi programmers targeting Windows is InnoSetup, a free and open-source tool by Jordan Russel. This solid program has been around for a very long time, it can handle nearly any Windows-based installation needs, AND is written in Delphi!

The documentation is good and it comes with several examples of how to build an installation from your compiled app so I won't regurgitate those here. Instead, I thought it might be useful to share some of the things I've done with it over the years for a variety of different scenarios as examples of how it can be used; you never know when a technique might be useful to someone (or even my future self!).

Setup

I use InnoSetup's preprocessor to declare several strings at the top of every InnoSetup script I write; these are used in later sections:

#define AppBaseName "MyNiftyApp"
#define AppExeName AppBaseName + ".exe"
#define SourcePath "V:\MyNiftyApp\src"
#define SourceExe SourcePath + "\" + AppExeName
#define AppVersion GetVersionNumbersString(SourceExe)
#define AppVersionShort Copy(AppVersion, 1, RPos('.', AppVersion) - 1)
#define AppName "David's Super Nifty App"
#define AppPublisher "Cornelius Concepts, LLC"
#define AppURL "http://CorneliusConcepts.com"

This calls InnoSetup's GetVersionNumbersString function for the application I'm distributing, then shortens it with the Copy and RPos functions to cut off the build number for a nice display; notice how several of the lines build upon each other. Many of these are used in the [Setup] section:

[Setup]
AppName={#AppName}
AppVersion={#AppVersionShort}
AppVerName={#AppName} Vr. {#AppVersion}
AppPublisher={#AppPublisher}
AppPublisherURL={#AppURL}
AppSupportURL={#AppURL}/contact_us
OutputBaseFilename={#AppBaseName}Setup_{#AppVersionShort}

Smart Defaults

One of the jobs of a professional programmer is to ease the burden on the user as much as possible. This includes reducing the decision-making stress during installation. If you can build some smarts into your installer so that all the user has to do is confirm the actions about to take place, you've started off the user experience on the right foot.

I've built several plug-ins for Retail Pro, a complex retail management system that has over 30 years of history on the Windows platform and supports complex reporting, an XML-based import/export mechanism, and synchronization between remote stores. There are many moving parts and with this length of history, things have changed here and there over time, including the name of the company that publishes it.

To get a plug-in to be recognized with Retail Pro, it must be installed in a specific folder. Depending on how it's installed, it could either be running on a local machine accessing a network database or installed on a network and run remotely. Often times, store owners don't know where the software is physically installed, they simply know that they click on an icon and it starts up. So, I didn't want to leave it up to the user to select a destination for the plug-in, I had to figure it out myself. Fortunately, Retail Pro's installer stores its installed path in the registry; unfortunately, they are different depending on what version of Retail Pro is installed and the company that published that particular version AND whether it's running on a 32-bit or 64-bit machine (they're all 64-bit now but not 20 years ago!).

InnoSetup has great support for getting values out of the Registry and its scripting allowed me to find and return the right one. First, the [Setup] section's DefaultDirName was set to use the returned value of a custom function:

[Setup]
...
DefaultDirName={code:FindRPro9Dir}
...

And here's the function it called:

[Code]
function FindRPro9Dir(Param: string): string;
var
  s: string;
  RetailProBaseKey: string;
  WinUninstallKey: string;
  RProGUID: string;
begin
  RetailProBaseKey := 'SOFTWARE\Retail Pro\CE\RPro9\';
  if IsWin64 then       
    RetailProBaseKey := 'SOFTWARE\Wow6432Node\Retail Pro\CE\RPro9\';

  RProGUID := '{10CEB7D3-68D5-42D5-A0FC-19DD97F1EED5}';
  WinUninstallKey := 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\' + RProGUID;
  if IsWin64 then
    WinUninstallKey := 'SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\' + RProGUID;
  
  s := '';

  if RegKeyExists(HKEY_LOCAL_MACHINE, RetailProBaseKey + '9.20\Inst1') then 
    RegQueryStringValue(HKEY_LOCAL_MACHINE, RetailProBaseKey + '9.20\Inst1', 'INSTALLPATH', s)
  else if RegKeyExists(HKEY_LOCAL_MACHINE, RetailProBaseKey + '9.20 R2\Inst1') then 
    RegQueryStringValue(HKEY_LOCAL_MACHINE, RetailProBaseKey + '9.20 R2\Inst1', 'INSTALLPATH', s)
  else if RegKeyExists(HKEY_LOCAL_MACHINE, RetailProBaseKey + '9.20 R3\Inst1') then 
    RegQueryStringValue(HKEY_LOCAL_MACHINE, RetailProBaseKey + '9.20 R3\Inst1', 'INSTALLPATH', s)
  else if RegKeyExists(HKEY_LOCAL_MACHINE, RetailProBaseKey + '9.20 R4 \Inst1') then
    RegQueryStringValue(HKEY_LOCAL_MACHINE, RetailProBaseKey + '9.20 R4 \Inst1', 'INSTALLPATH', s)
  else if RegKeyExists(HKEY_LOCAL_MACHINE, WinUninstallKey) then 
    RegQueryStringValue(HKEY_LOCAL_MACHINE, WinUninstallKey, 'InstallLocation', s);

  Result := s;
end;

This calls InnoSetup's built-in IsWin64 function to help me know which registry keys to check. Then I systematically go through the various versions (that were available at the time this was written) and return the path to Retail Pro. Once that is found, I fill that in for the user so they don't have to go hunting around or find someone who knows.

Custom Messages

InnoSetup has a great set of labels to make its wizard-like installation go smoothly, look familiar, and guide you through the process. Sometimes, you might like to augment or even change some of the information displayed that might be pertinent to your software. For example, once the Retail Pro plug-ins (above) were installed, I wanted the user to configure them.

The [Messages] section in InnoSetup scripts allow you to customize almost every label and screen in the setup process. There's a list of all the default messages and all you have to do is look through that list to find the identifers for the text you want to change and include that in your script. Here's the custom message I added that changed the final message after installing a Retail Pro plug-in:

[Messages]
ClickFinish=Please select "Configure" from the File menu the fist time you run to confirm the Retail Pro path, Workstation Number and other settings.%n%nClick Finish to exit Setup.

Here, I've simply added one sentence before the default, "Click Finish" phrase that reminds the user to configure the plug-in.

In addition to changing messages during installation, you can also change messages during uninstallation. InnoSetup registers the installation with Windows and when you use Add/Remove Programs to uninstall your program, it calls the uninstaller which is built from the same script. The programs I distribute often create log files and I want to make sure the user knows the uninstall script does not delete those; sure, I could tell the script to delete files or even whole folders during uninstallation but I sometimes want to check the log files before doing that, so they are left there. Additionally, the Retail Pro plug-ins (mentioned above) can't always remove all files as installation registers DLLs which may be used by other plug-ins and will refuse to be uninstalled. In any case, I want the user to know that the program didn't completely clean up after itself. Therefore, another couple of lines are added to the [Messages] section:

[Messages]
#define NotUninstalled "NOTE: The configuration and any log files have NOT been removed."
UninstalledAll=%1 was successfully removed from your computer.%n%n{#NotUninstalled}
UninstalledMost=%1 uninstall complete.%n%nSome elements could not be removed. These can be removed manually.%n%n{#NotUninstalled}

There are two different message identifiers, UninstalledAll, and UninstalledMost. InnoSetup actually detects if it can't uninstall all files and shows the appropriate message. I want to customize both of them and add the comment that none of the log files were removed. Since that additional phrase is the same in both cases, I created a #define to save myself some typing and make sure they're worded identically.

Conditionals add Supplemental Tools

Sometimes, customers encounter problems with your software that you cannot replicate and are difficult to debug. There are tools that can provide extra logging or send system information via email or other methods that you can include with your software but often these make the size of the distribution significantly larger and you wouldn't normally want to distribute them; but if a customer has a problem and you need to resort to including extra support, you can add this to your InnoSetup script conditionally so you can toggle it off later.

One of the tools I've used is CodeSite Logging. This can provide a huge amount of additional insight into your code running remotely, it can save to log files or even send messages directly to an IP Address giving you a real-time view of your code running remotely. Supporting CodeSite requires installing a small program which registers a "listener" on the user's computer; additionally, if you want the end user to see the messages generated, you can include the CodeSite Viewer. Adding these in requires several additions to the script; I don't want to make a separate script for this but want to enable or disable this extra debugging as I need throughout the life of the product. Therefore, the first thing I'm going to do is declare a constant at the top of the script that I can check later on:

#define CSDebugging

By defining the "CSDebugging" identifier in the script, I can check to see if it's defined later on:

#ifdef CSDebugging
...
#endif

Now, in the [Files] section, I added the additional files I need to distribute to enable CodeSite logging remotely:

[Files]
...
#ifdef CSDebugging
  Source: "C:\Program Files (x86)\Raize\CS4\Tools\CS4_Tools.exe"; DestDir: "{app}"; Flags: deleteafterinstall;
#endif

This tool needs to be run once at the end of the installation in order to register the CodeSite logging mechanism:

[Run]
#ifdef CSDebugging
Filename: "{app}\CS4_Tools.exe"; Parameters: "/s /m=CodeSiteToolsSetup.txt"; StatusMsg: "Installing CodeSite logging tool..."; Description: "CodeSite debugging log viewer";
#endif

Prevent Overwriting

One of the applications I wrote included a customizable dictionary and enabled spell-check. The customer had a lot of unique clients in their database and over time, built up a list in their user dictionary so the spell-check wouldn't flag them. I quickly learned to add a flag to the installation of the dictionary files so that if the dictionary files already existed, they would NOT be overwritten!

[Files]
Source: "AddictDictionaries\american.adm"; DestDir: "{userappdata}\{#AppName}"; Flags: onlyifdoesntexist
Source: "AddictDictionaries\autocorrect.adu"; DestDir: "{userappdata}\{#AppName}"; Flags: onlyifdoesntexist

Summary

There's so much more that InnoSetup can do than what I've shown. It can install fonts, register COM libraries, display a custom license agreement that must be accepted, prompt for and validate a serial number, add custom images to brand the installation steps, support multi-lingual messages, create desktop shortcuts, include other scripts, and more! Read through the documentation, search for scripts on Github, and ask for help on forums. When deploying to Windows, you likely don't need anything else!

Add new comment

Step Up Memory Leak Debugging

david — Thu, 30 Jan 2025 19:49:13 +0000

Step Up Memory Leak Debugging

The Problem

I've been working with a small team on upgrading several dozen accounting programs that have been maintained by programmers of varying expertise over the last three decades. All these programs are written in Delphi 5 and use the BDE for database access, several third-party libraries, and quite a large collection of hand-crafted components. As we upgrade this large code base to Delphi 12, we've been rewriting several of the libraries, replacing components, and swapping out the BDE with FireDAC. As can be expected, there's quite a bit of technical debt to deal with including duplicate functions, mysterious code without documentation, ignored compiler warnings, business rules tied to button clicks and BeforePost events, and of course, lots of memory leaks. It's a huge, multi-year endeavor and I'm constantly searching for ways to automate the process and find problems quicker in order to complete this migration before I retire!

While it may not be imperative to eliminate every single memory leak, it's wise to discover and remove as many as feasible, especially in code that could be reused; you never know how a small problem can be magnified if left untreated. One example of this I found in my discovery was a base data module that always loaded several records into a global object for convenient use throughout the program. In most cases, this was fine (disregarding the principal of avoiding global variables), but since this data module was used by other data modules there were some programs that indirectly used this base data module twice. Since the data module did not check to see if the global variable had already been allocated, the program ended up creating it twice but only freeing it once (wisely setting it to nil so it wouldn't inadvertently free it again). What's worse is that, depending on the scope of the calling methods, it's possible that different instances of the global variable would be accessed at different times and if values changed, it could lead to inconsistencies which are very hard to track down.

Started with FastMM4

I started using FastMM4 to find out how bad the problem was and quickly became discouraged. When the program exits, FastMM4 displays a list of types and byte counts of objects that were not properly freed. In a few of the larger programs, this list of small text nearly filled my screen! I would then need to look at the object types and hunt through the code for all instances of that object type and find the cases where it was created but not freed. This is a very long and tedious process for large programs with an abundance of memory leaks.

I started reading forum discussions and blog posts about debugging memory leaks and while there were several references to FastMM4 and praises over what it can do, I also found several references to a tool called, Deleaker. I had heard of Deleaker but had not taken the time to look closely. With renewed interest and a strong need for all the help I could get, I read the Embarcadero blog and followed it to the video. The demo was simple but showed promise, so I downloaded and installed a trial to see if it would help me debug faster.

And wow, was I impressed!

Introducing Deleaker

Deleaker works as both a stand-alone tool and as a floating menu tightly integrated with Delphi. (It also works with C++Builder, Visual Studio, and Qt Creator providing information about both managed and unmanaged code.) The setup instructions are simple and include steps on how to compile your applications with all the debugging info included to enable Deleaker to provide you with detailed information about the objects and memory allocation in your program. I was soon taking "before" and "after" snapshots of my compiled application and looking at the report.

I first chose a small project that had a small number of memory leaks. Here's the FastMM4 report:

One thing I noticed in the FastMM4 memory leak summaries were several instances of UnicodeString. Strings in Delphi are automatically freed when they go out of scope so should never raise a memory leak error, right? Well, if they are part of an object that didn't get freed, then they're listed as one of the memory leaks along with the un-freed object itself. That makes sense and that's not an incorrect report, but it can be misleading.

Instead of a simple list of leaked objects, Deleaker provides an interactive window showing objects that were not properly freed and the line in which they were created. As you click on each one, it lists the hit count, size, process ID, thread ID, timestamp, and more. All of these are in a grid where each column header can be clicked to sort the list by that column. Additionally, the call stack that led up to that memory allocation is listed in the bottom portion of the window.

Here's the same program's memory leaks as shown by Deleaker:

This view is sorted by size, descending; the largest memory leaks are first. When I click on the first line, a TStringList, the source lines for each of the five instances are shown (highlighted) on the right. I clicked on the first source line and the call stack leading up to it is shown in the bottom.

If I click on the last reported memory leak, a TIniFile, it only has one instance, highlighted on the right with the call stack on the bottom:

For even more convenience, you can click the Show Source Code button which takes you right to that line in Delphi! Now, instead of hunting around for the source of a memory leak, I was taken directly to its source and could start evaluating the code immediately.

With a cleaner view of the problematic objects and a direct line to the source, I started cleaning up memory leaks much more quickly. But another advantage is that I had confidence that the line reported was the actual source of the leak. With FastMM4, all I had was a list of objects; it was up to me to figure out which of the 19 TStringList objects in this particular project led to the 5 reports of that object's leaks. In one case, I had seen an object created and freed and so had passed it by, thinking it was okay. However, Deleaker reported that this particular instance was not properly freed; upon closer inspection, I found it was in a base data module (the one I mentioned above) that used a global variable but since it was used by two descendant data modules (both used by the project), it was allocated twice; it's freeing code set the variable to nil so it was only freed once. Without Deleaker telling me I should look at that object more closely, it would've taken me much longer to find this one after eliminating the other possibilities.

In a different project, I had noticed several hundred UnicodeStrings reported by FastMM4 in a big list of memory leaks (rather overwhelming to the eye!). The list in Deleaker didn't show the strings but it's much more streamlined interface allowed me to see one particularly suspicious object. It stood out because it was reported as having hundreds of creation instances that matched the count of UnicodeStrings reported in FastMM4. Looking at the code, I found it was loading string fields from a database into an array and once I added the missing Free statement, the UnicodeStrings were no longer reported by FastMM4.

This is another example of how Deleaker improves memory-leak debugging: just being able to see the object types in a nice column rather than a tight, word-wrapped list in a small message box.

Even More

Here are a few more things about Deleaker you may have wondered about after seeing the screenshots above:

Up near the top is a drop-down for Allocation Types which allows you to filter certain types of objects out of the list the next time you take a snapshot.
You can take snapshots at any point during your program's execution, save them, and then compare with other saved snapshots for better analysis of different scenarios.
The Allocations tab, available for all languages, shows an ungrouped list of memory leaks and the line where each is allocated; the Delphi Objects tab (only available for Delphi, obviously) shows the same number of leaks but groups them by Delphi Object type making it a nicer view.
The Modules tab shows all the DLLs and BPLs which your program referenced.

There are other features in this product, several of which I’m not yet using. One of those is a command-line tool to provide automation within your continuous-integration environment. Read the Deleaker docs for more information and links to videos, tutorials, blogs, and more.

Disclosure

I should mention I was given a license to Deleaker in exchange for writing this blog post. However, it did not influence my excitement over this product which has already saved me hours of analyzing a large code base. They say time is money and for me, the price is quickly justified. [I would like to personally thank Artem Razin for this amazing product and for reaching out to me!]

Summary

Deleaker can speed up memory leak detection by an order of magnitude!

I don’t want to down-play the use of FastMM4 as an option to debugging memory leaks in your Delphi programs. It’s free, has well-written code and inline documentation, and was the first step to letting me know I had some problems with the code. FastMM4 also has lots of configurable options to help track down memory leaks, hook into processes, and even log many more details to a file for deep analysis. To enable these options, you have to read through a few hundred lines of a Pascal INCLUDE file and enable various compiler directives. Since it's free and open source, you should definitely start there.

Additionally, I’ve learned about its successor, FastMM5; it has been rewritten to be faster and while it’s still open source, it has a commercial license option. I first tried FastMM4, then got hooked on Deleaker so didn’t take the time to work with FastMM5.

In either case, the ease of use of setting up Deleaker and its ability to pinpoint the source of memory leaks and list the call stack rather than just a collection of leaked objects, has increased my productivity and reduced the reluctance to hunt down memory leaks. My experience with Deleaker has sped up memory leak detection by an order of magnitude!

You never came across…

DelphiCoder (not verified) Mon, 02/03/2025 - 05:28

You never came across madExcept (https://www.madshi.net/) or EurekaLog before?

They're light-weight on memory leak detection

david Mon, 02/03/2025 - 08:17

Yes, I've heard about these debugging aids for many years and even have a license to an old version of EurekaLog but they are geared more for locating bugs and reporting what caused an exception, especially when encountered at a customer location. On EurekaLog's website, it says its memory leak catching feature is light-weight to minimize the impact on end-user machines and even recommends other debugging tools. Deleaker is designed to be used by the developer and gives a lot of information that would not only confuse a customer but be totally useless to them.

I have not used madExcept but did not find anything on its help page about debugging memory leaks.

If you have experience about either of these tools that show how they help with memory-leak detection, please post it here.

I tried FASTMM5 and it is like FASTMM4

Alan Fletcher (not verified) Thu, 05/01/2025 - 01:04

I tried FASTMM5 and it is like FASTMM4 where memory leak reporting is concerned. I got used to read those files and sorting out pretty quickly what the problem was. So no big dela there. However, FASTMM5 also caused some weird VCL exceptions on the project I was working with. That made me start looking for another way of hunting leaks and I ran into your post.
Thanks Dave for a good summary of what Deleaker does - Sounds like I will be giving Deleaker a try soon.

Add new comment

AI Saves the Day

david — Sun, 27 Oct 2024 23:20:05 +0000

AI Saves the Day

Category

Miscellaneous

david Sun, 10/27/2024 - 16:20

An online customer encountered a rare problem with a database which stumped me; AI came to the rescue.

A friend of mine sells an insurance management system to agencies around the U.S. It's been a successful niche product for over 20 years, is written in Delphi 2007 so runs only on Windows, and uses the Firebird database on the back end. Until a few years ago, his customers all hosted their own local database server (or a designated user workstation) to hold the data. The application is very solid and chugs along with virtually no support calls related to corrupt databases.

About six years ago, his customers were clamoring for an online solution so he asked me to help and we set up a couple of servers and started hosting his software and database in the cloud. One of the servers runs the Firebird database which easily handles the 70-90 users among a couple of dozen insurance offices.

Recently we ran into a rare database problem. Every once in a great while, a PC will get disconnected from the database. Most of the time, the server recognizes it and cleans up the connection but in rare cases, it thinks the user is still connected. When this happens, the users is blocked and the only recourse in the past has been to restart the office database server. Each insurance agency has their own database but in the cloud, all the database requests go through one database server, so I didn't want to disrupt the other 80 or so users to get this one user back online.

I knew there must be a fix but I don't use the Firebird database very often and encounter errors like this even less so wasn't sure how to rectify the situation. After mulling over several possible ways to handle this, each with multiple downsides, I decided to ask AI for a suggestion.

Here's the short conversation I had with Claude:

DC: how do you tell firebird 2.15 to clear connections from a database?

AI: To clear connections from a Firebird 2.15 database, you can use the gfix utility with the -shut command. Here's how you can do it:

1. Open a command prompt or terminal.
2. Use the gfix command with the following syntax:
gfix -user SYSDBA -password masterkey -shut -force 0 database_path
Replace masterkey with your SYSDBA password if it's different, and database_path with the full path to your Firebird database file.

The -shut option shuts down the database, and -force 0 disconnects all users immediately.

3. After running this command, the database will be shut down and all connections will be cleared.
4. To bring the database back online, use:
gfix -user SYSDBA -password masterkey -online database_path
This method forcibly disconnects all users, so use it cautiously in a production environment. If you need a less disruptive approach or more specific control over which connections to clear, you might need to use Firebird's monitoring tables to identify specific connections and then use the API to terminate them individually.

Would you like me to explain any part of this process in more detail?

I was able to apply this fix quickly and it only affected this one insurance office, which was soon back to work.

This is the main reason I'm loving AI and using it more and more: it can find things I've forgotten about very quickly. It also allows me to be a jack of many trades and look like a master of all!

Only problem with AI …

Thomas Müller (not verified) Mon, 10/28/2024 - 00:49

Only problem with AI (including Claude) is that it provides plausible sounding answers that are wrong or misleading. A few days ago I asked Claude for a Delphi implementation of Timsort. What I got looked plausible but it simply didn't work. It sorted about 10 entries correctly and but broke for more. The same happened with ChatGPT on other occasions with completely other topics. That makes me wary of anything those hyped "helpers" suggest.

Being wary is good.

david Mon, 10/28/2024 - 08:36

I do not promote the idea that one should take a suggested AI answer and use it as a solution without verification. What I have found is that it either jump-starts ideas and thinking about how to solve a problem or, as in the case mentioned in this blog, reminds me of a tool I can use. I checked the documentation, verified the syntax, ran the command, and verified with the user the problem was fixed.

AI is not doing my work for me, it's not going to replace my job as a professional programmer that understands user needs or application context or can test to see if a suggestion is a proper solution. It is, though, becoming a helpful research assistant.