It took about a day for ServerPronto to reply that my cancellation request has been accepted. It looks like I'll be off the hook next month.
Maybe I got lucky. Maybe all the complaints come from people who didn't send the correct documentation. Maybe ServerPronto has made an effort to improve lately. Whatever it is, I can't complain.
I'm on to larger hard drives, faster processors, and bigger bills. It was great while it lasted, ServerPronto. Thanks.
I've had a server at ServerPronto for almost four years. I had one of their "Starter" servers, and it worked well for what it was. I learned a lot managing my own server, and I never had a problem with the hardware or the network.
But now it's time to move on, and I'm a little worried because of the trouble I've heard other people have had trying to cancel their service.
It seems that ServerPronto has a habit of ignoring cancellation requests and doing everything to be unhelpful in the cancellation process.
The cancellation form in itself is daunting. They require a lot of information, stuff that I don't like sending to anyone. My driver's license, and front and back of my credit card. If anyone working at their company decides to use my card for a online shopping spree, they have all the information they need.
But I've filled it all out and sent it to them, as I documented in this video. I'll document the response I get from them as soon as it comes.
Crap happens, and it just happened to iContact.com
I've had a Google Apps Gmail account for a few years now, and I really like it. I never get spam, the large capacity is great and the interface and features can't be beat.
One of those features is a catch-all email address. That is, you can set up your email to receive all mail directed to any user at your domain. If you own example.com, you could have tom@example.com, dick@example.com and harry@example.com all come to your inbox.
Why would you do that, though?
One reason is to determine if any company you give your email address to leaks your address to other parties.
For example, you sign up for untrustyshop.com with the email address untrustyshop@example.com. If next week you notice a lot of advertisments coming to your inbox sent to untrustyshop@example.com, you know that untrustyshop.com has somehow mishandled your email address.
So I've been wondering why I was suddenly getting spam at two unique email addresses at my Google Apps domain. After a more detailed examination of previous messages to those addresses, I noticed both were sent by iContact. A Google search confirmed my suspicion that iContact.com's data had been compromised.
It seems, they lost their email list to hackers. They try to bury it in a bunch of other good-intentions drivel in their blog, but the key sentence is "Based on the information we have, the subscriber email address is the only data affected."
An embarrassing exhibition of incompetence in your professed area of expertise can't be good for business.
On the other handle, the great Google itself has had trouble recently with compromised data.
Security is hard.
What is going to happen when these tiny URL services meet the extended URL character set that is taking effect as we latin-centric ignoramuses sleep?
Blam!
Insanity!
Tweets will be full of links like http://集.働
I just stole those characters from The Japan Times Online and I have not idea what they mean.
Looking through the Facebook API and sipping a beer, the thought occurred to me that Facebook was like AOL.
Of course, someone else had thought about this before me.
Security means limited access, and the access limits have to be simple to define and universally valid.
It is ostensibly easy to configure a web server to do the following, "Only give outside access to this HTML form and the result page."
But because of the various layers involved in a web form and result page, a person intent on gaining more access might inject some clever SQL that writes a file containing some script to the disk. Then they could request the server pull up that file, and gain control of a whole lot more than was intended.
Although it was simple to define the access limits in the example, they were not universally valid due to the complexity of the application stack.
It is that complexity that makes security such a difficult endeavor. It is beyond a single developer's ability to foresee all the ways in which people will abuse their creations. And even some foreseen threats must be left unaddressed due to various constraints.
Imagine a building contractor hired to create a house that not only stood up to the wind and rain, but also was safe against every sort of bulldozer, wrecking ball, tank and bomb that other human's can construct.
Designing secure software is less like designing a building and more like designing crumple zones for automobiles. People will destroy the machine. The hope is for a graceful wreck where the important parts come out intact.
If twitter does anything, it will bring us one step closer to a successful Turning test.
It will do this in two ways:
A while ago one of my favorite clients wanted an application that would basically set her up as an ASP. My client planned to charge a yearly fee for access to a customized version of this application. While each instance of the application would have its own database and style sheet, the application logic would be the same for all instances.
As it was, each instance would be accessed under its own subdomain. Therefore, I could have created a separate cakePHP installation for each subdomain, but I decided against that approach because bug fixes or enhancements would then need to be applied to each instance, one-by-one. I decided instead to share the cake and app folder, so application updates would only have to be applied once.
The file system on the web host was set up like this:
main_folder --public_html --subdomain1_folder --subdomain2_folder
Each instance got its own copy of the webroot folder in the subdomain's folder. That way I could customize the contents of the css, img, and js folders, thereby changing the style of each instance. The resulting file system looked like this:
main_folder
--app
--cake
--public_html
--subdomain1_folder
--css
--img
--js
--index.php
The copy of index.php that is in each subdomain folder had to be modified so that ROOT and APP_DIR are correct. Also, I added a new constant called CLIENTDB that is the name of the database config in the DATABASE_CONFIG object--more on that below.
With some help at the cakePHP Google Group I simply added each new database to config/database.php in the standard manner. With that set up, at runtime, the application knows which database to use because of the line
var $useDbConfig = CLIENTDB;which I added to app_model.php. If you remember from above, CLIENTDB was defined in index.php, the entry point for the application, which is unique for each subdomain. I just had to make sure what I defined CLIENTDB to be matched the variable I created in config/database.php.
If, to you, making those modification by hand for each new subdomain seems like a pain in the knuckles, you and I think alike. To make setup of a new domain easier, I created a database to that stored the database and other configuration information for each instance of the application. I called it the manager database.
With the manager database I was able to modify config/database.php. Instead of a static list of databases, I made a call to the manager database and pulled in each subdomain's database configuration dynamically. I've posted an example of the new database.php.
The next step was to create a manager application that created the instance database, copied a standard webroot folder into the subdomain's folder and created the customized index.php file with the new CLIENTDB. Then I even created a script to automatically set up the subdomin.
In the end, I had a manager that generated an entire working instance of the application from a simple form that my client could use.
This morning at 9:00:00 PST, I turned the software switches that opened Linkbidr to the public.
It's a great feeling to finish a project. Even if it is mundane (this one wasn't), having a complete working site is a source of pride. I might not have came up with the concept, but it is my ingenuity and knowledge that made everything work according to spec.
So today I will click through the links, over and over again, knowing what will happen, because I made the links and because I've clicked them a dozen times already, but I still do it, polishing the mirror of my vanity.
This particular site is an interesting concept, and I don't know if it will catch hold. But it the first site I have built that aimed to be "Web 2.0".
Of course, "Web 2.0" isn't a well-defined term. This site has AJAX-ish functionality, and it has javascript effects. It has a community, kinda. And finally, the site name doesn't have an 'e'. That's as good an indicator as anything that it is Web 2.0.
Good luck Linkbidr.
A fews days ago I decided the time was nigh to install Linux on my development machine. My standard tools were already free, Apache, MySQL, PHP, Open Office, GIMP, Inkscape, one exception being TextPad, but I'm sure there is a suitable alternative. Hell, I'm pretty good with vi, ;-) or I remember liking emacs back in college.
Anyway, the time was nigh. So I started the download for Ubuntu 7.04 - the Feisty Fawn.
It went pretty smoothly. I had to start Ubuntu in safe graphics mode after getting no picture. Then after some worrying over the partitions I installed the system.
I spent a couple of hours trying to get my dual monitor setup working. It turned out to be simple matter of turning on the Nvidia driver in the Restricted Drivers Manager and using nvidia-settings.
The hard part was getting wireless networking functioning. Eventually, I followed the steps outlined in this article. I had to uninstall Network Manager and run sudo modprobe bcm43xx but now my precious Internet connection is working—without having to string a Cat5 from my laptop.
All in all, it's been the easiest Linux setup ever. Of course, I'm more knowledgeable about how things work these days. But a large part of it is the community around Ubuntu—they seem to have a large enough user base to support most common problems.
I've been using CakePHP for over a year. Without it, I probably would have stopped using PHP and switched to python or maybe squeak and seaside.
More and more, the strengths of the framework and my increasing knowledge of it make its forfeit an expensive proposition.
Now I'm up-ing the ante and releasing my own component. It doesn't do a whole lot, but I find it useful.
I've been using the code for most of my projects, although it was embedded in the controllers and customized.
As the month drew to a close and I had yet to write a blog post—again—I decided to distill the logic and give it to the sober masses.
But enough of the fascinating story behind the component, let me tell you how to use it.
soySearch creates criteria for a findAll query. All you have to do is pass it the search fields like this
$this->data['Search']['Modelname.fieldname']
So if you wanted your users to be able to search the body of your blog posts you could make a form like:
<form method="post" action="/posts/index/"> <input type="text" name="data[Search][Post.content]" /> <input type="Submit" value="Search" /> </form>
In your controller you include the component:
var $components = array('soySearch');
In the action you invoke the component:
function search() {
$this->Post->recursive = 1;
$criteria = array();
$criteria = $this->soySearch->getCriteria($criteria);
$this->set('posts', $this->Post->findAll($criteria));
}
Notice you can pass any pre-existing criteria to the component.
Try it out:
An additional feature is the ability to save the search to the session and recall it for later use. Just add the query string parameter newSearch=0 to the form action and the search will be stored in the session. I use it with the pagination component so I can order and page my resultset.
I am working on a simple site for a video production company. Today I was trying to use PHP includes for site navigation and other repeating elements. Alas, when I uploaded my scripts to a development folder on the client's server, the PHP files were not recognized.
The error displayed in the browser was FILE NOT FOUND. But curiously, the title bar displayed 401 Authorization Required. At first I thought my client was on a Windows server, and I would have to dust off my ASP hat. But he assured me that he had a UNIX plan and gave me the login information to the hosting control panel.
I've never trod upon Network Solutions' cyber-lawn, but it's mowed for newbies (you know, n00bz). I couldn't find anything to change the apache or PHP configuration. However, the overview page did say PHP was "available".
To make a long story short, I decided to use the WordPress installer. I knew WordPress was written in PHP, and I figured the installer would flip some configuration switches that I didn't know how to get to.
As I suspected, after WordPress was installed, my PHP files begin working. I uninstalled WordPress, and my scripts still worked. So my problem is solved, except I don't know why.
This is another post about the fight against bots. This time it is email-address-harvesting bots that I'm worried about.
Here are five of the variety of techniques employed to obscure email addresses.
Technique 1 will fool most bots, but it makes it more cumbersome to send an email, since the user can't copy and paste.
Using technique 1 you could create the image by hand, if there were only a small number of addresses, and a change of address was rare. But if you had many addresses, say from registered users, then you would have to use programmatic image creation tools. PHP offers good support for this sort of thing. You can install the python imaging library to do the same stuff in python. And other languages probably have similar capabilities.
Example:
Technique 2 is used in the comments of the php.net site. While this is a fairly safe method for displaying your address on a public site, it is not immune to a intelligently designed bot. I would think of some original formatting before posting my address like this. Example:
Technique 3 is simple to use and probably escapes detection by simple bots. But even marginally intelligent bots will strip the html tags from a page.
| joe | @ | example | .com |
Technique 4 is a more effective alternative to using tables. The idea is to construct elements that do not appear in the correct order in the markup, but then use CSS positioning to put them in the correct order.
This technique will fall under the radar of most bots. However, this technique generally breaks copy and paste. Example:
Technique 5 will escape detection by all but the most advanced bots. Because bots look at a web page as static text, they will not be able to detect changes javascript makes to the document. And if you require user interaction like mouse over, it makes it doubly safe. However, this technique will not work for browsers without proper javascript support. Example:
After writing this I did a Google search and found A more thorough take by Sarven Capadisli
I do not bill myself as a designer because I have so little experience designing things. But this month I was hired to create a small, informational site for an engineering firm. My plan was to hire a designer and give them most of the budget while limiting my involvement to the contact form script.
However, my designer was busy, so I figured I would tackle the project myself.
The design was not that hard. I just modified a template from Open Source Web Design. The fun part came when I decided to write a fade-out, fade-in routine to highlight the strengths of the company.
I am covering ground already worn bare by more competent javascript developers, but I decided to write it myself both as a learning experience and to avoid the bloat that comes with some of the javscript libraries.
Two hours later I had the amazing effect you can see below.
A shortcoming is that is fades to white. Maybe, I should add another variable in the script so the background color can be set. On the other hand, it gives it a sort of glimmer on this background.
For diddlers everywhere I have created the virtual ball-puzzle scale. You can test out your solution systems. Or just mess around. It's so much fun, I would not be afraid to call it mildly interesting.
During a recent bit of downtime, I came across this post about a type of puzzle programmers sometimes get asked during a job interview.
The gist of the puzzle is given n apparently identical balls and a simple scale, how many weighings would it take to find the ball with a mass different from the others.
There is an easier version of the puzzle where the odd ball is guaranteed to be heavier than the others. And a harder version were the odd ball can be either heavier or lighter.
Before, I never had the patience to figure out the answer to this sort of puzzle, but using this tool, I have come up with a general solution when n < 4.
So the first CAPTCHA system with the images was not user-friendly.
This time I think I will stick to a text-based system. It will pose simple arithmetic word questions. For example, "If you have 617 beans and a cowboy appears and gives you two more beans, how many beans do you have?"
The only problem with such a system is it is weak, due to the speed at which computers can generate numbers to try.
I can increase the strength of the system by adding another question. I still want to do something with images. So I think I'll have a little generated image of a box and a circle. Then I'll ask if the circle is inside the box.
And to top it off, I'll only allow five attempts from the same IP address within the space of an hour.
A bit complicated and probably not that well thought out, but it gives me something to do.
There are so many things that need to be done with this blogging platform. Several functions are still in the state the bake script left them. And I want to add more stuff.
And for that I have decided I need a CAPTCHA.
I could use PHP's GD library to create your standard distorted-text-on-busy-background CAPTCHA, but I want to try something else.
I am thinking of a row of simple images--squares, triangles and circles. I will generate the images with GD so the file names are the same. Let's say there will be 20 images in the row.
I will generate some instructions tell the user which six images to use. The candidate user will then have to type in the color and shape of those six images. I will only have four colors and three shapes, so the users will abbreviate. For instance, a red square would be 'rs'.
That allows for 4^6*3^6 = 2985984 combinations, which would be good enough for my site. And with a little help from IP logging, it would probably be good enough for any site.
Here's a mockup:
| colors: | shapes |
|
red = r blue = b green = g yellow = y |
circle = c square = s triangle = t |
Enter them in the order specified.
Update: I had my brother test this out. It sucks. I'll come up with something simpler.
Whoever has been working on the bake script is doing a good job. The last time I used it, it was a one-shot utility controlled by command line options. I stopped using it after one try because I figured I could hammer out the scaffolded models / views / controllers in as much time as it would take me to learn the command line options.
Now it is an interactive experience equal to the best choose-your-own-adventure novel.
Of course a "baker" still has to customize the generated code. But that is expected, and I find it much easier to start with a skeleton, however far it be from the final beast.
At the start of the small projects I like to write out a description of the system in plain English. Then I identify the nouns. That set of nouns gives me an idea of the tables in the database. You can also identify the verbs and match those up to methods in your code, but I find that less useful.
An author logs in to create posts. Readers read posts. Readers log in to create comments about posts. The author can modify and delete posts. The author can group posts into categories.
Nouns: Author, posts, readers, comments, categories
I am going to call authors and readers "users." But the other nouns will go straight into the database. So my tables are going to be
users
posts
comments
categories
Now that I have my database prepared, I will use the bake script to generate my models and controllers.