The other day I was running Microsoft's malicious software removal tool and, to my shock and horror, it did not remove all of my ASP.NET applications that make use of ViewState. I'm sure it's just an oversight and Microsoft will be releasing a patch for that soon... if there is one application that could be called malicious, it's an app that uses ViewState.

Before I get into the rant proper, let's have a little history lesson. Back in the good old days when developers walked uphill both ways to their cubicle in the freezing snow and hail - there was "classic" ASP. This festering boil on the ass of developers everywhere allowed a big old pile of VBscript to be run inside a file that was also littered with markup. Eventually developers came up with some good practices (like doing everything in a Sub Main, etc) but the end result was still awful spaghetti and it was often very difficult to code multi-state pages because, well, you had to maintain all that state information yourself. Whether your page was in edit mode, confirmation mode, or edit + rainbow + candle mode - all stuff you had to code by hand.

So along comes ASP.NET. The people at Microsoft saw the developer difficulty in using ASP and thought, "We should make the web development experience feel like the windows development experience, with double-click-to-create event handlers!"

Nooooooooooooooooooooo! For the love of all that is good and geeky, Noooooooooooo! Web development should feel like web development dammit!! Web evelopment can feel like web development and still be fun and elegant and easy!!

So.. to give developers the feeling that they're working in a windows world, even though they're on the web, the ASP.NET folks created ViewState. To imagine what this was like, picture one of those mad scientist laboratories where they're working on creating some kind of godzilla-mothra hybrid..they jam 1billion volts into it and it wakes up and spontaneously gives birth to a baby alien-monster... that's ViewState.

You can see a dramatic re-enactment of the birth of ViewState below. You can see the baby ViewState has escaped the host's stomach and is attempting to bring forth an era of dark evil the likes of which mankind has never before experienced....

While their heart was in the right place, the implementation is just downright nasty. The web is not a windows development platform and the simple act of forcing developers to think about their web pages in terms of events and postbacks created a fundamental break between what's really happening on that page and what the developer's are dealing with. This eventually led to the abuse of ViewState, where everything shows up in that damn state bag. I've looked at the inside of some pretty retchid ViewState and I've been appalled by what I've seen. I'm positive that most developers have no clue what's inside the ViewState their page is generating. Many of them assume that because ViewState is a Microsoft invention, it's efficient and can't be abused.

I've seen pages become anywhere from 300KB to 300MB (that's right, MB!) because of ViewState bloat. This creates a burden on both the server and the client: the client has to hold onto that bag and re-transmit it every time and the server has to de-serialize that insanity at the start of every request.

I'm sure there will be people who comment on this blog that ViewState is good if used by properly disciplined people. Sure, that's true, I've done it myself - if you spend a ridiculous amount of time optimizing the use of ViewState by your pages, you can trim it down so you're probably only adding 20-30KB of extra text to the rendered output. My advice, of course, is to simply not bother.

There are two avenues to take here:

1. Use ASP.NET MVC instead. Finally you can go back to programming like a web programmer and ditch the stupid ViewState/Event/Postback goo.
2. Turn off ViewState. Turn it off system-wide and disable it on every page and user control. Then refactor your entire application to survive without it. Or, if this sounds like too much trouble, see #1 :)

Yes folks, this is a rant so I've deliberately exaggerated some of my opinions. For example, I do not believe that ViewState was birthed by an alien-monster hybrid in a lab. Come on, that's totally unrealistic. I do, however, believe that ViewState is the froo-it of the dev-il. That's for realz.

Also, bonus points if you can name the movie from which the "froo-it of the dev-il" reference originates :)